Submitted URL: http://dreambook.in.ua/
Effective URL: https://dreambook.in.ua/
Submission: On December 05 via api from GB — Scanned from GB

Summary

This website contacted 25 IPs in 4 countries across 24 domains to perform 139 HTTP transactions. The main IP is 2606:4700:3031::ac43:cd91, located in United States and belongs to CLOUDFLARENET, US. The main domain is dreambook.in.ua.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 9th 2022. Valid for: a year.
This is the only time dreambook.in.ua was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 16 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a02:6b8:20::215 208722 (GLOBAL_DC)
12 2a00:1450:400... 15169 (GOOGLE)
1 49.12.80.41 24940 (HETZNER-AS)
4 9 2a02:6b8::1:119 208722 (GLOBAL_DC)
16 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
27 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a02:2638:1::2 44788 (ASN-CRITE...)
2 2a02:2638::b 44788 (ASN-CRITE...)
14 2a02:2638:1::3 44788 (ASN-CRITE...)
2 178.250.0.160 44788 (ASN-CRITE...)
2 2600:9000:223... 16509 (AMAZON-02)
2 4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
12 2a02:2638:1::8 44788 (ASN-CRITE...)
2 2a02:2638:1::17 44788 (ASN-CRITE...)
1 2a02:2638::2 44788 (ASN-CRITE...)
1 1 3.74.33.199 16509 (AMAZON-02)
5 142.250.185.194 15169 (GOOGLE)
2 2 69.192.160.219 16625 (AKAMAI-AS)
1 34.98.67.61 396982 (GOOGLE-CL...)
1 35.227.252.103 15169 (GOOGLE)
1 1 69.173.144.165 26667 (RUBICONPR...)
2 2 172.64.154.237 13335 (CLOUDFLAR...)
6 2a00:1450:400... 15169 (GOOGLE)
139 25
Apex Domain
Subdomains
Transfer
39 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 109
tpc.googlesyndication.com — Cisco Umbrella Rank: 144
495 KB
28 criteo.net
static.criteo.net — Cisco Umbrella Rank: 675
pix.eu.criteo.net — Cisco Umbrella Rank: 7434
csm.eu.criteo.net — Cisco Umbrella Rank: 7693
59 KB
19 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 39
cm.g.doubleclick.net — Cisco Umbrella Rank: 234
120 KB
16 dreambook.in.ua
dreambook.in.ua
88 KB
6 gstatic.com
fonts.gstatic.com
114 KB
6 criteo.com
rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 12307
ads.eu.criteo.com — Cisco Umbrella Rank: 7380
cat.fr.eu.criteo.com — Cisco Umbrella Rank: 9516
rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 14766
108 KB
6 google.com
adservice.google.com — Cisco Umbrella Rank: 87
www.google.com — Cisco Umbrella Rank: 2
2 KB
6 yandex.com
mc.yandex.com — Cisco Umbrella Rank: 8380
3 KB
4 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 190
190 KB
3 yandex.ru
mc.yandex.ru — Cisco Umbrella Rank: 3018
57 KB
2 casalemedia.com
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 467
2 KB
2 addthis.com
e.dlx.addthis.com — Cisco Umbrella Rank: 2007
1 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 51
2 KB
2 imrworldwide.com
secure-gl.imrworldwide.com — Cisco Umbrella Rank: 1575
1 KB
2 google.de
adservice.google.de — Cisco Umbrella Rank: 7808
914 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 351
463 B
1 openx.net
rtb.openx.net — Cisco Umbrella Rank: 1824
351 B
1 mookie1.com
odr.mookie1.com — Cisco Umbrella Rank: 1148
356 B
1 agkn.com
d.agkn.com — Cisco Umbrella Rank: 669
763 B
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 942
699 B
1 minergate.com
minergate.com — Cisco Umbrella Rank: 285576
8 KB
1 yandex.st
yandex.st — Cisco Umbrella Rank: 101046
15 KB
0 gemius.pl Failed
googlecm.hit.gemius.pl Failed
0 yandex.ua Failed
mc.yandex.ua Failed
139 24
Domain Requested by
27 tpc.googlesyndication.com googleads.g.doubleclick.net
tpc.googlesyndication.com
dreambook.in.ua
pagead2.googlesyndication.com
16 dreambook.in.ua 1 redirects dreambook.in.ua
14 static.criteo.net ads.eu.criteo.com
14 googleads.g.doubleclick.net pagead2.googlesyndication.com
googleads.g.doubleclick.net
dreambook.in.ua
12 pix.eu.criteo.net ads.eu.criteo.com
12 pagead2.googlesyndication.com dreambook.in.ua
pagead2.googlesyndication.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
www.googletagservices.com
6 fonts.gstatic.com fonts.googleapis.com
6 mc.yandex.com 3 redirects dreambook.in.ua
mc.yandex.ru
5 cm.g.doubleclick.net googleads.g.doubleclick.net
dreambook.in.ua
4 www.google.com 2 redirects googleads.g.doubleclick.net
tpc.googlesyndication.com
4 www.googletagservices.com googleads.g.doubleclick.net
3 mc.yandex.ru 1 redirects dreambook.in.ua
2 ssum-sec.casalemedia.com 2 redirects
2 e.dlx.addthis.com 2 redirects
2 csm.eu.criteo.net ads.eu.criteo.com
2 fonts.googleapis.com tpc.googlesyndication.com
2 secure-gl.imrworldwide.com ads.eu.criteo.com
2 cat.fr.eu.criteo.com ads.eu.criteo.com
2 ads.eu.criteo.com googleads.g.doubleclick.net
2 adservice.google.com pagead2.googlesyndication.com
2 adservice.google.de pagead2.googlesyndication.com
1 pixel.rubiconproject.com 1 redirects
1 rtb.openx.net googleads.g.doubleclick.net
1 odr.mookie1.com googleads.g.doubleclick.net
1 d.agkn.com 1 redirects
1 rtb.fr.eu.criteo.com googleads.g.doubleclick.net
1 rtb.nl.eu.criteo.com googleads.g.doubleclick.net
1 partner.googleadservices.com pagead2.googlesyndication.com
1 minergate.com dreambook.in.ua
1 yandex.st dreambook.in.ua
0 googlecm.hit.gemius.pl Failed googleads.g.doubleclick.net
0 mc.yandex.ua Failed dreambook.in.ua
139 32

This site contains links to these domains. Also see Links.

Domain
ru.dreambook.in.ua
us.dreambook.in.ua
minergate.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-09 -
2023-06-09
a year crt.sh
*.yastatic-net.ru
GlobalSign ECC OV SSL CA 2018
2022-08-31 -
2023-02-28
6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.minergate.com
Sectigo RSA Domain Validation Secure Server CA
2021-09-23 -
2022-09-28
a year crt.sh
mc.yandex.ru
GlobalSign ECC OV SSL CA 2018
2022-10-18 -
2023-03-30
5 months crt.sh
*.googleadservices.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.google.de
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.nl.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-10-10 -
2023-01-10
3 months crt.sh
*.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-10-14 -
2023-01-13
3 months crt.sh
*.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-11-08 -
2023-02-04
3 months crt.sh
*.fr.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-09-27 -
2022-12-29
3 months crt.sh
*.imrworldwide.com
DigiCert TLS RSA SHA256 2020 CA1
2022-01-04 -
2023-02-03
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.eu.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-11-01 -
2023-02-04
3 months crt.sh
www.google.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh
*.mookie1.com
DigiCert TLS RSA SHA256 2020 CA1
2022-02-24 -
2023-03-27
a year crt.sh
*.openx.net
GeoTrust RSA CA 2018
2022-07-21 -
2023-08-21
a year crt.sh
*.gstatic.com
GTS CA 1C3
2022-11-02 -
2023-01-25
3 months crt.sh

This page contains 16 frames:

Primary Page: https://dreambook.in.ua/
Frame ID: 9124D2454C12BB10DE1A27DF79AECC26
Requests: 34 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/zrt_lookup.html
Frame ID: 6C0A1BC5070613CBF9FF732666DAD1B1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Frame ID: 49E7CC6AD1854ED36CEAEF87C4DE3AF7
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Frame ID: 701716AC884023E641EB8B89A613DF65
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&adk=1812271804&adf=3025194257&lmt=1670246445&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fdreambook.in.ua%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444953&bpp=1&bdt=535&idt=384&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250%2C300x250&nras=1&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=388
Frame ID: 15C1F244F96C8D9C27E2916DB6A46629
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Frame ID: CA4844BD0127F81C83D56DA194438BB5
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Frame ID: 8778A499946C607CAC3ED72992E090A6
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Frame ID: 3EA44B411ADEBA29A62F0A33C9CED2E4
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Frame ID: BF9BDBB6B5BEA1F31B12057E535384DE
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: E560B0D69C5531F8CC5A82D802B578DE
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Frame ID: E4BCE5005A50B546D670D715A89C7814
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 029796B5680C17BB07CFFBBCEFE52600
Requests: 2 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Frame ID: AC595EFF6A15048F8A8F688EBD3F83C9
Requests: 16 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 79BB0D9EC415B14389EF4459DF757C1B
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: CD7788C8AA351ABB08B8714EFFC318A9
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DF3F8F3E933BB794F09F17CEC267219D
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Онлайн сонник: тлумачення снів безкоштовно по 100 сонникам - Dream Book

Page URL History Show full URLs

  1. http://dreambook.in.ua/ HTTP 301
    https://dreambook.in.ua/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <input[^>]+name="__VIEWSTATE

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

139
Requests

94 %
HTTPS

68 %
IPv6

24
Domains

32
Subdomains

25
IPs

4
Countries

1261 kB
Transfer

3302 kB
Size

35
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://dreambook.in.ua/ HTTP 301
    https://dreambook.in.ua/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9843.IaCX2glVS4vRhqOT4iN7FCRbnEd0RrVneBZzANJjeuLlL2ZUt2oRFL8obhWitNUn.Gn02CJWt7Uk4xgAdCy-udFLaWZk%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9843.AkvsNSrTSLTf0R1USCHmQkRjzSPfkGHCxhLuc5vsKVcYM0t6zT4nknvUrRmO60HgCUvqrHDgzHc56dwGk1YiyiqT-JruTJZFN8nGvrS4IV0%2C.zTYR94lzvDqe-6Q3IrDhIhlEiqE%2C HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=9843.9LTM_tmCvN6acGCDEAycx6R1R-2i5ABpIHqU0Ve7EGmkwqAVjV_q3X-iMdVPyntysyZgdHFcUx6kGGfYGPaDMdsAGRUzhTRFb1ijEu7V_oMCxaSqF9kkdX3uz5AFOD3GZKZy9v7vnvOqJdOq6x9vrDmXovyRqqtZAQ1H6J5vByKTEHyQcaQRmO9C7JKccamQSe2LJ6kCKf775DQ867ulKA%2C%2C._Lf9Cg8LaKJ1XjWi05M73IsyP6w%2C
Request Chain 23
  • https://mc.yandex.com/watch/35172605?wmode=7&page-url=https%3A%2F%2Fdreambook.in.ua%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Assb7e99gu042u1d5clb78%3Afp%3A527%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A933%3Acn%3A2%3Adp%3A0%3Als%3A852941490838%3Ahid%3A134169789%3Az%3A0%3Ai%3A20221205132045%3Aet%3A1670246445%3Ac%3A1%3Arn%3A234617747%3Arqn%3A1%3Au%3A1670246445225849332%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A1%2C99%2C85%2C17%2C147%2C0%2C%2C194%2C8%2C%2C%2C%2C796%3Aco%3A0%3Acpf%3A1%3Ans%3A1670246444081%3Arqnl%3A1%3Ast%3A1670246445%3At%3A%D0%9E%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%3A%20%D1%82%D0%BB%D1%83%D0%BC%D0%B0%D1%87%D0%B5%D0%BD%D0%BD%D1%8F%20%D1%81%D0%BD%D1%96%D0%B2%20%D0%B1%D0%B5%D0%B7%D0%BA%D0%BE%D1%88%D1%82%D0%BE%D0%B2%D0%BD%D0%BE%20%D0%BF%D0%BE%20100%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%D0%B0%D0%BC%20-%20Dream%20Book&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
  • https://mc.yandex.com/watch/35172605/1?wmode=7&page-url=https%3A%2F%2Fdreambook.in.ua%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Assb7e99gu042u1d5clb78%3Afp%3A527%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A933%3Acn%3A2%3Adp%3A0%3Als%3A852941490838%3Ahid%3A134169789%3Az%3A0%3Ai%3A20221205132045%3Aet%3A1670246445%3Ac%3A1%3Arn%3A234617747%3Arqn%3A1%3Au%3A1670246445225849332%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A1%2C99%2C85%2C17%2C147%2C0%2C%2C194%2C8%2C%2C%2C%2C796%3Aco%3A0%3Acpf%3A1%3Ans%3A1670246444081%3Arqnl%3A1%3Ast%3A1670246445%3At%3A%D0%9E%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%3A%20%D1%82%D0%BB%D1%83%D0%BC%D0%B0%D1%87%D0%B5%D0%BD%D0%BD%D1%8F%20%D1%81%D0%BD%D1%96%D0%B2%20%D0%B1%D0%B5%D0%B7%D0%BA%D0%BE%D1%88%D1%82%D0%BE%D0%B2%D0%BD%D0%BE%20%D0%BF%D0%BE%20100%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%D0%B0%D0%BC%20-%20Dream%20Book&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29
Request Chain 63
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 95
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 101
  • https://d.agkn.com/pixel/2175/?google_gid=CAESELfIzrkQri25wtUqeaacjK8&google_cver=1&google_push=ASkJ3FbuH8UsJasHH7gdvopCHGL3oyHgoJ09dGXm871A0HdX4eyzrj2pgfXaaCgwuTIbfp-7owoBabMPSYusyLhcuyes2G9Jsw9mdQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3FbuH8UsJasHH7gdvopCHGL3oyHgoJ09dGXm871A0HdX4eyzrj2pgfXaaCgwuTIbfp-7owoBabMPSYusyLhcuyes2G9Jsw9mdQ&google_hm=Q0FFU0VMZkl6cmtRcmkyNXd0VXFlYWFjaks4
Request Chain 102
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DASkJ3FaZ412T4hSuxu6efIWZoWbTy2wEFcfqPyGqlWr-d8LbeJI4V-VuBXKSwyZ6pG4Ljj4fYG62SCZ8KqiEV93l8HOIgHTv8kVZ&google_gid=CAESEAcqQ35uyRJfatunEfHMopU&google_cver=1 HTTP 302
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DASkJ3FaZ412T4hSuxu6efIWZoWbTy2wEFcfqPyGqlWr-d8LbeJI4V-VuBXKSwyZ6pG4Ljj4fYG62SCZ8KqiEV93l8HOIgHTv8kVZ&google_gid=CAESEAcqQ35uyRJfatunEfHMopU&google_cver=1&rd=Y HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEyMDUxMzIwNDcwMDA4MTYzNzU1NDA5MA%3D%3D&google_push=ASkJ3FaZ412T4hSuxu6efIWZoWbTy2wEFcfqPyGqlWr-d8LbeJI4V-VuBXKSwyZ6pG4Ljj4fYG62SCZ8KqiEV93l8HOIgHTv8kVZ
Request Chain 105
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENi52p4__ay8OYmTN-JGKRk&google_cver=1&google_push=ASkJ3FYri695AUcQ6EzHz-HL4p7s5XWw1LDRP_NhI8YFD2BWcvuPstXpuQa_ZVD1PvBobE9DwgvcMyUkPwrDYpTdn38BhksuIPPtuA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJBVExZRzktMjItOE5PNw==&google_push=ASkJ3FYri695AUcQ6EzHz-HL4p7s5XWw1LDRP_NhI8YFD2BWcvuPstXpuQa_ZVD1PvBobE9DwgvcMyUkPwrDYpTdn38BhksuIPPtuA
Request Chain 106
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_cver=1&google_push=ASkJ3FaDaZZ0FyMYTRVdjD1EkTrPK35XKif2b1kXVSCL4Qg-wr9v4vWpxawqFcEafgeqPmZ6uff7TspOIy-U97ANzoBb8nvmwjQMSw HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_push=ASkJ3FaDaZZ0FyMYTRVdjD1EkTrPK35XKif2b1kXVSCL4Qg-wr9v4vWpxawqFcEafgeqPmZ6uff7TspOIy-U97ANzoBb8nvmwjQMSw&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_hm=Y43wLuqKluuEWKzV16s74QAAFAwAAAIB&google_nid=index&google_push=ASkJ3FaDaZZ0FyMYTRVdjD1EkTrPK35XKif2b1kXVSCL4Qg-wr9v4vWpxawqFcEafgeqPmZ6uff7TspOIy-U97ANzoBb8nvmwjQMSw

139 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dreambook.in.ua/
Redirect Chain
  • http://dreambook.in.ua/
  • https://dreambook.in.ua/
62 KB
12 KB
Document
General
Full URL
https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
9ecc0b3e1f763edd8ef35fad325dba4d9dc9786369c255500dcee75e673ac000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private
cf-cache-status
DYNAMIC
cf-ray
774d14b53f3b76cf-LHR
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 05 Dec 2022 13:20:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KDe1Iy3%2Fv%2BhvOy6Nc0tFvZdPuAsHRM%2Fdnm2QMA0BGKuXuPMdN7Dl0JL3F3nuoTQ6ubBGGKVJ%2BvS4MlfID27QByER6Gi0TTInsho9Y7j5opfXMgPoIhS%2FP58MQ%2FsqZaLI66OgPdwoEa84%2BbUaOiw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-aspnet-version
2.0.50727
x-powered-by
ASP.NET

Redirect headers

CF-RAY
774d14b43c0088c1-LHR
Cache-Control
max-age=3600
Connection
keep-alive
Date
Mon, 05 Dec 2022 13:20:44 GMT
Expires
Mon, 05 Dec 2022 14:20:44 GMT
Location
https://dreambook.in.ua/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2FtOWBCD%2BLnE%2BPHkJzhyM7a8J7R%2Fv%2FAVBkPG1n13QUoWp6lYKxk8JnilRtLnK0j%2F7l0l9nyLAUEkOsgftZzZGPPhi0rdwVGlJr3gcD%2FCbvkUhlRfdFOIIafzNxJk6LumI9qLsYdGD%2BwxvuJxVUk%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
dreambook.in.ua/css/
17 KB
4 KB
Stylesheet
General
Full URL
https://dreambook.in.ua/css/style.css
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
7bd52a71b1144108d7ba13ec5c770ea3c99546a3209fcfe6cfe7231a49e53aa8

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Mon, 07 Mar 2016 21:54:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"0285fe9bb78d11:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IEWGcFhFzOH2EgnlnGv0zuVfyj6LqltyzBA0DC7n%2FL2sCkyThmr%2FiCHwL2%2FX1%2FMQW4WkrVN5wl5ULwsk5PwoMSNLXWxZglK48I82vUlzpBQIpY2q1lLq%2F0YQqk73vVJk7zXAgf9%2Fit9UTzTEQs4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=7200
cf-ray
774d14b5cfec76cf-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.js
dreambook.in.ua/js/
128 KB
45 KB
Script
General
Full URL
https://dreambook.in.ua/js/jquery.js
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
40a158fc874b49cac7b9d00073b49f01a3dd7fd933ec67a5ee31354104b57089

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Sun, 23 Dec 2012 22:49:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"0c3e6b35fe1cd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MYe6Ps6k4L%2FvZ1MVbvS1WYDrayFJwk%2Bnsc7LQuQr%2F1fg00ZC9a4y5tf8PBmwujzRko8KGk4xrO2NMwTBOHbJbNsNCJZJ8BsTokY3iFGCSCU0q7ZnyJ3725ksswgfKVGhMtYEupCLfpIGtAxQTSY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=7200
cf-ray
774d14b5cfef76cf-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
share.js
yandex.st/share/
53 KB
15 KB
Script
General
Full URL
https://yandex.st/share/share.js
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
nginx/1.17.9 /
Resource Hash
944979b576ee52348d5c63d35f566c11df26f70ed15d2ceba61180662a49b114
Security Headers
Name Value
Strict-Transport-Security max-age=43200000; includeSubDomains;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
strict-transport-security
max-age=43200000; includeSubDomains;
last-modified
Wed, 24 Oct 2018 16:00:42 GMT
server
nginx/1.17.9
nel
{"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
etag
W/"db7132f94e4730c128b638f72b46c899"
vary
Accept-Encoding
report-to
{ "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=216013
x-nginx-request-id
81f2254d9f7ac0b1
timing-allow-origin
*
expires
Thu, 08 Dec 2022 01:19:24 GMT
WebResource.axd
dreambook.in.ua/
20 KB
4 KB
Script
General
Full URL
https://dreambook.in.ua/WebResource.axd?d=gHJIrct29BQNeAZdYjgKi-6YPS_gJhZPDGU8UTy1SNMUadeiNzxeiIcOG50mADRfvbVZaMR3JQb2K2akIT-ehKLd4dA1&t=636284741271971599
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Sat, 22 Apr 2017 13:08:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-aspnet-version
2.0.50727
server
cloudflare
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ey2wkFQZTTZG6g3itf%2FA2Jp4gg%2FvGieXPnstV4GB%2BJA%2BvgqKu8rsDF3JVZ8JDn6jliTMtm8HfWOTVunh1ZHp7chMQGelm3%2BCL3PA3vusZKSrkWiAHOkqilwwkGrxkOOEnP35BqxtfZetBj7ZFzw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
cache-control
public
cf-ray
774d14b5cff076cf-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Tue, 05 Dec 2023 12:24:35 GMT
WebResource.axd
dreambook.in.ua/
21 KB
5 KB
Script
General
Full URL
https://dreambook.in.ua/WebResource.axd?d=tbrnlAtorprhjBQSNgf8HLj8Jzv3M7yZgC_1-3eg5Z8dYn8Yhuk3Y92M9kCvsimBFZTztR-OABKr3SQwNsarjuN5hCo1&t=636284741271971599
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
aeaa9e7c8c70d2ce5431cfdf5387e4a96fd55ff14fadd4420cf7cfe6adf01aa1

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Sat, 22 Apr 2017 13:08:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-aspnet-version
2.0.50727
server
cloudflare
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g8Uud9qqfqoW93sBDNh221xRfwLIftG6A3DijKEOI8Rv4WQ3qgubUnx6oR7wqHmWYAhiniCIrE9PKwi9wdgctgjO%2FSCz2RTLxaB4%2BCmnVwXT92f3nX9r06eaQgGrVpSvUnDZ2e60I%2FvJFBiO0B8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
cache-control
public
cf-ray
774d14b5cff176cf-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Tue, 05 Dec 2023 12:24:35 GMT
logo.png
dreambook.in.ua/i/
4 KB
4 KB
Image
General
Full URL
https://dreambook.in.ua/i/logo.png
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
5ddc9584f279855447fcb714a88ba33ed55e11f5f7758c602f55b556121ce299

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Tue, 25 Dec 2012 22:53:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"05bc797f2e2cd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cErfFtqWN4W3%2Bo3Ez28bDbasudQucSJ%2BM5LGuP9pW8AOdJay1EeMgR8UA%2Bzmbk2go2yMQMghOcAN2dmm5bd7ONr3XAV6uqqwWc4a1KEg4Q9yC2rulR%2Beom3LQabgVcg2kLtngVIfvr%2FIWukIz9M%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6a8100706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3765
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
142 KB
48 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2cc6cef59f091fa402ac846fe156fadc768fa16078475f8e2b6a808e0fdc1380
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49034
x-xss-protection
0
server
cafe
etag
6258821361377281675
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 05 Dec 2022 13:20:44 GMT
250x250-1.png
minergate.com/assets/promo/
8 KB
8 KB
Image
General
Full URL
https://minergate.com/assets/promo/250x250-1.png
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
49.12.80.41 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.41.80.12.49.clients.your-server.de
Software
nginx/1.17.10 /
Resource Hash
92bf5ad018fb0ce559f762515cb78894b0e5743d5e69663c4d78f139d3261eb9
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Mon, 05 Dec 2022 13:20:45 GMT
Strict-Transport-Security
max-age=15724800; includeSubDomains
Last-Modified
Wed, 18 Nov 2020 11:21:18 GMT
Server
nginx/1.17.10
ETag
"5fb503ae-1efa"
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7930
Expires
Mon, 12 Dec 2022 13:20:45 GMT
email-decode.min.js
dreambook.in.ua/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://dreambook.in.ua/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 30 Nov 2022 18:31:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6387a18d-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bb3DJxjw769TPAXrwXIpnFoWNkP32HC43whSvPAiZsKMdI8hfD3L46X02zFHGL2hC8fhiFAPmH7i9zDSvC5wzf2lk6xKTZX2%2FwYf6UPA2UtUO5B3gDJijSVi7MXfzuV%2Fi%2F3iGRZi1Eszzm3UrC4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
774d14b65fa60706-LHR
expires
Wed, 07 Dec 2022 13:20:44 GMT
m-itf.gif
dreambook.in.ua/i/
311 B
806 B
Image
General
Full URL
https://dreambook.in.ua/i/m-itf.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
56ae7b158fe30afdf7409073e98697d4fe1f7c3b9eeb0d7262802fccc5453ccb

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Sat, 01 Dec 2012 17:04:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0af92e8e5cfcd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H4T22jT69UogMEfYSYRzdiEGvbrrMBz5HQXddOrAFi6kyMYIEGmCoBizl43Sxjt1iOpZvoc0%2BQAemxCJsjuHa23w1JUG5PEpS2MkuL5ApzR2nZpjX9Wszw0Wgd0zmPHjHfjBvxY%2FvK70t1kxloo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6e85d0706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
311
m-ite.gif
dreambook.in.ua/i/
91 B
587 B
Image
General
Full URL
https://dreambook.in.ua/i/m-ite.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
9077bd4ca033049154d7e3d5d198fa087efd1c73bf9ed8909f1d48d9a8dca799

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Sat, 01 Dec 2012 17:04:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0af92e8e5cfcd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5bNz%2BH2%2F2luU7NvdGDEfa4oqpS36mfS9l3YzWPnXIemi27jfWSeLlkSw6SzvnM4yYN6Qyhw9w6QVohlHqBZzeUoUf1OKpORPC7jMHDCMlBxoa0RFeQMyYswYdHhDbe5tFWgpgfLirFZcuaDMnQ4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6e85f0706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
91
m-itg.gif
dreambook.in.ua/i/
598 B
1 KB
Image
General
Full URL
https://dreambook.in.ua/i/m-itg.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
3746e92445d6d0487be17921f261a66d41ecaf504bb776be0fde2347d1d187cf

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Sat, 01 Dec 2012 17:04:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0af92e8e5cfcd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XEND3Q5oxrnak25sDxUmU8Z5WerhOs054VVccVqLCMmBZi4cmgWRIVnmzGgPYOltJ173JbgzaMp0JoQ2Q0GmOCqIpjOOC7C6x%2F98tN91WQcHlrsAuS2qrg3AvJnLvNCuJ0uH0oagaaY%2BEhFr2UA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6e86a0706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
598
ssm-bl.gif
dreambook.in.ua/i/
81 B
580 B
Image
General
Full URL
https://dreambook.in.ua/i/ssm-bl.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
9d67583be1d8964571b098f0e7531c37052e7402b8f939a5d1c3065d88b6b7f6

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Sat, 01 Dec 2012 17:04:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0af92e8e5cfcd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q3XQy0xUgVIniNHKB8WIQfmmLW%2FHm369X5R5iymbFIqsqYVlxthfr%2BP5pKm1ju6HRFsTyBMKXIbR3PX1uBRYWWeQm2QaCdTUqAQWyaiZstfvHRDWrVZasZxXTyQ80AypII64PhUftIL%2BJKr8s5w%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6f87c0706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
81
ssm-bm.gif
dreambook.in.ua/i/
235 B
736 B
Image
General
Full URL
https://dreambook.in.ua/i/ssm-bm.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
48aba25efe941b83f621cb111f13a1f9a129c0fc6979a2a12e0fec716103f69b

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Sat, 01 Dec 2012 17:04:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0af92e8e5cfcd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gcx%2BoY18oB4sjTvewiKjGq2mTauBth0cDxi94iRGvIRUE%2Ba7oUf7pGz6wNn%2BUul3M2NCauSmDC3cs0%2Fd7Sx2sVoVxmO0vRep2vHlqMVvNIPIKmh%2B%2FioUozIqFfzRdIdZykp6EKNvaETHmB60qvo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6f8800706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
235
/
dreambook.in.ua/
7 KB
7 KB
Image
General
Full URL
https://dreambook.in.ua/
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-aspnet-version
2.0.50727
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2j%2B4TqY8UBNrFLx1E8MZeICOk%2Bd%2FFbcOzkDEmowEDwiyxLo4a7Wskd6cWMs3%2BsgZj729DQFBCGfO03IEojDhP%2FyliJKvoIZORDNfYpYST%2FaTaGttex6L5GqWzTn9X8aCdyCrkPT0La47RDPe4aU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
cache-control
private
cf-ray
774d14b6f8820706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ssm-bn.gif
dreambook.in.ua/i/
236 B
740 B
Image
General
Full URL
https://dreambook.in.ua/i/ssm-bn.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
4a843a4cce8f92aadf37f49608a2db9014a8e2899a134715d9d7efa934fe3658

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Sat, 01 Dec 2012 17:04:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0af92e8e5cfcd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QiGWMxtmM0tO6%2FH18MH9wOx9zPqMX06clPcVJ%2BqiJctySh4wQ0fh2wjFpUu%2B%2FA%2FWnF4SG1TsYqsyQ7pGZ2f3FWom5lt%2FikmhuRWOiRsZYv3SBue31e5H6vMwot%2FfbMwuH32VvUAnzm5AkClG%2FQE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6f8840706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
236
list-dot.gif
dreambook.in.ua/i/
43 B
543 B
Image
General
Full URL
https://dreambook.in.ua/i/list-dot.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/css/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:cd91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
af0478e1e9e321b6896053a3cb015eafa853b8c3616db73b46e9dc339bca3849

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
cf-cache-status
MISS
last-modified
Sat, 01 Dec 2012 17:04:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0af92e8e5cfcd1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F43UsDMmpNsbhN6NFawbk4V%2FxeBkBb%2F53aZcUNZXD6pfL2ycbKEta%2F20VUZwwRO2rbcZ8kXBauuM7YTeiuIDd8Q94ICuFU8rd97LKq9ErJC4HUaSqSQJ%2FoM0QTfGqI3yzGld8ZctQYTz%2BBWLg2M%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=7200
accept-ranges
bytes
cf-ray
774d14b6f8850706-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
watch.js
mc.yandex.ru/metrika/
160 KB
57 KB
Script
General
Full URL
https://mc.yandex.ru/metrika/watch.js
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
b9b55eda4118e5fda9876af796e33d19cbb2661da9e0594f2d7837039f0e0ac1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:44 GMT
content-encoding
br
strict-transport-security
max-age=31536000
last-modified
Thu, 01 Dec 2022 16:28:44 GMT
etag
"6388ac0c-e14c"
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
57676
expires
Mon, 05 Dec 2022 14:20:44 GMT
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/
354 KB
116 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
414a47dba5e34a26bc453a35dc057a5e651ab59b28491a693abc958ab77d46eb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
119179
x-xss-protection
0
server
cafe
etag
2790806485272446708
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 05 Dec 2022 13:20:45 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/ Frame 6C0A
10 KB
5 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

age
16209
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
br
content-length
4242
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 08:50:36 GMT
etag
10353107486223812946
expires
Mon, 19 Dec 2022 08:50:36 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
sync_cookie_image_finish
mc.yandex.ru/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9843.IaCX2glVS4vRhqOT4iN7FCRbnEd0RrVneBZzANJjeuLlL2ZUt2oRFL8obhWitNUn.Gn02CJWt7Uk4xgAdCy-udFLaWZk%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9843.AkvsNSrTSLTf0R1USCHmQkRjzSPfkGHCxhLuc5vsKVcYM0t6zT4nknvUrRmO60HgCUvqrHDgzHc56dwGk1YiyiqT-JruTJZFN8nGvrS4IV0%2C.zTYR94lzvDqe-6Q3IrDhIhlEiqE%2C
  • https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=9843.9LTM_tmCvN6acGCDEAycx6R1R-2i5ABpIHqU0Ve7EGmkwqAVjV_q3X-iMdVPyntysyZgdHFcUx6kGGfYGPaDMdsAGRUzhTRFb1ijEu7V_oMCxa...
43 B
416 B
Image
General
Full URL
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=9843.9LTM_tmCvN6acGCDEAycx6R1R-2i5ABpIHqU0Ve7EGmkwqAVjV_q3X-iMdVPyntysyZgdHFcUx6kGGfYGPaDMdsAGRUzhTRFb1ijEu7V_oMCxaSqF9kkdX3uz5AFOD3GZKZy9v7vnvOqJdOq6x9vrDmXovyRqqtZAQ1H6J5vByKTEHyQcaQRmO9C7JKccamQSe2LJ6kCKf775DQ867ulKA%2C%2C._Lf9Cg8LaKJ1XjWi05M73IsyP6w%2C
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000
content-length
43
x-xss-protection
1; mode=block
content-type
image/gif

Redirect headers

location
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=9843.9LTM_tmCvN6acGCDEAycx6R1R-2i5ABpIHqU0Ve7EGmkwqAVjV_q3X-iMdVPyntysyZgdHFcUx6kGGfYGPaDMdsAGRUzhTRFb1ijEu7V_oMCxaSqF9kkdX3uz5AFOD3GZKZy9v7vnvOqJdOq6x9vrDmXovyRqqtZAQ1H6J5vByKTEHyQcaQRmO9C7JKccamQSe2LJ6kCKf775DQ867ulKA%2C%2C._Lf9Cg8LaKJ1XjWi05M73IsyP6w%2C
date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
sync_cookie_image_check
mc.yandex.ua/
0
0

advert.gif
mc.yandex.com/metrika/
43 B
136 B
Image
General
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 01 Dec 2022 16:28:44 GMT
etag
"6388ac0c-2b"
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Mon, 05 Dec 2022 14:20:45 GMT
1
mc.yandex.com/watch/35172605/
Redirect Chain
  • https://mc.yandex.com/watch/35172605?wmode=7&page-url=https%3A%2F%2Fdreambook.in.ua%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Assb7e99gu042u1d5clb78%3Afp%3A527%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3...
  • https://mc.yandex.com/watch/35172605/1?wmode=7&page-url=https%3A%2F%2Fdreambook.in.ua%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Assb7e99gu042u1d5clb78%3Afp%3A527%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US...
428 B
510 B
XHR
General
Full URL
https://mc.yandex.com/watch/35172605/1?wmode=7&page-url=https%3A%2F%2Fdreambook.in.ua%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Assb7e99gu042u1d5clb78%3Afp%3A527%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A933%3Acn%3A2%3Adp%3A0%3Als%3A852941490838%3Ahid%3A134169789%3Az%3A0%3Ai%3A20221205132045%3Aet%3A1670246445%3Ac%3A1%3Arn%3A234617747%3Arqn%3A1%3Au%3A1670246445225849332%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A1%2C99%2C85%2C17%2C147%2C0%2C%2C194%2C8%2C%2C%2C%2C796%3Aco%3A0%3Acpf%3A1%3Ans%3A1670246444081%3Arqnl%3A1%3Ast%3A1670246445%3At%3A%D0%9E%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%3A%20%D1%82%D0%BB%D1%83%D0%BC%D0%B0%D1%87%D0%B5%D0%BD%D0%BD%D1%8F%20%D1%81%D0%BD%D1%96%D0%B2%20%D0%B1%D0%B5%D0%B7%D0%BA%D0%BE%D1%88%D1%82%D0%BE%D0%B2%D0%BD%D0%BE%20%D0%BF%D0%BE%20100%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%D0%B0%D0%BC%20-%20Dream%20Book&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H2
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
ecb3c8b5dc4308fb64e9ed50c77ad80b2e3df2fd32f091a19410963b52119d80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Mon, 05-Dec-2022 13:20:45 GMT
content-type
application/json; charset=utf-8
access-control-allow-origin
https://dreambook.in.ua
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
428
x-xss-protection
1; mode=block
expires
Mon, 05-Dec-2022 13:20:45 GMT

Redirect headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000
last-modified
Mon, 05-Dec-2022 13:20:45 GMT
location
/watch/35172605/1?wmode=7&page-url=https%3A%2F%2Fdreambook.in.ua%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Assb7e99gu042u1d5clb78%3Afp%3A527%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A933%3Acn%3A2%3Adp%3A0%3Als%3A852941490838%3Ahid%3A134169789%3Az%3A0%3Ai%3A20221205132045%3Aet%3A1670246445%3Ac%3A1%3Arn%3A234617747%3Arqn%3A1%3Au%3A1670246445225849332%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A1%2C99%2C85%2C17%2C147%2C0%2C%2C194%2C8%2C%2C%2C%2C796%3Aco%3A0%3Acpf%3A1%3Ans%3A1670246444081%3Arqnl%3A1%3Ast%3A1670246445%3At%3A%D0%9E%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%3A%20%D1%82%D0%BB%D1%83%D0%BC%D0%B0%D1%87%D0%B5%D0%BD%D0%BD%D1%8F%20%D1%81%D0%BD%D1%96%D0%B2%20%D0%B1%D0%B5%D0%B7%D0%BA%D0%BE%D1%88%D1%82%D0%BE%D0%B2%D0%BD%D0%BE%20%D0%BF%D0%BE%20100%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%D0%B0%D0%BC%20-%20Dream%20Book&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29
access-control-allow-origin
https://dreambook.in.ua
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Mon, 05-Dec-2022 13:20:45 GMT
cookie.js
partner.googleadservices.com/gampad/
397 B
699 B
Script
General
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=dreambook.in.ua&callback=_gfp_s_&client=ca-pub-6227986699150986&gpid_exp=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e0ae86481c149d356cf49579e071681c7e6383fe22328be60dff7fa8149b88c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
254
x-xss-protection
0
integrator.js
adservice.google.de/adsid/
107 B
792 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=dreambook.in.ua
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
549 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=dreambook.in.ua
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 49E7
114 KB
41 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9d0d1eb333b1b81276d7f0be6750f16710d8415e51d455f51e42390221d2d69b
Security Headers
Name Value
Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CK3SyPDI4vsCFQno7QodwvoIcQ&gqi=LfCNY56LHc-A1fAP5YOlcA&layout=/sadbundle/%24csp%253Der3%24/2745339239957086399/index.html
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
br
content-length
42328
content-security-policy
child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CK3SyPDI4vsCFQno7QodwvoIcQ&gqi=LfCNY56LHc-A1fAP5YOlcA&layout=/sadbundle/%24csp%253Der3%24/2745339239957086399/index.html
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:46 GMT
expires
Mon, 05 Dec 2022 13:20:46 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 7017
22 KB
10 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a6e22eba51ae13ff030b51fc14a3f33614fedb30eb79ec1e73fa9ff40cda2399
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
br
content-length
9861
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:45 GMT
expires
Mon, 05 Dec 2022 13:20:45 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 15C1
145 KB
47 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&adk=1812271804&adf=3025194257&lmt=1670246445&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fdreambook.in.ua%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444953&bpp=1&bdt=535&idt=384&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250%2C300x250&nras=1&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=388
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
735fd17212c327597d338eb9ace537d6eb2a108604907accefa95af5c78c7b5a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
br
content-length
47992
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:45 GMT
expires
Mon, 05 Dec 2022 13:20:45 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
20123911
mc.yandex.com/watch/
428 B
596 B
XHR
General
Full URL
https://mc.yandex.com/watch/20123911?wmode=7&page-url=https%3A%2F%2Fdreambook.in.ua%2F&charset=utf-8&browser-info=pv%3A1%3Avf%3Assb7e99gu042u1d5clb78%3Afp%3A527%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A933%3Acn%3A1%3Adp%3A0%3Als%3A27308295205%3Ahid%3A134169789%3Az%3A0%3Ai%3A20221205132045%3Aet%3A1670246445%3Ac%3A1%3Arn%3A863846123%3Arqn%3A1%3Au%3A1670246445225849332%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A1%2C99%2C85%2C17%2C147%2C0%2C%2C194%2C8%2C%2C%2C%2C796%3Aco%3A0%3Acpf%3A1%3Ans%3A1670246444081%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1670246446%3At%3A%D0%9E%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%3A%20%D1%82%D0%BB%D1%83%D0%BC%D0%B0%D1%87%D0%B5%D0%BD%D0%BD%D1%8F%20%D1%81%D0%BD%D1%96%D0%B2%20%D0%B1%D0%B5%D0%B7%D0%BA%D0%BE%D1%88%D1%82%D0%BE%D0%B2%D0%BD%D0%BE%20%D0%BF%D0%BE%20100%20%D1%81%D0%BE%D0%BD%D0%BD%D0%B8%D0%BA%D0%B0%D0%BC%20-%20Dream%20Book&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2)
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),
Reverse DNS
Software
/
Resource Hash
252de26441cca646d376c6b5c43ed5ca83f6f16d771123ac4fc1b3888b2ebe13
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Mon, 05-Dec-2022 13:20:45 GMT
content-type
application/json; charset=utf-8
access-control-allow-origin
https://dreambook.in.ua
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
428
x-xss-protection
1; mode=block
expires
Mon, 05-Dec-2022 13:20:45 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 7017
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 10:54:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
8780
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 19 Dec 2022 10:54:26 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 7017
18 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 04 Dec 2022 14:56:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
80677
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7458
x-xss-protection
0
server
cafe
etag
16870613375306414947
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 18 Dec 2022 14:56:09 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7017
155 KB
48 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
302e69dd5cd67c33a01a5d0308c1ead25d5967bd0810b0c073f9fe18124de7bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48508
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1669811598765935"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 05 Dec 2022 13:20:46 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame 7017
0
0
Fetch
General
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CYnYQLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBLoBT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2HYZiCQkaVkFX8aVeZ25YH_1ydZ0ckMoYxBBQ2sqoE4P4pyCSsUfgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi02MjI3OTg2Njk5MTUwOTg2GAA&sigh=RJzCSlOdXk4&uach_m=[UACH]&cid=CAQSGwDq26N9IdWIb0ZuVGVrAkiRP7cZDgOZb5f__BgBIBM
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 05 Dec 2022 13:20:46 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Mon, 05 Dec 2022 13:20:46 GMT
notify
rtb.nl.eu.criteo.com/google/auction/ Frame 7017
0
0
Fetch
General
Full URL
https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kJCTFN2BMKwC-gGdg2ICAgAAAHM1MdMLenkkEC3wjWPCZSXJNsY7_M6mCAASAAA&wp=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
server-processing-duration-in-ticks
297339
content-length
0
afr.php
ads.eu.criteo.com/delivery/r/ Frame CA48
198 KB
57 KB
Document
General
Full URL
https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
bd36f76b2fa94e00b565eedefd63b717457a8ef80c0d0d26328dcea799556c2d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1000
cache-control
private, max-age=0, no-cache
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:45 GMT
expires
Mon, 26 Jul 1997 05:00:00 GMT
link
<pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p
CP='CUR ADM OUR NOR STA NID'
pragma
no-cache
report-to
{"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=lsyuSBgR-I5xPNv4vXPSaJ_6rcAnJtxz3rflCvhXfae0EqgihZZCZlE7tE_FMkobTw3vSmcAjopCGDGBP-g4ewB2t-22vJo-I_knNnU-zS7gSxi1xfw0ULpyyL9BGVRE0hHZ9xhPuLn9GK1oIxwN3-vH8XB86OyvBzxGuU4VHof8FH0gbD9w4MO13odPw0N9GvuwY5lb24ToMA50KwuAhE85qhVxY_gLE32Om1dC_P3CJPEE9RhASu_YzgIX1eIBYNB9fQ"}], "max_age": 86400}
server
Kestrel
server-processing-duration-in-ticks
140601807
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
reactive_library_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/
150 KB
51 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/reactive_library_fy2021.js?bust=31071035
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
208c0ffa948b4422487703da66c44cad2e40d9b3e1e7a7d4cd1146e562793327
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52280
x-xss-protection
0
server
cafe
etag
15454431027673061034
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Mon, 05 Dec 2022 13:20:46 GMT
integrator.js
adservice.google.de/adsid/
107 B
122 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=dreambook.in.ua
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
122 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=dreambook.in.ua
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 8778
25 KB
12 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e58a9af019771ed14ac50791c01848e616ad28c8d3cb910e6b7b780c4ff81a37
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding
br
content-length
11800
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:46 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/ Frame 3EA4
19 KB
6 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
42cc80741ade3b46ade00bcdc89253cab8cb30d5c3aec41ac18072dc708b75ce
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
192924
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
4594
content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
cross-origin-resource-policy
cross-origin
date
Sat, 03 Dec 2022 07:45:22 GMT
expires
Sun, 03 Dec 2023 07:45:22 GMT
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 49E7
0
0
Fetch
General
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=ChtAOLfCNY-2HHonQtwfC9aOIB-T0kd9tkcyT7L4QspLkhuo3EAEg_uGyV2CVAqABsorBqgHIAQmpArJ3B30VAak-qAMByANIqgTEAU_Q_FVgrlX42ZoQU6qI9S48F-jXtVUCUTXuOqgSa90_fv3SJdbrY22OzN9VM0ILvcSIcpmzJtJnftykJ2V__ZLelvtk-aLZe6w88-Iwp_4E-DFIG8JApZoROG89_XPIcURApKATvvuqCPJLptI-ufhtFIADdzB_DSntfmkcd_F6iKI72_NpDkC3THz4Y9wgRY3hVpYYEvnYS9MUM8qqJX7rWGrBmzGYdkOY--j_HPBGBix57GfNyKZn6zuUGYNXuOMdQDDABJ-HzKCiBJIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAe29b7VAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEPDtCNIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTYyMjc5ODY2OTkxNTA5ODYYAA&sigh=RBE-Xabm_qY&uach_m=[UACH]&cid=CAQSGwDq26N9_Rul1j_8-pnWraPbkQp3c7B0mPrF0RgBIBM&template_id=419
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 05 Dec 2022 13:20:46 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 49E7
23 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
61651edfb03aae1c1007d6741f98171447ae7b1a67aaa520d8b0a959e0400885
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 09:30:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
13796
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9428
x-xss-protection
0
server
cafe
etag
246362764157784863
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 19 Dec 2022 09:30:50 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 49E7
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 10:54:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
8780
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 19 Dec 2022 10:54:26 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 49E7
18 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 04 Dec 2022 14:56:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
80677
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7458
x-xss-protection
0
server
cafe
etag
16870613375306414947
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 18 Dec 2022 14:56:09 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 49E7
155 KB
47 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
302e69dd5cd67c33a01a5d0308c1ead25d5967bd0810b0c073f9fe18124de7bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48508
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1669811598765935"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 05 Dec 2022 13:20:46 GMT
truncated
/ Frame 7017
206 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c46386899a9d9ccb637debd2f095442639041efa677ec3c8434ab77b7a1c7ef7

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 3EA4
6 KB
3 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:12:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
506
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2655
x-xss-protection
0
server
cafe
etag
4618035238173732404
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Tue, 06 Dec 2022 13:12:20 GMT
addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 3EA4
34 KB
13 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 04 Dec 2022 19:53:06 GMT
content-encoding
br
x-content-type-options
nosniff
age
62860
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13035
x-xss-protection
0
server
cafe
etag
2319883687766034370
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Mon, 05 Dec 2022 19:53:06 GMT
ff0e13b44aa69e593b8af39cbaae0572.js
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/ Frame 3EA4
101 KB
29 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/ff0e13b44aa69e593b8af39cbaae0572.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6c12e1209efcb45bbc84f530bafac68ece315a70dfb1732b54238bec65010710
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 02 Dec 2022 03:45:04 GMT
age
293742
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29694
x-xss-protection
0
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 02 Dec 2023 03:45:04 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/ Frame BF9B
10 KB
4 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

age
58160
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
br
content-length
4242
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 04 Dec 2022 21:11:26 GMT
etag
10353107486223812946
expires
Sun, 18 Dec 2022 21:11:26 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
s
googleads.g.doubleclick.net/pagead/drt/ Frame E560
143 B
166 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

age
1461
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 12:56:25 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/ Frame E4BC
20 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c0dade5e40511841f841814ed717788248c50490400ef63f4620391825f7444e
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
225619
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
4775
content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
cross-origin-resource-policy
cross-origin
date
Fri, 02 Dec 2022 22:40:27 GMT
expires
Sat, 02 Dec 2023 22:40:27 GMT
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame BF9B
0
0
Fetch
General
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Cp8PhLfCNY-24IYeNxtYPm7a64Aq7mqHfbcuv1vaJEYy0zKehNxABIP7hsldglQKgAbKKwaoByAEJqQIr_rWS4_qoPqgDAcgDSKoEywFP0KRmw7n1YQIhfpl9OodjZ-OP7aE0uAZmfl6Vx_vAAstJmgJ-7rxJbmieG2XOFdRZA7iQmck7O_qjabxoYogacrc-h3LjqWtjMAtfbUnl5fIOp4NIlZrraEJkO4fO5vB44lsg2UlkwaMBycp55XpAJobPUbhrqYtWqFW0UH_QyQfbfXh9wlLHiYSZ1Mck1vXOcFs4H8Y3UkxrPxBi1dBi1vFrF0aDt25MuKr6qQNomLSuzH8y9kVVq6MlQYxkvTO4f_zV_0Muq1t_c8AE0smnt4YEkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB7b1vtUCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwUQhu-SAdIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTYyMjc5ODY2OTkxNTA5ODYYAA&sigh=Sk1m1Ztnwlw&uach_m=[UACH]&cid=CAQSGwDq26N9rDDIDZPhRCOv3OI_spkEJgriPEckeRgBIBM&template_id=419
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 05 Dec 2022 13:20:46 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame BF9B
23 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
61651edfb03aae1c1007d6741f98171447ae7b1a67aaa520d8b0a959e0400885
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 09:30:50 GMT
content-encoding
br
x-content-type-options
nosniff
age
13796
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9428
x-xss-protection
0
server
cafe
etag
246362764157784863
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 19 Dec 2022 09:30:50 GMT
privacy_small.svg
static.criteo.net/flash/icon/ Frame CA48
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/privacy_small.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Tue, 11 Feb 2020 14:30:28 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42ba84-6aa"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
adchoices_en.svg
static.criteo.net/flash/icon/ Frame CA48
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/adchoices_en.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Tue, 11 Feb 2020 14:27:58 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42b9ee-759"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
close_button.svg
static.criteo.net/flash/icon/ Frame CA48
308 B
637 B
Image
General
Full URL
https://static.criteo.net/flash/icon/close_button.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Fri, 14 Feb 2020 13:51:32 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"5e46a5e4-134"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
308
expires
Thu, 30 Nov 2023 13:20:46 GMT
back_button2.svg
static.criteo.net/flash/icon/ Frame CA48
293 B
621 B
Image
General
Full URL
https://static.criteo.net/flash/icon/back_button2.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 28 Apr 2022 09:09:48 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"626a59dc-125"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
293
expires
Thu, 30 Nov 2023 13:20:46 GMT
lg.php
cat.fr.eu.criteo.com/delivery/ Frame CA48
43 B
348 B
Image
General
Full URL
https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=HrSfq4IKUvCa0VmvpIYMUBpHL-q8gbMrpp1cC9aO5z8XDDOcyX3EJwPeomQnVQ2LhCWVXOw0Z0zdef0uSNYR4U1rHk96cadhzPTCq0K5vwIiiXISe6ytebnhdnFAM8abmVn2CI3EzLwSQ5puKaUyiQ1xpayDUSVdiqHeoofulvQgpFvJGW2H4ZqM-YVjvVTJGvhFSBEHQ_PG7jRQ7UPrAiH1Fu0Pps-k4E-iPZhJ6abxV9Ng5tu9ABk4mWaAg60urPdyMQcyzkDLXPhCNvR2iu3Jh6Z5cNLy3OBgfknKFz-py479ZcKI6mJShHQ4326KPXZtQPbKKVVYqtVttc5kXSlVbN80cS24tOaqalLyrD0otVJzgcewP8b5CcE1drJ3isqYt0Qsg68RwSTG5QDiwpCTg3rpa-GmjOLHb9XB81my8b0DIrTn2NEHlU4QADbwjuzL-w
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type
image/gif
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
3719152
expires
Mon, 26 Jul 1997 05:00:00 GMT
m
secure-gl.imrworldwide.com/cgi-bin/ Frame CA48
44 B
752 B
Image
General
Full URL
https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1670246445
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:2a00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
via
1.1 e44e0b24e706487eaec6b9e01f2166dc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-cache
Miss from cloudfront
p3p
P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
cross-origin-resource-policy
cross-origin
content-length
44
pragma
no-cache
server
nginx
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods
POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
x-amz-cf-id
1-QrYBXN0iwHI4e4taLktOfnZbmGNwJAZX2HGEPOjuVn38e5XUbw2Q==
expires
Thu, 01 Dec 1994 16:00:00 GMT
truncated
/ Frame 49E7
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3894faa2322f186cd91f46a5232c2b74c9e76c9fd27aaca18212504bfadb589e

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame E560
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=4164001797&adk=2506542124&adf=4025247695&pi=t.ma~as.4164001797&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444938&bpp=3&bdt=520&idt=370&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&correlator=4824436152772&frm=20&pv=2&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=166&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=NmQj4yDUIe&p=https%3A//dreambook.in.ua&dtd=387
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:46 GMT
expires
Mon, 05 Dec 2022 13:20:46 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:46 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame E4BC
6 KB
3 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:12:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
506
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2655
x-xss-protection
0
server
cafe
etag
4618035238173732404
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Tue, 06 Dec 2022 13:12:20 GMT
addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame E4BC
34 KB
13 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 04 Dec 2022 19:53:06 GMT
content-encoding
br
x-content-type-options
nosniff
age
62860
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13035
x-xss-protection
0
server
cafe
etag
2319883687766034370
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Mon, 05 Dec 2022 19:53:06 GMT
120fb889c9d3d02c8d3dd0555cf62ab3.js
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/ Frame E4BC
104 KB
30 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/120fb889c9d3d02c8d3dd0555cf62ab3.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
abf06691088fd3e48eeca737b56e448a96b06b1d7abb1495b634efcc2795aa89
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 03 Dec 2022 03:08:39 GMT
age
209527
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30375
x-xss-protection
0
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 03 Dec 2023 03:08:39 GMT
animejs.js
static.criteo.net/animejs/ Frame CA48
12 KB
6 KB
Script
General
Full URL
https://static.criteo.net/animejs/animejs.js
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Tue, 26 Mar 2019 17:44:11 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5c9a64eb-3181"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
css
fonts.googleapis.com/ Frame 3EA4
6 KB
780 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/ff0e13b44aa69e593b8af39cbaae0572.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
78631aa2658006d43b70adcf42bfef831d29315d91bfe9e67bb4acd5f9b349e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 05 Dec 2022 13:20:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 05 Dec 2022 13:20:46 GMT
14a7940d8977d30d66bee7ecca0f1aa6.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/media/ Frame 3EA4
17 KB
17 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/media/14a7940d8977d30d66bee7ecca0f1aa6.jpg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9209b27a04396910366c0bc3ac620f5792e91d93f441b566a0139095f0733961
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date
Fri, 02 Dec 2022 14:19:43 GMT
x-content-type-options
nosniff
age
255663
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17730
x-xss-protection
0
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 02 Dec 2023 14:19:43 GMT
251b76f59de36ba2027573f3faa8250e.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/media/ Frame 3EA4
19 KB
19 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/media/251b76f59de36ba2027573f3faa8250e.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1ec4d3d0699cec4dac9fdc379d3259108b8fe20ed29ef79eccf0817c884dc6a6
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date
Sat, 03 Dec 2022 11:55:56 GMT
x-content-type-options
nosniff
age
177890
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19154
x-xss-protection
0
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 03 Dec 2023 11:55:56 GMT
438ea363c3a53bf72ff0a2d81608c571.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/media/ Frame 3EA4
1 KB
1 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/media/438ea363c3a53bf72ff0a2d81608c571.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2745339239957086399/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61e1ae6218645ef3f2d9ce5087ed2e2aeb7781c3adf8296a3adf0dd17ee06ad3
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date
Sat, 03 Dec 2022 03:48:24 GMT
x-content-type-options
nosniff
age
207142
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1270
x-xss-protection
0
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 03 Dec 2023 03:48:24 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 0297
143 B
166 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

age
1461
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 12:56:25 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame BF9B
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 10:54:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
8780
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 19 Dec 2022 10:54:26 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame BF9B
18 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 04 Dec 2022 14:56:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
80677
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7458
x-xss-protection
0
server
cafe
etag
16870613375306414947
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 18 Dec 2022 14:56:09 GMT
img
pix.eu.criteo.net/img/ Frame CA48
11 KB
11 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?h=76&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=596&s=CxRtjByjbRtf0nK6cmCwL0fZ
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
093da471f5256cc2c4143fef0a012c247888761f0d398659582dc56da5769a16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/png
cache-control
public, max-age=30197887
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
10911
expires
Mon, 20 Nov 2023 01:38:54 GMT
img
pix.eu.criteo.net/img/ Frame CA48
2 KB
2 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2Flogothyssenkrupp-Steel-Europe-AG-219788DE.gif%3Feb%3D1&v=3&w=400&s=XHuExgt2X6Ogi7LaGnPy56_c&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
bc0b263c7a92aa4b891aba2e2792726b2b7ac1c068e55b37a073d95a8e9e5faf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=874846
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1554
expires
Thu, 15 Dec 2022 16:21:33 GMT
img
pix.eu.criteo.net/img/ Frame CA48
2 KB
2 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FT%2FlogoTDK-EPC-AG-Co-KG-95155DE.gif%3Feb%3D1&v=3&w=400&s=O7qNKrGU4fA2YpbLN3RCXeat&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
66899a46f2b3bf4e14994e256fa8c3aa5b32571947d166350e10e88ae588412b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=1130
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1920
expires
Mon, 05 Dec 2022 13:39:37 GMT
img
pix.eu.criteo.net/img/ Frame CA48
2 KB
2 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FR%2FlogoRefresco-Deutschland-GmbH-68743DE.gif%3Feb%3D1&v=3&w=400&s=dV06WbUvDl0PBq-j5txLeVn8&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
26af37caf711acf7cf4483d7ca400806b22918f32ae2e1733fd54e24aa6f6c91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=65656
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
2136
expires
Tue, 06 Dec 2022 07:35:03 GMT
img
pix.eu.criteo.net/img/ Frame CA48
1 KB
1 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FC%2FlogoMercedes-Benz-AG-237414DE-2106010949.gif%3Feb%3D1&v=3&w=400&s=CmlLSbiWqKPLWam-_BOBNCRi&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
9a73fe4f2b3f00d5f680adb3d4affae2a924b6ae4e8d3ea009c36f2f9177c0ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=1866925
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1052
expires
Tue, 27 Dec 2022 03:56:12 GMT
img
pix.eu.criteo.net/img/ Frame CA48
2 KB
2 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FA%2FlogoMeMedix-GmbH-314368DE-2209261200.gif%3Feb%3D1&v=3&w=400&s=367m8FbkTqCPq8UZFxbTrddi&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
273a09036e7edf6ddceac33ab6e1cecf2d4b1eb3c4bf40fc5e18a8d668d52676
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=2010857
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1608
expires
Wed, 28 Dec 2022 19:55:03 GMT
img
pix.eu.criteo.net/img/ Frame CA48
487 B
744 B
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F6%2FlogoWestnetz-GmbH-287002DE-2210251532.gif%3Feb%3D1&v=3&w=400&s=bsEA-Rlp3f3WSR6aUkLCc74_&b=400
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
809671b4a80114a50716fe5edc470c1f90cd9059029a4a28170c18500b37efa0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/png
cache-control
public, max-age=0
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
487
expires
Mon, 05 Dec 2022 13:20:46 GMT
all
csm.eu.criteo.net/ Frame CA48
0
128 B
Ping
General
Full URL
https://csm.eu.criteo.net/all?cppv=3&cpp=lsyuSBgR-I5xPNv4vXPSaJ_6rcAnJtxz3rflCvhXfae0EqgihZZCZlE7tE_FMkobTw3vSmcAjopCGDGBP-g4ewB2t-22vJo-I_knNnU-zS7gSxi1xfw0ULpyyL9BGVRE0hHZ9xhPuLn9GK1oIxwN3-vH8XB86OyvBzxGuU4VHof8FH0gbD9w4MO13odPw0N9GvuwY5lb24ToMA50KwuAhE85qhVxY_gLE32Om1dC_P3CJPEE9RhASu_YzgIX1eIBYNB9fQ&sds=2&rev=83599&sendBeacon=true
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://ads.eu.criteo.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
cross-origin-resource-policy
cross-origin
server
Finatra
content-length
0
criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame CA48
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/criteo_logo_2021.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 27 May 2021 13:21:59 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"60af9cf7-891"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
privacy.svg
static.criteo.net/flash/icon/ Frame CA48
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/privacy.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLQAITOoITwhyAAuz-UO05kI9kqdkXJbXjw&u=%7CXbvu7oStCAikBZQ2s6%2Bj8QNz14WQn4o5qPK26dIlVN8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgAFBOQAVcHyzHYSjZvm1b0YL5gkwuOi4uADsXyUY3bBHbgXWTLj-6bqVPyfYMLddvmjmNCl1XlYa47zL-xMfY_sz8OCMgjzLvIZOCE9txtSS9kTTft1VX0qBjBoXu3yFnqPDL8R4cwart5oQ85k2zC4xb6nwmy5yTnFqrqABlnojBAJPWLz4FshIjUJtiY14_CEcRc_GWf81DrbvApY5LyvMu28GwNsFXnnn6Tf6yD6Lmuj3LDOnm87BgltbsPRxyHv2LVn8HOjkbXjlVrWur-HeyE30B2TO42oe_5mu4XHzbZd312QispaobtkpDJnmzfOYLstR9TV0i2hO5TgnFnLN0w-9ShtWVTTofWkUHcv2Cqoxf0QokRUXOQYgUbLBOsWTUB8IPdNkXxiaEnTF-oNfKGKNZ_tmWgz8wK8CUKjsTTcOLLfp2xTyhr3HegSfKjjg3QMLKkJ5gd-h-8wySyxU2x6qE_4CFieShOn_GGm2PJcohcxZ6NqY7rMIPAV4a-5b5m1DRs7isqZ6M-naJqzlzvoLeo4GMHuZYd3yp88Y&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCXiEWLfCNY-qZIfKQvPIP-eeu2AvJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCa1rdVkKusT6oAwGqBL0BT9D4BLybmhoL8YhmTW10ZkFajRMGOOEFj7RFMiRKzGye4YS_iSCw86oOscldeMjveYIsEEtchM2c9whO-LL40o01vcbiFZ-XH1K56vzOj7r_4sJpufAF4H9oIgmbe2Jxo_6GOr_4jJf7B-uns_MWkJbZus-zXaP2367vp67oOxSv15ASiYvFsB5nCjBZe2Xo09xq2DQbqbaj5sUW4FqB2k2Exof83dzCeG0w4aSJfs3YH1Aj-hkoztagS_fcgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0BFdZ62qqj6gwj-y5TP_mjZDVQyg%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 19 Feb 2020 10:57:21 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e4d1491-646"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame BF9B
155 KB
47 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
302e69dd5cd67c33a01a5d0308c1ead25d5967bd0810b0c073f9fe18124de7bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48508
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1669811598765935"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 05 Dec 2022 13:20:46 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 8778
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 10:54:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
8780
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 19 Dec 2022 10:54:26 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 8778
18 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sun, 04 Dec 2022 14:56:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
80677
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7458
x-xss-protection
0
server
cafe
etag
16870613375306414947
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 18 Dec 2022 14:56:09 GMT
l
www.google.com/ads/measurement/ Frame 8778
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRW4nAX7AYmmnIVMvkLlxCwvk4w8UOnDchROCWTAR5u_ntEsnJE17ChJbnZynyrdD6nW9ysyZV1tZPGPXICsN-zcnwe_A
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8778
155 KB
47 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
302e69dd5cd67c33a01a5d0308c1ead25d5967bd0810b0c073f9fe18124de7bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48508
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1669811598765935"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 05 Dec 2022 13:20:46 GMT
truncated
/ Frame BF9B
220 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d68abc4c4bda8b4c4ec377ee852513b7114327c77cd107b25bab141e753ac57b

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
css
fonts.googleapis.com/ Frame E4BC
6 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/120fb889c9d3d02c8d3dd0555cf62ab3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
78631aa2658006d43b70adcf42bfef831d29315d91bfe9e67bb4acd5f9b349e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 05 Dec 2022 13:20:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 05 Dec 2022 13:20:46 GMT
7296e22ca20ac6472628647a52a912af.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/media/ Frame E4BC
9 KB
9 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/media/7296e22ca20ac6472628647a52a912af.jpg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6847a453292f6db177d022b32b68ec91da611dd1bc18c6e33d26ed726339bc60
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date
Fri, 02 Dec 2022 15:17:59 GMT
x-content-type-options
nosniff
age
252167
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8880
x-xss-protection
0
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 02 Dec 2023 15:17:59 GMT
0eeebe2aab7fa2fb99c2a447383fb9a6.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/media/ Frame E4BC
9 KB
9 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/media/0eeebe2aab7fa2fb99c2a447383fb9a6.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a842670e0c9a10d0c42dc6de87889c6b9de065232e6bf125d5ca43a163f6d9fd
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date
Fri, 02 Dec 2022 14:43:50 GMT
x-content-type-options
nosniff
age
254216
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9647
x-xss-protection
0
last-modified
Fri, 25 Nov 2022 19:23:26 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 02 Dec 2023 14:43:50 GMT
undefinedz9njpo
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/ Frame E4BC
43 B
67 B
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/undefinedz9njpo
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:47 GMT
x-content-type-options
nosniff
server
sffe
x-dns-prefetch-control
off
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=0
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Mon, 05 Dec 2022 13:20:47 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 0297
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:46 GMT
expires
Mon, 05 Dec 2022 13:20:46 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:46 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 8778
0
0
Fetch
General
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Cz2zELvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBLsBT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRI1ja5SACRdAk0YZ9V2TfTSXH7sSfz21a82WikmXN3IwZ9OOzOtr4AGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNjIyNzk4NjY5OTE1MDk4NhgA&sigh=nK9emkXLxNw&uach_m=[UACH]&cid=CAQSPADq26N9XjR03JN6OdPpD3cBlw1JQvL3v1e2jNRdVGpYpmfNZ0N461Pvg-u2A-Qn0fuqZS0qxrFSM4R9gBgBIBM
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 05 Dec 2022 13:20:46 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
notify
rtb.fr.eu.criteo.com/google/auction/ Frame 8778
0
0
Fetch
General
Full URL
https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kJCTFMz6RLAJmAKdg2ICAgAAANueneVnYQUzEC3wjWMI6Vtx5u9s6qziZQASAAA&wp=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
server-processing-duration-in-ticks
248451
content-length
0
afr.php
ads.eu.criteo.com/delivery/r/ Frame AC59
169 KB
51 KB
Document
General
Full URL
https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
e374176d6c978facc5f3375f7ebe98f35e436b662fa2c9792e066c1a21cda4cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1000
cache-control
private, max-age=0, no-cache
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:45 GMT
expires
Mon, 26 Jul 1997 05:00:00 GMT
link
<pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p
CP='CUR ADM OUR NOR STA NID'
pragma
no-cache
report-to
{"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=CU446hgR-I5xPNv4o1OHFknusvfw1gTa0_E65nfqKWCYDgYV1QvBcQoYfkqv3Lpf-erJAnt-fQca5FkfJHdDJFeNVTDYpXc5nKRkAFxCQA7Bt8wyIAFCTIUyF7DeGKX-lkUlAVzjKfEJnGTuIgpIU1niJ2Rn1Ra4G1mIGETUzn3z79YM-fPkEox2QgM8Eu0vBMyHbYCz6r7ys1eDhwu0Tyz2EY2j5E42NfCLKvXp0lW1TbTcR5xjI7d0SpA"}], "max_age": 86400}
server
Kestrel
server-processing-duration-in-ticks
121843077
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 79BB
1 KB
643 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

age
9400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 10:44:06 GMT
etag
48472445140208031
expires
Tue, 06 Dec 2022 10:44:06 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 8778
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3e216fb71de249dae0a7a1fead4486815c4abeb4052ccdef6d19c4a5b5bb0f52

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
pixel
cm.g.doubleclick.net/ Frame 79BB
Redirect Chain
  • https://d.agkn.com/pixel/2175/?google_gid=CAESELfIzrkQri25wtUqeaacjK8&google_cver=1&google_push=ASkJ3FbuH8UsJasHH7gdvopCHGL3oyHgoJ09dGXm871A0HdX4eyzrj2pgfXaaCgwuTIbfp-7owoBabMPSYusyLhcuyes2G9Jsw9mdQ
  • https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3FbuH8UsJasHH7gdvopCHGL3oyHgoJ09dGXm871A0HdX4eyzrj2pgfXaaCgwuTIbfp-7owoBabMPSYusyLhcuyes2G9Jsw9mdQ&google_hm=Q0FFU0VMZkl6cmtRcmk...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3FbuH8UsJasHH7gdvopCHGL3oyHgoJ09dGXm871A0HdX4eyzrj2pgfXaaCgwuTIbfp-7owoBabMPSYusyLhcuyes2G9Jsw9mdQ&google_hm=Q0FFU0VMZkl6cmtRcmkyNXd0VXFlYWFjaks4
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H3
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:46 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 05 Dec 2022 13:20:45 GMT
Server
Apache-Coyote/1.1
P3P
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3FbuH8UsJasHH7gdvopCHGL3oyHgoJ09dGXm871A0HdX4eyzrj2pgfXaaCgwuTIbfp-7owoBabMPSYusyLhcuyes2G9Jsw9mdQ&google_hm=Q0FFU0VMZkl6cmtRcmkyNXd0VXFlYWFjaks4
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Sat, 01 Jan 2000 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 79BB
Redirect Chain
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DASkJ3FaZ412T...
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DASkJ3FaZ412T...
  • https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEyMDUxMzIwNDcwMDA4MTYzNzU1NDA5MA%3D%3D&google_push=ASkJ3FaZ412T4hSuxu6efIWZoWbTy2wEFcfqPyGqlWr-d8LbeJI4V-VuBXKSwyZ6pG4Ljj...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEyMDUxMzIwNDcwMDA4MTYzNzU1NDA5MA%3D%3D&google_push=ASkJ3FaZ412T4hSuxu6efIWZoWbTy2wEFcfqPyGqlWr-d8LbeJI4V-VuBXKSwyZ6pG4Ljj4fYG62SCZ8KqiEV93l8HOIgHTv8kVZ
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H3
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:47 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEyMDUxMzIwNDcwMDA4MTYzNzU1NDA5MA%3D%3D&google_push=ASkJ3FaZ412T4hSuxu6efIWZoWbTy2wEFcfqPyGqlWr-d8LbeJI4V-VuBXKSwyZ6pG4Ljj4fYG62SCZ8KqiEV93l8HOIgHTv8kVZ
pragma
no-cache
date
Mon, 05 Dec 2022 13:20:47 GMT
cache-control
max-age=0, no-cache, no-store
strict-transport-security
max-age=2628000
content-length
0
expires
Mon, 05 Dec 2022 13:20:47 GMT
sync
odr.mookie1.com/t/v2/ Frame 79BB
43 B
356 B
Image
General
Full URL
https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEO6-lkepVR0tahBAcHp3od4&google_push=ASkJ3FaD5TlBzrBe9myodW2vKBcopT6wNe4iJni18Qt_h8ozSZnAkIoqvzGkOf2QmV9bzk9op9DPauNWFu704b9hT0YKFyMjRcig&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.67.61 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
61.67.98.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:46 GMT
via
1.1 google
server
Apache
content-type
image/gif;charset=UTF-8
p3p
CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-application-context
application
expires
Thu, 01 Jan 1970 00:00:00 GMT
dds
rtb.openx.net/sync/ Frame 79BB
43 B
351 B
Image
General
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESEJqDKekZztUhZa1VBPMQwls&google_cver=1&google_push=ASkJ3Fbn85RdIu1e_rbKZxevWVMvYvpLvrNzinkyBwk6La12Ae4hFCMSMSfU3wFr9OO_azb5zJE5oQaMssMPrtZheAFlumkU5h0hRg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
103.252.227.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:46 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
e007biiv6lrg8q33913gtjip976onpg0
pixel
cm.g.doubleclick.net/ Frame 79BB
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENi52p4__ay8OYmTN-JGKRk&google_cver=1&google_push=ASkJ3FYri695AUcQ6EzHz-HL4p7s5XWw1LDRP_NhI8YFD2BWcvuPstXpuQa_ZVD1PvBobE9Dwgv...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJBVExZRzktMjItOE5PNw==&google_push=ASkJ3FYri695AUcQ6EzHz-HL4p7s5XWw1LDRP_NhI8YFD2BWcvuPstXpuQa_ZVD1PvBobE9DwgvcMyUkPwrDYpTdn38BhksuIPPtuA
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJBVExZRzktMjItOE5PNw==&google_push=ASkJ3FYri695AUcQ6EzHz-HL4p7s5XWw1LDRP_NhI8YFD2BWcvuPstXpuQa_ZVD1PvBobE9DwgvcMyUkPwrDYpTdn38BhksuIPPtuA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H3
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:46 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEJBVExZRzktMjItOE5PNw==&google_push=ASkJ3FYri695AUcQ6EzHz-HL4p7s5XWw1LDRP_NhI8YFD2BWcvuPstXpuQa_ZVD1PvBobE9DwgvcMyUkPwrDYpTdn38BhksuIPPtuA
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8f052d4f888ae4e0626c5f819879cacd
Expires
0
pixel
cm.g.doubleclick.net/ Frame 79BB
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_push=AS...
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_hm=Y43wLuqKluuEWKzV16s74QAAFAwAAAIB&google_nid=index&google_push=ASkJ3FaDaZZ0FyMYTRVdjD1EkTrPK35XKif2b...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_hm=Y43wLuqKluuEWKzV16s74QAAFAwAAAIB&google_nid=index&google_push=ASkJ3FaDaZZ0FyMYTRVdjD1EkTrPK35XKif2b1kXVSCL4Qg-wr9v4vWpxawqFcEafgeqPmZ6uff7TspOIy-U97ANzoBb8nvmwjQMSw
Requested by
Host: dreambook.in.ua
URL: https://dreambook.in.ua/
Protocol
H3
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:46 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:46 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rv4J5l7a%2B1pu%2FT1RR25AQKFJ0uosLupWJufJCoq7LB4Lw26LqwWRezY8mbxwrJVva5VYqRAaz0SwrkmcaJ%2Bn2%2BGUL2wPXqtYbl2xesSBqYYomOYe8O%2FNhovC%2FVxP1xxpxyErTFlr9NZ8ug%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEI3HR2h7DYL3DNdYsYcD460&google_hm=Y43wLuqKluuEWKzV16s74QAAFAwAAAIB&google_nid=index&google_push=ASkJ3FaDaZZ0FyMYTRVdjD1EkTrPK35XKif2b1kXVSCL4Qg-wr9v4vWpxawqFcEafgeqPmZ6uff7TspOIy-U97ANzoBb8nvmwjQMSw
cache-control
no-cache
cf-ray
774d14c4ac007750-LHR
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
expires
0
googleredir
googlecm.hit.gemius.pl/ Frame 79BB
0
0

attr
cm.g.doubleclick.net/pixel/ Frame 79BB
0
223 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ISrEMZkGWRQqor-MsAoMP0LSOGbVu0lhXJqnX_BtfYossMczaE2r2l8uU4R988YNoeiiKMDA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1670246446&rafmt=1&to=qs&pwprc=4567826781&format=1200x280&url=https%3A%2F%2Fdreambook.in.ua%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246446066&bpp=1&bdt=1647&idt=1&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Df00781729b14c1ee-222fc63843d80016%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw&gpic=UID%3D00000b8dc3e6233b%3AT%3D1670246445%3ART%3D1670246445%3AS%3DALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA&prev_fmts=300x250%2C300x250%2C0x0&nras=2&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2907&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=FkB6G1jeuf&p=https%3A//dreambook.in.ua&dtd=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY527LvspYY.woff2
fonts.gstatic.com/s/ibmplexsanscondensed/v13/ Frame 3EA4
18 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsanscondensed/v13/Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY527LvspYY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6b4f873f3371bd426336178dfe982cf8366df7592c21738d0e1261e67a0cb2e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 20:01:53 GMT
x-content-type-options
nosniff
age
580733
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18688
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:21:16 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Nov 2023 20:01:53 GMT
Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY5a67vspYY.woff2
fonts.gstatic.com/s/ibmplexsanscondensed/v13/ Frame 3EA4
18 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsanscondensed/v13/Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY5a67vspYY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
71fe56560b9eba788c8ff58e084f24ca95ff3b89aff510345fab96de36ec8101
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 03 Dec 2022 13:54:18 GMT
x-content-type-options
nosniff
age
170788
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18740
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:21:21 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 03 Dec 2023 13:54:18 GMT
Gg8iN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHYas8F_olYQtEw.woff2
fonts.gstatic.com/s/ibmplexsanscondensed/v13/ Frame 3EA4
20 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsanscondensed/v13/Gg8iN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHYas8F_olYQtEw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
09591867279cfa308e6366b2d6be5033904ef3de3c86b6f89cbe47e3022b7d99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 02 Dec 2022 10:08:15 GMT
x-content-type-options
nosniff
age
270751
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20496
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:21:15 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 02 Dec 2023 10:08:15 GMT
privacy_small.svg
static.criteo.net/flash/icon/ Frame AC59
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/privacy_small.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Tue, 11 Feb 2020 14:30:28 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42ba84-6aa"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
adchoices_en.svg
static.criteo.net/flash/icon/ Frame AC59
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/adchoices_en.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Tue, 11 Feb 2020 14:27:58 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42b9ee-759"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
close_button.svg
static.criteo.net/flash/icon/ Frame AC59
308 B
636 B
Image
General
Full URL
https://static.criteo.net/flash/icon/close_button.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Fri, 14 Feb 2020 13:51:32 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"5e46a5e4-134"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
308
expires
Thu, 30 Nov 2023 13:20:46 GMT
back_button2.svg
static.criteo.net/flash/icon/ Frame AC59
293 B
621 B
Image
General
Full URL
https://static.criteo.net/flash/icon/back_button2.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 28 Apr 2022 09:09:48 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"626a59dc-125"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
293
expires
Thu, 30 Nov 2023 13:20:46 GMT
lg.php
cat.fr.eu.criteo.com/delivery/ Frame AC59
43 B
347 B
Image
General
Full URL
https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=Ns0wfyB1GfGKclueEhCYwN_E1ni4nywXlk4Z-u4Gd1kaVK8s8snztGAi_4i4_FvO2Fh6Y-mocQwL_nTPs5V8J_OtcQOv9n4NHPMHsR2i2Io9J6Yy6LF40oKhLIKUrNPbg7FitxeFwdei0UGlF-Br4wZ36BJnnaROARiGw6pd3VrKBoSeOK3y5gRq3qOcjtVJ0sxQKjNFmTdgSA9O6lu9FA-LeP_cjgaP4qQFQSEtVANsWocm9jdU9007ANCB_MbSjR_Jej1hIzVkEph13WO0zy4oatHyDQw-vmHE5s1Wsw7lU0DvGnUXTo_SaGJBqPw6SXSWvJDDLQ3c5Lh_7fNhS2Ls0v_l5cL-UfujNXmxOgUxRJBp5aDuzVWEysvaDlNVycad0Kmh7SWtHVW5v7A2bpT7n3qicjIofi5KPwJnw7HUbm_s
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type
image/gif
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
2330625
expires
Mon, 26 Jul 1997 05:00:00 GMT
m
secure-gl.imrworldwide.com/cgi-bin/ Frame AC59
44 B
751 B
Image
General
Full URL
https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1670246445
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:2a00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
via
1.1 e44e0b24e706487eaec6b9e01f2166dc.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-cache
Miss from cloudfront
p3p
P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
cross-origin-resource-policy
cross-origin
content-length
44
pragma
no-cache
server
nginx
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods
POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
x-amz-cf-id
XLXOQGP2aAAFhswAQPYISlcMjg-oBD0ysMzMKHiJ30qqgN1Jl8nplA==
expires
Thu, 01 Dec 1994 16:00:00 GMT
animejs.js
static.criteo.net/animejs/ Frame AC59
12 KB
6 KB
Script
General
Full URL
https://static.criteo.net/animejs/animejs.js
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Tue, 26 Mar 2019 17:44:11 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5c9a64eb-3181"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
img
pix.eu.criteo.net/img/ Frame AC59
5 KB
5 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?h=556&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=196&s=cv-0XWAuCUcnqwngfrtP0s7A
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
080069b2dce01872cbc2bfcc0b6a2cd9b9a5b9fbb22fc1683ece0cea17aac96f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/png
cache-control
public, max-age=30197887
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
5106
expires
Mon, 20 Nov 2023 01:38:54 GMT
img
pix.eu.criteo.net/img/ Frame AC59
2 KB
2 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2Flogothyssenkrupp-Steel-Europe-AG-219788DE.gif%3Feb%3D1&v=3&w=800&s=Sm5m8DRAU33ucx2xoZmcosrJ&b=800
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
bc0b263c7a92aa4b891aba2e2792726b2b7ac1c068e55b37a073d95a8e9e5faf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=874846
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1554
expires
Thu, 15 Dec 2022 16:21:33 GMT
img
pix.eu.criteo.net/img/ Frame AC59
2 KB
2 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FR%2FlogoRefresco-Deutschland-GmbH-68743DE.gif%3Feb%3D1&v=3&w=800&s=HxTzWHo-hk514HNWhGfV11-0&b=800
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
26af37caf711acf7cf4483d7ca400806b22918f32ae2e1733fd54e24aa6f6c91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=65656
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
2136
expires
Tue, 06 Dec 2022 07:35:03 GMT
img
pix.eu.criteo.net/img/ Frame AC59
2 KB
2 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FT%2FlogoTDK-EPC-AG-Co-KG-95155DE.gif%3Feb%3D1&v=3&w=800&s=fa6--jzWWqhdJbsdaOaXvShE&b=800
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
66899a46f2b3bf4e14994e256fa8c3aa5b32571947d166350e10e88ae588412b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:45 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=1130
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1920
expires
Mon, 05 Dec 2022 13:39:37 GMT
img
pix.eu.criteo.net/img/ Frame AC59
1 KB
1 KB
Image
General
Full URL
https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FC%2FlogoMercedes-Benz-AG-237414DE-2106010949.gif%3Feb%3D1&v=3&w=800&s=JIAYYix35VmzVzG5CogYs-G7&b=800
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
9a73fe4f2b3f00d5f680adb3d4affae2a924b6ae4e8d3ea009c36f2f9177c0ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 4 Jun 2008 06:06:06 GMT
server
Finatra
vary
Origin
content-type
image/webp
cache-control
public, max-age=1866925
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1052
expires
Tue, 27 Dec 2022 03:56:12 GMT
all
csm.eu.criteo.net/ Frame AC59
0
127 B
Ping
General
Full URL
https://csm.eu.criteo.net/all?cppv=3&cpp=CU446hgR-I5xPNv4o1OHFknusvfw1gTa0_E65nfqKWCYDgYV1QvBcQoYfkqv3Lpf-erJAnt-fQca5FkfJHdDJFeNVTDYpXc5nKRkAFxCQA7Bt8wyIAFCTIUyF7DeGKX-lkUlAVzjKfEJnGTuIgpIU1niJ2Rn1Ra4G1mIGETUzn3z79YM-fPkEox2QgM8Eu0vBMyHbYCz6r7ys1eDhwu0Tyz2EY2j5E42NfCLKvXp0lW1TbTcR5xjI7d0SpA&sds=2&rev=83599&sendBeacon=true
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://ads.eu.criteo.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Mon, 05 Dec 2022 13:20:46 GMT
strict-transport-security
max-age=31536000; preload;
cross-origin-resource-policy
cross-origin
server
Finatra
content-length
0
criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame AC59
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/criteo_logo_2021.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 27 May 2021 13:21:59 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"60af9cf7-891"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
privacy.svg
static.criteo.net/flash/icon/ Frame AC59
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/privacy.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y43wLgACwe4ITwW_AAPniVNN6xlhGfmw9upayg&u=%7COP2%2FPe9g7jq1bT8XkPlzSKsSzily7GIqaUV9cXfV8ig%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC861rj35gAAPfgZz_iECm0jx2TPUc2KZmfMCVCst_WhFvUPNixNygoJZsPEXyaCIuayjIregyvCuy_LWYFarXxsQzj-RtbsAxUFJlqeSQrUfrZUBTquvVV9LPHMjanzPr7xtsG75G9c4kF3Pjull_K7QjHXA7NM8lpS0effGo74qvomTXotGqrpfMAUKshPfXBjQ1rYD0kAKLskTXHJsrDGO4QphimLFLh2gCLdMura37e_OTl0FKtWHOQqhSNKzyI4L0CEWzf0PDeywdx56QHNcjgV6InBgylY-QPUHJwQ8-q7ajD2f1b3CE4DY9-6_FzkyTcVm5SqNnilZ-uYDmq02dnZPM3UV8gG_uMO_v1olQXyDWqrJsWdURibTfeNd87_PrNHDR9y2qAKUSiDNqLnbj2xD7rP6RHpJzU8ryBFuw2NFKbK6t7i0Q-LI7luiPHxEQb2anx_TXfEsvU_UY-Z9wv9AzfPE6KZvQ8yfmJNYnM9C6CzOdyrCFpbNPbtBoyW2EtEw-_GcIRj9yrNSSHgt3WJ6xJBeJ0g-tjpUHoU6LD&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJcRQLvCNY-6DC7-LvPIPic-PsAnJntKxXL3xlPdwwI23ARABIABglQKCARdjYS1wdWItNjIyNzk4NjY5OTE1MDk4NsgBCakCRL-0GpessT6oAwGqBL4BT9BhafpNeNBI0gL9vnbIL00F5VXjDg8RVhiKEmAVSKi1WsBqxIFFRkpGcRxNp9jMmlff45-06C1a8CMvoWODnqlC0GwxSB3FtNbTUwyTLYnWxQrwskwjf6PLKjmq-fQSe6Mv-xMVhIy1zPzkiGuoP8Nbu8r3KOx1pG2WtcmBgThIThpc4JhLlVhZ7LGWRrgyHf1tZRJ3j4_Ah6vBEfKEc3amcFIqVWrm__bYzS2CkhSArmLW7YfLkbe-EBx5TYAGx83PmN-e7an5AaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0V1kaAX4OpCYZb9VaA-JDJ3N-WeA%26client%3Dca-pub-6227986699150986%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 19 Feb 2020 10:57:21 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e4d1491-646"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Thu, 30 Nov 2023 13:20:46 GMT
Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js
pagead2.googlesyndication.com/bg/ Frame 3EA4
36 KB
16 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 11:51:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5376
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15969
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 05 Dec 2023 11:51:10 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 49E7
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvMyC2JwsU01CWhpPH5cH711d09maS4hhQiRnqE5aJP6CqrY-7q2zSl0VTblivbrdH1Q4ctN00Jr3g6OJXB770jCFE2TrJsiN9_pQwc5PD6OjQbqu7_tam7RBK4lTv5vzDoBSyMIQ&sai=AMfl-YQAkgMqkCac7QxOB9MwCU_LFgu7Q7FvphS2jQizEPfOqE0G-3iKhGeF1A9x1nZ8FqR0GNziXn5amErzVeE&sig=Cg0ArKJSzKM9dHg5NvwUEAE&cid=CAQSGwDq26N9_Rul1j_8-pnWraPbkQp3c7B0mPrF0RgBIBM&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221130&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=2506542124&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670246445326&rpt=1010&met=mue&wmsd=0&pbe=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:47 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame BF9B
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstRnJ2nEyIC0fK1TUimjA06MQXTAk6iMCPhDLvSgvorbtfzOHgP2jqMDv_O6wgeegvMQcWn_GHnH0z00SOVUXNwZ1FDlxmcj4rkEDng_ij9XaR2eORzhYV9N3Abdi0sOUbHyj8LIg&sai=AMfl-YSaR28fyUZ96aP2_ZgJV-fdwgjUup9q9RSJcwGTXpuqVmsF5j5qReWsDWYQdJKvaxNOE13fDCJJwES1iew&sig=Cg0ArKJSzMaxNFgHjwHAEAE&cid=CAQSGwDq26N9rDDIDZPhRCOv3OI_spkEJgriPEckeRgBIBM&id=lidar2&mcvt=1002&p=0,1,124.25,1006&mtos=0,917,1002,1002,1002&tos=0,917,85,0,0&v=20221130&bin=7&avms=nio&bs=0,0&mc=0.76&if=1&vu=1&app=0&itpl=2&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670246446184&rpt=591&met=mue&wmsd=0&pbe=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 05 Dec 2022 13:20:47 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY527LvspYY.woff2
fonts.gstatic.com/s/ibmplexsanscondensed/v13/ Frame E4BC
18 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsanscondensed/v13/Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY527LvspYY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6b4f873f3371bd426336178dfe982cf8366df7592c21738d0e1261e67a0cb2e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 28 Nov 2022 20:01:53 GMT
x-content-type-options
nosniff
age
580734
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18688
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:21:16 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Nov 2023 20:01:53 GMT
Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY5a67vspYY.woff2
fonts.gstatic.com/s/ibmplexsanscondensed/v13/ Frame E4BC
18 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsanscondensed/v13/Gg8gN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHY5a67vspYY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
71fe56560b9eba788c8ff58e084f24ca95ff3b89aff510345fab96de36ec8101
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 03 Dec 2022 13:54:18 GMT
x-content-type-options
nosniff
age
170789
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18740
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:21:21 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 03 Dec 2023 13:54:18 GMT
Gg8iN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHYas8F_olYQtEw.woff2
fonts.gstatic.com/s/ibmplexsanscondensed/v13/ Frame E4BC
20 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsanscondensed/v13/Gg8iN4UfRSqiPg7Jn2ZI12V4DCEwkj1E4LVeHYas8F_olYQtEw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:700|IBM+Plex+Sans+Condensed:500i|IBM+Plex+Sans+Condensed:500|IBM+Plex+Sans+Condensed:600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
09591867279cfa308e6366b2d6be5033904ef3de3c86b6f89cbe47e3022b7d99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
null
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 02 Dec 2022 10:08:15 GMT
x-content-type-options
nosniff
age
270752
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20496
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:21:15 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 02 Dec 2023 10:08:15 GMT
sodar
pagead2.googlesyndication.com/getconfig/
14 KB
11 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221110&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8845286d2e58836dc10b1a30458e6a17eb253da07c90f7f0834befa9fe00f2c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:48 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11092
x-xss-protection
0
Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js
pagead2.googlesyndication.com/bg/ Frame E4BC
36 KB
16 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 11:51:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5378
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15969
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 05 Dec 2023 11:51:10 GMT
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6227986699150986&plah=dreambook.in.ua&bust=31071035
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 05 Dec 2022 13:20:48 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame CD77
13 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

accept-ranges
bytes
age
280
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:16:08 GMT
expires
Tue, 05 Dec 2023 13:16:08 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame DF3F
783 B
533 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
dad4b4c2f41b4a459797d55833044186756d6e5b6ebf2a63fcad057cd9be53e8
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-_ixY2iaEeoRKfLrS7_EXbA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://dreambook.in.ua/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
511
content-security-policy
script-src 'report-sample' 'nonce-_ixY2iaEeoRKfLrS7_EXbA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 05 Dec 2022 13:20:48 GMT
expires
Mon, 05 Dec 2022 13:20:48 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js
pagead2.googlesyndication.com/bg/ Frame CD77
36 KB
16 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 11:51:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5378
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15969
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 05 Dec 2023 11:51:10 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame DF3F
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221110&jk=3529445899688022&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

generate_204
tpc.googlesyndication.com/ Frame CD77
0
12 B
Image
General
Full URL
https://tpc.googlesyndication.com/generate_204?0anh_g
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 05 Dec 2022 13:20:48 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
sodar
pagead2.googlesyndication.com/pagead/
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221110&jk=3529445899688022&bg=!qKulq-_NAAbvMpMzzzI7ACkAdvg8WtZUlNL6y94LjJ_tv_YE6as1Mr6kJkbmk27E5mAuzkzsNwlffAIAAABUUgAAAA1oAQeZAqVyLflekzqJDGC464JJkocVf2HwloSCkHSR9yORZd9Z41JiKiuxxIHSmOhCV7YlxI08gxP7DXdnT_53RMoH-zVCxIcRxzKR_exsZCTK2hAyCixCSUVR6Awrg6xu4GttI7JtLUKX8UUSg7e0IEOnhDLyoPNzG0TDX-osVj-_NDfGB2NjP2NGsk5Q8nfL5is3pWLJh6N4RBlKi49FXyjGUsGtVoAb9pALw5b5jqX3hs6MlfyrtptMS1MFlISIDRzvi2zsv9OlhcCDJykeDEXGjaylRGqiu5iiDsiKkAdXU170cU_PTDnrhriQIpkb7TuXjiwtf1SfxQ7vJXN0NON1aUIN1hKmptVllgebUHMe_SGTrGUeip_GOUH1UOtRKV9ReyjuxV_7-HefB0X_LTC15e-DqdRODfNQ1jHvktmjjk65HSbjuaKZUZ8ijmDqqsEP0Sr55VH4YSulWmgB0IDog7xbLZCygEI-YyBdrEOWxFmxiqVEI9HnPTzQqqqXb746vG2JJ8ozTgMEWua6kgWv0-dI9POlbaeem1pS93pT4PEg2p62uLFeupLNhEZT2XmcrTlKax2vM9x933UG6HprA6GtnGSWOMJPnf6lceBIvLy11XnbRop7XErkr_woLn8IOPiYb7W6StRqQh_FIAew9QtxyEGMXM6Y72GHwpjCW-9BZIF_2xlbxqeCm_H6mwyNQFqhwLl6xhmnlqsYcZpCHIJrH0WyOs2cUdjhG2rqTlKFITfXtlMDPAX2eSowtr_smXE8wF6F16MH-xzrfKhGYxutVf8jucDJhOvo0SWVCSy7tEdBJpZJQ5-2oEg8xMTpGRyQNXm0mfIPyKkGeAN_pQpiNMj3QqADg7rwO_BwtpzLNoYjmcx7hpt5pGAtpczQ73IEyal_KQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://dreambook.in.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mc.yandex.ua
URL
https://mc.yandex.ua/sync_cookie_image_check
Domain
googlecm.hit.gemius.pl
URL
https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENbLPakUxPfuGMP9m8hu7s0&google_cver=1&google_push=ASkJ3FbV-dEhDwRSKBNF3320eE8RmjpFGOEDwVUGEiOocMFH9_yTOTa9dKUv0MfxkAO9QhgaAsNKjOk-phJMZF8oo5xDV_k8nL8Urw

Verdicts & Comments Add Verdict or Comment

135 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| oncontentvisibilityautostatechange function| $ function| jQuery object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY string| Page_ValidationVer boolean| Page_IsValid boolean| Page_BlockSubmit object| Page_InvalidControlToBeFocused function| ValidatorUpdateDisplay function| ValidatorUpdateIsValid function| AllValidatorsValid function| ValidatorHookupControlID function| ValidatorHookupControl function| ValidatorHookupEvent function| ValidatorGetValue function| ValidatorGetValueRecursive function| Page_ClientValidate function| ValidatorCommonOnSubmit function| ValidatorEnable function| ValidatorOnChange function| ValidatedTextBoxOnKeyPress function| ValidatedControlOnBlur function| ValidatorValidate function| ValidatorSetFocus function| IsInVisibleContainer function| IsValidationGroupMatch function| ValidatorOnLoad function| ValidatorConvert function| ValidatorCompare function| CompareValidatorEvaluateIsValid function| CustomValidatorEvaluateIsValid function| RegularExpressionValidatorEvaluateIsValid function| ValidatorTrim function| RequiredFieldValidatorEvaluateIsValid function| RangeValidatorEvaluateIsValid function| ValidationSummaryOnSubmit function| WebForm_OnSubmit object| mqlA300 object| adsbygoogle object| Page_Validators object| ctl00__1_3_rfvc boolean| Page_ValidationActive function| ValidatorOnSubmit object| mql object| mql4 object| mql900 boolean| show_scrollbox boolean| show_fizedbox number| height_scrollbox number| height_sidebar number| top_main object| Ya object| jQuery18306039773698535218 object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_tag_data object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue function| google_process_slots boolean| google_apltlad function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map object| google_ama_state number| google_rum_task_id_counter string| google_user_agent_client_hint object| yaCounter20123911 object| yaCounter35172605 function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages object| google_llp object| googletag object| GoogleGcLKhOms object| google_image_requests

35 Cookies

Domain/Path Name / Value
.dreambook.in.ua/ Name: _ym_uid
Value: 1670246445225849332
.dreambook.in.ua/ Name: _ym_d
Value: 1670246445
.mc.yandex.com/ Name: sync_cookie_csrf
Value: 396376031fake
.dreambook.in.ua/ Name: _ym_isad
Value: 2
mc.yandex.com/ Name: yabs-sid
Value: 2319532621670246445
.yandex.com/ Name: i
Value: J21S3fQDymhuCU8ZarFP2SHC7tCVt9gRXQHXso2hkEIUAVAdiWnV7MA6p1n5cMKa9AKCb4VZaLbsiz2E6pOnrrWNYbA=
.yandex.com/ Name: yandexuid
Value: 3992247111670246445
.yandex.com/ Name: yuidss
Value: 3992247111670246445
.mc.yandex.ru/ Name: sync_cookie_csrf
Value: 379682815fake
.mc.yandex.com/ Name: sync_cookie_ok
Value: synced
.dreambook.in.ua/ Name: __gads
Value: ID=f00781729b14c1ee-222fc63843d80016:T=1670246445:RT=1670246445:S=ALNI_MYIGPBjjwdGvfsj1CcLupijIlosWw
.dreambook.in.ua/ Name: __gpi
Value: UID=00000b8dc3e6233b:T=1670246445:RT=1670246445:S=ALNI_MYR0lpeqWSfKE9SkucbcUof8IYInA
.dreambook.in.ua/ Name: _ym_visorc
Value: w
.yandex.ru/ Name: yandexuid
Value: 3992247111670246445
.yandex.ru/ Name: yuidss
Value: 3992247111670246445
.yandex.ru/ Name: i
Value: J21S3fQDymhuCU8ZarFP2SHC7tCVt9gRXQHXso2hkEIUAVAdiWnV7MA6p1n5cMKa9AKCb4VZaLbsiz2E6pOnrrWNYbA=
.yandex.com/ Name: ymex
Value: 1701782445.yrts.1670246445#1701782445.yrtsi.1670246445
.doubleclick.net/ Name: IDE
Value: AHWqTUmp9SA-6Se8RFr0wcSS_mH3DoMg6yyUgR5mp8Q1a2lgVpO3B2qeo84NvSQThow
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.doubleclick.net/ Name: DSID
Value: NO_DATA
.casalemedia.com/ Name: CMID
Value: Y43wLuqKluuEWKzV16s74QAA
.casalemedia.com/ Name: CMPS
Value: 5132
.casalemedia.com/ Name: CMPRO
Value: 5132
.agkn.com/ Name: ab
Value: 0001%3AQZP4ZhvHkjLucJ18IQzbWKR%2BiJvFr0LB
.agkn.com/ Name: u
Value: C|0CEArIKyuKyCsrgAAAAAAAQ13AQCAAQpAAAAAAA
.casalemedia.com/ Name: CMTS
Value: 2176
.e.dlx.addthis.com/ Name: na_tc
Value: Y
.addthis.com/ Name: na_id
Value: 2022120513204700081637554090
.addthis.com/ Name: na_tc
Value: Y
.addthis.com/ Name: uid
Value: 638df02f4a4dd39d
.addthis.com/ Name: ouid
Value: 638df02f0001421dca3c07bd4880dd5956c93c1ace8bd1f2b123
.dlx.addthis.com/ Name: na_rn
Value: 0
.dlx.addthis.com/ Name: na_sr
Value: 20221205
.dlx.addthis.com/ Name: na_srp
Value: 3614
.dlx.addthis.com/ Name: na_sc_e
Value: 0

5 Console Messages

Source Level URL
Text
network error URL: https://mc.yandex.ua/sync_cookie_image_check
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
other warning URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6227986699150986&output=html&h=250&slotname=7417808956&adk=1198173441&adf=4187061096&pi=t.ma~as.7417808956&w=300&lmt=1670246445&format=300x250&url=https%3A%2F%2Fdreambook.in.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1670246444941&bpp=1&bdt=523&idt=391&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=4824436152772&frm=20&pv=1&ga_vid=262738222.1670246445&ga_sid=1670246445&ga_hid=1094144779&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=990&ady=1152&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44773614%2C31071035%2C31060048&oid=2&pvsid=3529445899688022&tmod=1438892011&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=OZXkpFoeEw&p=https%3A//dreambook.in.ua&dtd=394
Message:
Origin trial controlled feature not enabled: 'attribution-reporting'.
security error URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1(Line 21)
Message:
The Content Security Policy 'child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/index.html' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
network error URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENbLPakUxPfuGMP9m8hu7s0&google_cver=1&google_push=ASkJ3FbV-dEhDwRSKBNF3320eE8RmjpFGOEDwVUGEiOocMFH9_yTOTa9dKUv0MfxkAO9QhgaAsNKjOk-phJMZF8oo5xDV_k8nL8Urw
Message:
Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
network error URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12406491265686199930/undefinedz9njpo
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
adservice.google.com
adservice.google.de
cat.fr.eu.criteo.com
cm.g.doubleclick.net
csm.eu.criteo.net
d.agkn.com
dreambook.in.ua
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
mc.yandex.com
mc.yandex.ru
mc.yandex.ua
minergate.com
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
pixel.rubiconproject.com
rtb.fr.eu.criteo.com
rtb.nl.eu.criteo.com
rtb.openx.net
secure-gl.imrworldwide.com
ssum-sec.casalemedia.com
static.criteo.net
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
yandex.st
googlecm.hit.gemius.pl
mc.yandex.ua
142.250.185.194
172.64.154.237
178.250.0.160
2600:9000:223c:2a00:1e:a43d:b640:93a1
2606:4700:3031::ac43:cd91
2a00:1450:4001:801::2002
2a00:1450:4001:808::2002
2a00:1450:4001:810::2003
2a00:1450:4001:812::2001
2a00:1450:4001:813::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::200a
2a00:1450:4001:831::2002
2a02:2638:1::17
2a02:2638:1::2
2a02:2638:1::3
2a02:2638:1::8
2a02:2638::2
2a02:2638::b
2a02:6b8:20::215
2a02:6b8::1:119
3.74.33.199
34.98.67.61
35.227.252.103
49.12.80.41
69.173.144.165
69.192.160.219
080069b2dce01872cbc2bfcc0b6a2cd9b9a5b9fbb22fc1683ece0cea17aac96f
093da471f5256cc2c4143fef0a012c247888761f0d398659582dc56da5769a16
09591867279cfa308e6366b2d6be5033904ef3de3c86b6f89cbe47e3022b7d99
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1ec4d3d0699cec4dac9fdc379d3259108b8fe20ed29ef79eccf0817c884dc6a6
208c0ffa948b4422487703da66c44cad2e40d9b3e1e7a7d4cd1146e562793327
252de26441cca646d376c6b5c43ed5ca83f6f16d771123ac4fc1b3888b2ebe13
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
26af37caf711acf7cf4483d7ca400806b22918f32ae2e1733fd54e24aa6f6c91
273a09036e7edf6ddceac33ab6e1cecf2d4b1eb3c4bf40fc5e18a8d668d52676
2cc6cef59f091fa402ac846fe156fadc768fa16078475f8e2b6a808e0fdc1380
302e69dd5cd67c33a01a5d0308c1ead25d5967bd0810b0c073f9fe18124de7bd
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3746e92445d6d0487be17921f261a66d41ecaf504bb776be0fde2347d1d187cf
3894faa2322f186cd91f46a5232c2b74c9e76c9fd27aaca18212504bfadb589e
3e216fb71de249dae0a7a1fead4486815c4abeb4052ccdef6d19c4a5b5bb0f52
40a158fc874b49cac7b9d00073b49f01a3dd7fd933ec67a5ee31354104b57089
414a47dba5e34a26bc453a35dc057a5e651ab59b28491a693abc958ab77d46eb
42cc80741ade3b46ade00bcdc89253cab8cb30d5c3aec41ac18072dc708b75ce
48aba25efe941b83f621cb111f13a1f9a129c0fc6979a2a12e0fec716103f69b
4a843a4cce8f92aadf37f49608a2db9014a8e2899a134715d9d7efa934fe3658
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56ae7b158fe30afdf7409073e98697d4fe1f7c3b9eeb0d7262802fccc5453ccb
5ddc9584f279855447fcb714a88ba33ed55e11f5f7758c602f55b556121ce299
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573
61651edfb03aae1c1007d6741f98171447ae7b1a67aaa520d8b0a959e0400885
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61e1ae6218645ef3f2d9ce5087ed2e2aeb7781c3adf8296a3adf0dd17ee06ad3
66899a46f2b3bf4e14994e256fa8c3aa5b32571947d166350e10e88ae588412b
6847a453292f6db177d022b32b68ec91da611dd1bc18c6e33d26ed726339bc60
6b4f873f3371bd426336178dfe982cf8366df7592c21738d0e1261e67a0cb2e2
6c12e1209efcb45bbc84f530bafac68ece315a70dfb1732b54238bec65010710
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
71fe56560b9eba788c8ff58e084f24ca95ff3b89aff510345fab96de36ec8101
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
735fd17212c327597d338eb9ace537d6eb2a108604907accefa95af5c78c7b5a
78631aa2658006d43b70adcf42bfef831d29315d91bfe9e67bb4acd5f9b349e3
78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53
7bd52a71b1144108d7ba13ec5c770ea3c99546a3209fcfe6cfe7231a49e53aa8
809671b4a80114a50716fe5edc470c1f90cd9059029a4a28170c18500b37efa0
8845286d2e58836dc10b1a30458e6a17eb253da07c90f7f0834befa9fe00f2c2
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
9077bd4ca033049154d7e3d5d198fa087efd1c73bf9ed8909f1d48d9a8dca799
9209b27a04396910366c0bc3ac620f5792e91d93f441b566a0139095f0733961
92bf5ad018fb0ce559f762515cb78894b0e5743d5e69663c4d78f139d3261eb9
944979b576ee52348d5c63d35f566c11df26f70ed15d2ceba61180662a49b114
9a73fe4f2b3f00d5f680adb3d4affae2a924b6ae4e8d3ea009c36f2f9177c0ea
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9d0d1eb333b1b81276d7f0be6750f16710d8415e51d455f51e42390221d2d69b
9d67583be1d8964571b098f0e7531c37052e7402b8f939a5d1c3065d88b6b7f6
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
9ecc0b3e1f763edd8ef35fad325dba4d9dc9786369c255500dcee75e673ac000
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a6e22eba51ae13ff030b51fc14a3f33614fedb30eb79ec1e73fa9ff40cda2399
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a842670e0c9a10d0c42dc6de87889c6b9de065232e6bf125d5ca43a163f6d9fd
abf06691088fd3e48eeca737b56e448a96b06b1d7abb1495b634efcc2795aa89
aeaa9e7c8c70d2ce5431cfdf5387e4a96fd55ff14fadd4420cf7cfe6adf01aa1
af0478e1e9e321b6896053a3cb015eafa853b8c3616db73b46e9dc339bca3849
b9b55eda4118e5fda9876af796e33d19cbb2661da9e0594f2d7837039f0e0ac1
bc0b263c7a92aa4b891aba2e2792726b2b7ac1c068e55b37a073d95a8e9e5faf
bd36f76b2fa94e00b565eedefd63b717457a8ef80c0d0d26328dcea799556c2d
c0dade5e40511841f841814ed717788248c50490400ef63f4620391825f7444e
c46386899a9d9ccb637debd2f095442639041efa677ec3c8434ab77b7a1c7ef7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d68abc4c4bda8b4c4ec377ee852513b7114327c77cd107b25bab141e753ac57b
dad4b4c2f41b4a459797d55833044186756d6e5b6ebf2a63fcad057cd9be53e8
e0ae86481c149d356cf49579e071681c7e6383fe22328be60dff7fa8149b88c7
e374176d6c978facc5f3375f7ebe98f35e436b662fa2c9792e066c1a21cda4cd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e58a9af019771ed14ac50791c01848e616ad28c8d3cb910e6b7b780c4ff81a37
ecb3c8b5dc4308fb64e9ed50c77ad80b2e3df2fd32f091a19410963b52119d80
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48