winzoro.net Open in urlscan Pro
194.67.68.223 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://winzoro.net/
Effective URL:
https://winzoro.net/
Submission: On November 26 via api (November 26th 2023, 2:46:17 pm UTC) from US — Scanned from DE

Summary HTTP 159 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 20 IPs in 6 countries across 21 domains to perform 159 HTTP transactions. The main IP is 194.67.68.223, located in Russian Federation and belongs to AS-REG, RU. The main domain is winzoro.net.
TLS certificate: Issued by R3 on October 12th 2023. Valid for: 3 months.

This is the only time winzoro.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 33	194.67.68.223 194.67.68.223	197695 (AS-REG) (AS-REG)
5	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
4	2606:4700:e2:... 2606:4700:e2::ac40:8d0d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a02:6b8:a::a 2a02:6b8:a::a	208722 (GLOBAL_DC) (GLOBAL_DC)
15	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	185.177.94.152 185.177.94.152	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
6	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
4 17	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
1 2	88.212.201.204 88.212.201.204	39134 (UNITEDNET) (UNITEDNET)
2 13	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
8	2a02:6b8:20::215 2a02:6b8:20::215	208722 (GLOBAL_DC) (GLOBAL_DC)
6	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
28	2a00:1450:400... 2a00:1450:4001:802::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
2 2	52.28.224.148 52.28.224.148	16509 (AMAZON-02) (AMAZON-02)
6	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1 1	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1	52.59.98.46 52.59.98.46	16509 (AMAZON-02) (AMAZON-02)
1	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2 2	37.157.4.29 37.157.4.29	198622 (ADFORM) (ADFORM)
4	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
159	20

33 194.67.68.223 (Russian Federation) 1 redirects

ASN197695 (AS-REG, RU)
PTR: 194-67-68-223.cloudvps.regruhosting.ru

winzoro.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:e2::ac40:8d0d (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:6b8:a::a (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.177.94.152 (Amsterdam, Netherlands)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: ip-185-177-94-152.ah-server.com

broluckycode.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a02:6b8::1:119 (Moscow, Russian Federation) 4 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.204 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host204.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:6b8:20::215 (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.28.224.148 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-224-148.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Loerrach, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.59.98.46 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-98-46.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.4.29 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 97 tpc.googlesyndication.com — Cisco Umbrella Rank: 149	530 KB
33	winzoro.net 1 redirects winzoro.net	1 MB
19	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 245	175 KB
15	yandex.com 3 redirects mc.yandex.com — Cisco Umbrella Rank: 8755	4 KB
12	gstatic.com fonts.gstatic.com www.gstatic.com	172 KB
10	yandex.ru 1 redirects yandex.ru — Cisco Umbrella Rank: 2158 mc.yandex.ru — Cisco Umbrella Rank: 4034	165 KB
8	yastatic.net yastatic.net — Cisco Umbrella Rank: 6894	214 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 212	319 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	5 KB
4	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 145
4	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2	760 B
4	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1002	150 KB
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 599	1 KB
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 912	2 KB
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 11595	1 KB
1	criteo.com dis.criteo.com — Cisco Umbrella Rank: 597	363 B
1	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 351	147 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 5683	555 B
1	adition.com 1 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1533	587 B
1	everesttech.net 1 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 709	543 B
1	broluckycode.site broluckycode.site	321 B
159	21

	Domain	Requested by
33	winzoro.net	1 redirects winzoro.net
28	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
15	mc.yandex.com	3 redirects winzoro.net mc.yandex.ru
15	pagead2.googlesyndication.com	winzoro.net pagead2.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com tpc.googlesyndication.com
13	googleads.g.doubleclick.net	2 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net winzoro.net
8	yastatic.net	yandex.ru
8	yandex.ru	winzoro.net yandex.ru yastatic.net
6	cm.g.doubleclick.net	googleads.g.doubleclick.net winzoro.net
6	www.gstatic.com	googleads.g.doubleclick.net
6	fonts.gstatic.com	fonts.googleapis.com
5	www.googletagservices.com	googleads.g.doubleclick.net
5	fonts.googleapis.com	winzoro.net googleads.g.doubleclick.net
4	www.googleadservices.com	winzoro.net googleads.g.doubleclick.net
4	www.google.com	2 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
4	use.fontawesome.com	winzoro.net use.fontawesome.com
2	c1.adform.net	2 redirects
2	pm.w55c.net	2 redirects
2	counter.yadro.ru	1 redirects winzoro.net
2	mc.yandex.ru	1 redirects winzoro.net
1	dis.criteo.com	googleads.g.doubleclick.net
1	x.bidswitch.net	googleads.g.doubleclick.net
1	ads.travelaudience.com	1 redirects
1	dsp.adfarm1.adition.com	1 redirects
1	sync-tm.everesttech.net	1 redirects
1	broluckycode.site	winzoro.net
159	25

This site contains links to these domains. Also see Links.

Domain
oauth.vk.com
www.facebook.com
www.liveinternet.ru
vk.com
vsthemes.org
7themes.su

Subject Issuer	Validity	Valid
winzoro.net R3	`2023-10-12` - `2024-01-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
use.fontawesome.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-10`	a year	crt.sh
*.xn--d1acpjx3f.xn--p1ai GlobalSign ECC OV SSL CA 2018	`2023-06-21` - `2023-12-19`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
0.broforyou.me R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-08-14` - `2024-01-24`	5 months	crt.sh
*.yastatic-net.ru GlobalSign ECC OV SSL CA 2018	`2023-07-10` - `2024-01-07`	6 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2023-12-23`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 21 frames:

Primary Page: https://winzoro.net/
Frame ID: 0CA9089E25854BC9C8BAD456E56146A0
Requests: 77 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/zrt_lookup_fy2021.html
Frame ID: B131E968AE24AE1DCE2743C7D38E5325
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&adk=1812271804&adf=3025194257&lmt=1701009946&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x810_l%7C188x810_r&format=0x0&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~5~6&ascmds=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009946736&bpp=6&bdt=256&idt=225&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6112926642607&frm=20&pv=2&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=247
Frame ID: 36E69BB86A582E8002BF896C92913010
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7
Frame ID: B848D25D28724E596C8C01CD00DF0438
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 4ED20C92744E8AD89B4F40D95267CA69
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 475A2213E2EA6206EF4EB406CA34BD33
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 5D7FF9BE64B8540D1DC4A2140857A848
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 208ACE1F9977DD08D35FB59CCD3970C9
Requests: 17 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 8A3708F94FB77FCD8C8B81022ECBA095
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 05D0BF6380844CB4595B172A1B17FF93
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 69BF89A29F9E7FB97E071A20B675A239
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 811841E2DBEE2E4DB2393BA7670596D6
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js
Frame ID: B25854099476C4B534F67D8F20F3A5C9
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js
Frame ID: 94E703B21B0D015C5D7F07BBC6E1877B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js
Frame ID: A2D1690DB9918562DD467EC0C531F755
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js
Frame ID: B098BFBA59D33EED236884A277555706
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js
Frame ID: 0F45D73200C0C20E203FDC16B402DAAF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7
Frame ID: AB255465C12B290FEC0C00527A2AB217
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7
Frame ID: FAF6C839DC4DF01C481228AD0794FECB
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 8EBBDE355A351D397ECCB1E022654957
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 83AFAD9BD70C78CF6AE6190A3D57C96C
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Оформление интерфейса рабочего стола windows 11/10/8/7/XP

Page URL History Show full URLs

http://winzoro.net/ HTTP 301
https://winzoro.net/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

159
Requests

92 %
HTTPS

50 %
IPv6

21
Domains

25
Subdomains

20
IPs

6
Countries

3249 kB
Transfer

6905 kB
Size

32
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://oauth.vk.com/authorize?client_id=3469268&redirect_uri=https%3A%2F%2Fwinzoro.net%2Findex.php%3Fdo%3Dauth-social%26provider%3Dvk&scope=offline%2Cemail&state=ca2e4f0c9db8cc2583f6f2c9f3ca3ef6&response_type=code&v=5.90
Title: Вконтакте

Search URL Search Domain Scan URL

URL: https://www.facebook.com/dialog/oauth?client_id=405359266316555&redirect_uri=https%3A%2F%2Fwinzoro.net%2Findex.php%3Fdo%3Dauth-social%26provider%3Dfc&scope=public_profile%2Cemail&display=popup&state=ca2e4f0c9db8cc2583f6f2c9f3ca3ef6&response_type=code
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.liveinternet.ru/click

Search URL Search Domain Scan URL

URL: https://vk.com/winzoro

Search URL Search Domain Scan URL

URL: https://vsthemes.org/
Title: VSThemes.org

Search URL Search Domain Scan URL

URL: http://7themes.su/
Title: 7themes.su

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://winzoro.net/ HTTP 301
https://winzoro.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://counter.yadro.ru/hit?t45.1;r;s1600*1200*24;uhttps%3A//winzoro.net/;0.8828468652926302 HTTP 302
https://counter.yadro.ru/hit?q;t45.1;r;s1600*1200*24;uhttps%3A//winzoro.net/;0.8828468652926302

Request Chain 56

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10199.auMZIT22vzyt4f_g1FU5s-m-dd3g2KZZ-2Z9mHzY7dXSG3twsZ1hfgE27dJCFYZ6.6Z70It8UJSn7vRG2TgnR3r4pyLk%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10199.eLDsHoTLcFCUqje0nFem-V7aR3fqm65dgM-4NA8SFuzc61U6wNhyzEV1i6SlB3-Bu_v6q1NU9BiLzlIyxDXCAoAiEKYf8v7O3RMBEZt7x9BrsWSRpDihPEPUA99ItkDkf27Wr8PoY6F9MQBtu1WraJf7HAxZMKIZUutimOmhUe4shN2NlThAYOZjrVJvpWi8JVElMRvaKQXrI37cidqoC9xearGYLFFVsVLwqdfTThg%2C.m8bh14dshTw95cxq2kndLr0_s-I%2C

Request Chain 58

https://mc.yandex.com/watch/294956?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A2%3Adp%3A1%3Als%3A1360091472738%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A486988743%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=mc(p-1)clc(0-0-0)aw(1)ti(1) HTTP 302
https://mc.yandex.com/watch/294956/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A2%3Adp%3A1%3Als%3A1360091472738%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A486988743%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=mc%28p-1%29clc%280-0-0%29aw%281%29ti%281%29

Request Chain 59

https://mc.yandex.com/watch/9377854?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afp%3A1034%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A1%3Adp%3A0%3Als%3A1687920505372%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A992609575%3Arqn%3A1%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C142%2C255%2C2%2C138%2C0%2C%2C%2C%2C%2C%2C%2C%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(1)aw(1)ti(1) HTTP 302
https://mc.yandex.com/watch/9377854/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afp%3A1034%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A1%3Adp%3A0%3Als%3A1687920505372%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A992609575%3Arqn%3A1%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C142%2C255%2C2%2C138%2C0%2C%2C%2C%2C%2C%2C%2C%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=gdpr%2814%29mc%28p-1%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29

Request Chain 104

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 117

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&google_cver=1&google_push=AXcoOmSuUGFJ5SdoKKCu47UJws9hzJQSh55NkDfZLHsesRyNSLNdc1qHAI1ioSOzr-mgmAdvAn8pafIuCDKZgQmSyYlqmwWZqWSVKw HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&google_cver=1&google_push=AXcoOmSuUGFJ5SdoKKCu47UJws9hzJQSh55NkDfZLHsesRyNSLNdc1qHAI1ioSOzr-mgmAdvAn8pafIuCDKZgQmSyYlqmwWZqWSVKw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MW9XWmFCTFcxUjdnb2s1&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&google_cver=1&google_push=AXcoOmSuUGFJ5SdoKKCu47UJws9hzJQSh55NkDfZLHsesRyNSLNdc1qHAI1ioSOzr-mgmAdvAn8pafIuCDKZgQmSyYlqmwWZqWSVKw

Request Chain 118

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESELyBv8OGL3D2i402v-SINvo&google_cver=1&google_push=AXcoOmSai_j4ICW0EGVFPBIsZjQ1yAShulcpLKlQMblKIX2WllSPViIIR5497AmVKCldCCc3hzujgzyFsuLzSjj9_sngQY1jsqCzmxo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESELyBv8OGL3D2i402v-SINvo&google_push=AXcoOmSai_j4ICW0EGVFPBIsZjQ1yAShulcpLKlQMblKIX2WllSPViIIR5497AmVKCldCCc3hzujgzyFsuLzSjj9_sngQY1jsqCzmxo

Request Chain 119

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEPdkXvC8md48oJDN8fZ9wzQ&google_cver=1&google_push=AXcoOmRV3DZ-08opPCNND3ziL78APgeYTYoGVbV4Xbe7mArELu-G3cDD1PRzT-z-sOdVoHpcP2WFIf96lIljkytnsc88iY0x5BkpSlM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNTc4MjA5Njg0NTkyODYwOA%3D%3D&google_push=AXcoOmRV3DZ-08opPCNND3ziL78APgeYTYoGVbV4Xbe7mArELu-G3cDD1PRzT-z-sOdVoHpcP2WFIf96lIljkytnsc88iY0x5BkpSlM

Request Chain 120

https://ads.travelaudience.com/google_pixel?google_gid=CAESEHGSkVICjWhnU2W15HuusNI&google_cver=1&google_push=AXcoOmSThpxTnqRXiKSyI-qvL_oeVyzmD6yvXlvesM4pRESN4JqaOqyDlxYpryp9TAExM2xfVSQz7xMTwdcruNas24TdFlvNUlAWz8Y HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=5xfJy0Z8Q0Ao2Eusn5USyA&google_push=AXcoOmSThpxTnqRXiKSyI-qvL_oeVyzmD6yvXlvesM4pRESN4JqaOqyDlxYpryp9TAExM2xfVSQz7xMTwdcruNas24TdFlvNUlAWz8Y

Request Chain 123

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEB9eaWxLpjOnqgGnyLNu3XI&google_cver=1&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1DwBjJGQobXj3wetjXHwt43NudG9lg HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEB9eaWxLpjOnqgGnyLNu3XI&google_cver=1&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1DwBjJGQobXj3wetjXHwt43NudG9lg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIyNzkxODUzOTIwOTc2Mjg0OQ&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1DwBjJGQobXj3wetjXHwt43NudG9lg

Request Chain 129

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 131

https://googleads.g.doubleclick.net/pagead/adview?ai=ClGxMG1pjZYHDAbaLwuIP1uO8-AKjh-mtdKzP_-bnEe3p2r_NARABIOOQ1RFglfrwgYwHoAGDrI2qKsgBCakCB8Q0K5Nasj6oAwHIA8sEqgS8AU_Qit3i1j89Yyykz8oOeFYxv1xOKDjY71oSBba1Ddwf-WlkNFoYHh7teiVgigYvfkfv8jdtNA44v0p98oWxUws5-pLNfHA1LdIaEgsMk2Z7ZWKjAuJEMTfYlbSzGIQNgBIE5003YJa8ufWoRXNgWzIENUkqFnEhZrqUpJccwNSB63u__cBpIsN7X_PeG69iy5oEV9KIrN-vzzeib4CLWx52u9TfGFn2QVo4y3jzUcePXJpC-JGVOnRKyT63wASjwb7vwgSIBb2MwLRNoAYugAeD5N2JBagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEOHWFtIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqaCTVodHRwczovL25vdmFwb3N0LmNvbS91ay1kZS9zZW5kL3BhcmNlbHMtYW5kLWRvY3VtZW50c4AKAcgLAaIMGCoWChTktLEC7rWxArW4sQLktLEC7rWxArgT5APYEwOIFAHQFQGYFgGAFwGyFxwKGggAEhRwdWItNDM3OTM1Mzg0MDU5OTYzMxgA&sigh=aFXkimyUWn0&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwDICaaNbVtFdCyRHHtHnbJFuhDhh02dGQN7vgqF4SWL6XquAWecd_66fdr2Bn-ynEXz--ridQCTzqUoQYFiy-Uv8PpsFOf0qmg575zLLSUYAQ&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2214229431237440384029%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211362588163%22],%224%22:[%2211-26%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229621900983401509297%22}&andc=true

Request Chain 133

https://googleads.g.doubleclick.net/pagead/adview?ai=CeIqFHFpjZc8z2q63B7jykZgMyfaP0nLy3KDCoxKzvYus1g4QASDjkNURYJX68IGMB6AB5qD40ALIAQKoAwHIA8kEqgS5AU_QBpp_Nus-xHUm78z_mKsSjb9gUYrUkXvqbJi8DQwMXcm5_NNMzejuwv_mtLMLUH0FwpGB9dWf5xL9Xg41cbz00x9RveZhSi8mgBVIiSeWa31Tycz5Hc2Ea6NLf4pb1xOhO46pYvHE-WIkUta2UOAp3pvJsGMASxbwUJv1mpq2HeQNx10cAUK_WO7bH1TTl90jLwNTCKCYYbYD30mDYPDzyUG99qjfN5z0n__2S89D1LgbsTC0nwgkwATp5YS9sQSIBe6f2atMkgUECAQYAZIFBAgFGASgBgKAB4Lfh68BqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQy44D0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJM2h0dHBzOi8vZ2V0ZWFzeXBkZi5jb20vcGRmL2xwND90eXBlPXZpZXdwZGYmbGFuZz1kZYAKAcgLAaIMGCoWChTktLEC7rWxArW4sQLktLEC7rWxAtgTDNAVAYAXAbIXHAoaCAASFHB1Yi00Mzc5MzUzODQwNTk5NjMzGAA&sigh=-hXt9nEMvl4&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSOwDICaaNFYemB7rCYvxsBbWtZibGNRrauXSYii-X97iOROlPXJ0vvdhmPo1_aE58I8Fnn40mDbhlXIudGAE&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216325362202943824154%22,%22debug_reporting%22:true,%22destination%22:%22https://geteasypdf.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22706613350%22],%224%22:[%2211-26%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%228370071914924008545%22}&andc=true

159 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
winzoro.net/
Redirect Chain

http://winzoro.net/
https://winzoro.net/

69 KB
13 KB

649ms
255ms

Document
text/html

194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

194-67-68-223.cloudvps.regruhosting.ru

Software

nginx /

Resource Hash

7610c8eff28cc17e0461f966280f48e3f3c88914b4028eb841c80750dd3d1fb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 26 Nov 2023 14:45:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: same-origin same-origin
server: nginx
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN SAMEORIGIN
x-permitted-cross-domain-policies: master-only master-only
x-xss-protection: 1; mode=block 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 162
Content-Type: text/html
Date: Sun, 26 Nov 2023 14:45:45 GMT
Location: https://winzoro.net/
Referrer-Policy: same-origin
Server: nginx
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: master-only
X-XSS-Protection: 1; mode=block

GET
H2 200 css
fonts.googleapis.com/ 6 KB
1 KB 103ms
42ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Exo+2:300,400,500,700&subset=cyrillic

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1f753192dcf35c9feebe309f936821c36a397a993388b992158458c505fe386a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 26 Nov 2023 14:45:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 26 Nov 2023 14:45:46 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.2.0/css/ 46 KB
10 KB 123ms
45ms Stylesheet
text/css 2606:4700:e2::ac40:8d0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.2.0/css/all.css
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8d0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:45:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1591479
etag: W/"20a9ce516eaea76da29a23adc43e8998"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K8vz%2FP7tXeCZJMH2iWSXmHcChtViXRbDv8ajVkh%2FTl%2FU%2Fa4GqE9%2BwVD9FU3M35DjacVfa%2FcjwbpzavF5guw6gFvwRTYZhecajowkY5DjnUFeE%2Bs5BzDcCY4wGG7sG%2FcvmRHlhUA%2Bey3QrIPPoWYY8XPR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 82c2eac61ae03c83-CDG
alt-svc: h3=":443"; ma=86400

GET
H2 200 engine.css
winzoro.net/templates/alliline/assets/min/ 24 KB
5 KB 225ms
224ms Stylesheet
text/css 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://winzoro.net/templates/alliline/assets/min/engine.css?1697072480
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 9ffef098b884c7af804c3cdc2ef744a2d3837a7fa303d317a2002cc7629463ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:01:20 GMT
server: nginx
etag: W/"65274560-60e0"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 styles.css
winzoro.net/templates/alliline/assets/min/ 31 KB
7 KB 226ms
225ms Stylesheet
text/css 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://winzoro.net/templates/alliline/assets/min/styles.css?1697072480
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 3fed9e40fb165dcb840e9b2965ce16e1842a6e83aaddaf06214605437a414314

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:01:20 GMT
server: nginx
etag: W/"65274560-7bbd"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 logo.png
winzoro.net/templates/alliline/dleimages/ 27 KB
27 KB 289ms
289ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/templates/alliline/dleimages/logo.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 9b67e1e53d9fe07a1569190b3c25ae4ab4d57a49b2515d30c20d32a6689683bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:01:20 GMT
server: nginx
etag: W/"65274560-6b12"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 noavatar.png
winzoro.net/templates/alliline/dleimages/ 572 B
786 B 353ms
353ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/templates/alliline/dleimages/noavatar.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: f99a2c60ac365f5cebd3b520372c07dac909708e0fb5f8848a0a967c7fc0b98e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:01:20 GMT
server: nginx
etag: W/"65274560-23c"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 context.js Show response
yandex.ru/ads/system/ 324 KB
93 KB 213ms
80ms Script
text/javascript 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

c319c3284c41a16507218acb514dc14a91498790752f85279455c3224528f775

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1701009946647218-8786675117205977028-balancer-l7leveler-kubr-yp-vla-34-BAL-2876
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 26 Nov 2023 15:45:46 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 150 KB
52 KB 135ms
72ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4379353840599633

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f7a93f16adf719ae19ef85b86d769b943b3b93a13d76d20fc19d121d911179b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52665
x-xss-protection: 0
server: cafe
etag: 1518738776595134265
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:46 GMT

GET
H2 200 preview.png
winzoro.net/uploads/posts/2023-11/thumbs/ 119 KB
119 KB 412ms
407ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/preview.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: d18f91781d6892fc24796d9253c6b82869799d2995b7ebdf90b835877df718ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Tue, 21 Nov 2023 16:23:26 GMT
server: nginx
etag: W/"655cd97e-1daeb"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gray-raven-hanying_preview.png
winzoro.net/uploads/posts/2023-11/thumbs/ 156 KB
156 KB 534ms
529ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/gray-raven-hanying_preview.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 5e96accf2e0a2a0978c6e5669ff9b79f65fb177ddf743a9c1e49a4462f035bb0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Tue, 14 Nov 2023 12:42:19 GMT
server: nginx
etag: W/"65536b2b-26e39"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 snimok-jekrana-147.png
winzoro.net/uploads/posts/2023-11/thumbs/ 127 KB
127 KB 534ms
529ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/snimok-jekrana-147.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: bd30ecd5ff9d522e69153382b6304c2b571e1a205f5b2c5728cb5e0c2e4b0181

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Tue, 14 Nov 2023 11:59:51 GMT
server: nginx
etag: W/"65536137-1fb36"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 snimok-jekrana-142.png
winzoro.net/uploads/posts/2023-11/thumbs/ 131 KB
131 KB 534ms
530ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/snimok-jekrana-142.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: bc8cbd85bd12b9715d6195b68e3e2c338630a13d763321cffc0a34d040c79ac7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 09 Nov 2023 06:28:46 GMT
server: nginx
etag: W/"654c7c1e-20be0"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 snimok-jekrana-140.png
winzoro.net/uploads/posts/2023-11/thumbs/ 138 KB
138 KB 534ms
530ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/snimok-jekrana-140.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 093c1fcee545ef703fcb79c1c4c835a32e67081bf651d44253cfdc68a31bf869

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 09 Nov 2023 06:26:04 GMT
server: nginx
etag: W/"654c7b7c-226f4"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 snimok-jekrana-143.png
winzoro.net/uploads/posts/2023-11/thumbs/ 135 KB
135 KB 534ms
530ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/snimok-jekrana-143.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 13d62575f2afbe06a27270e0ad31a53dc50a0bbea757e043cf8e2eb4d1c9fc9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Wed, 01 Nov 2023 17:27:49 GMT
server: nginx
etag: W/"65428a95-21a79"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 snimok-jekrana-144.png
winzoro.net/uploads/posts/2023-11/thumbs/ 136 KB
136 KB 534ms
530ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/snimok-jekrana-144.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 92a198bd1a2c8dec4aebbef1fe41a1219a0dd5061bf57ec3ca53773bc3169c6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Wed, 01 Nov 2023 17:26:46 GMT
server: nginx
etag: W/"65428a56-21f6f"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 snimok-jekrana-146.png
winzoro.net/uploads/posts/2023-11/thumbs/ 133 KB
133 KB 534ms
531ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-11/thumbs/snimok-jekrana-146.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 574b35072c523a94f489167282a8ce8eff008f8817d84aed7a8740190f04bdf2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Wed, 01 Nov 2023 17:25:41 GMT
server: nginx
etag: W/"65428a15-212d5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cat_amp_girl_in_a_rainy_purple_sunset_preview.png
winzoro.net/uploads/posts/2023-10/thumbs/ 97 KB
97 KB 534ms
531ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-10/thumbs/cat_amp_girl_in_a_rainy_purple_sunset_preview.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 227ebeadeabf720faa659ed7547a50ca7e2a9a19648ca781a13dbba37d04f958

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 26 Oct 2023 15:40:35 GMT
server: nginx
etag: W/"653a8873-183b8"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1431446291_finance-full.jpg
winzoro.net/uploads/posts/2015-05/thumbs/ 16 KB
16 KB 534ms
531ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2015-05/thumbs/1431446291_finance-full.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 67706e53b38e25f14acc64b5eca990ed4fe7be666019862acb40603fbd79480c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:08:05 GMT
server: nginx
etag: W/"652746f5-3e12"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1331908866_1282372022_001.jpg
winzoro.net/uploads/posts/2012-07/thumbs/ 3 KB
3 KB 534ms
531ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2012-07/thumbs/1331908866_1282372022_001.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 1d5d9b1390a089fb79129a1c6b7778945bdd2dd34eef49fd2acdc8a05162d1eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:09:08 GMT
server: nginx
etag: W/"65274734-b42"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1327061893_3507.jpg
winzoro.net/uploads/posts/2012-04/ 6 KB
6 KB 534ms
531ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2012-04/1327061893_3507.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 2d6d9dba2794d20680a5c8d13858b6d93ee95adf68f6a391530b0ce3dd3f9595

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:07:07 GMT
server: nginx
etag: W/"652746bb-165b"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1334944872_1270284708_tc_03.jpg
winzoro.net/uploads/posts/2012-04/thumbs/ 10 KB
10 KB 534ms
531ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2012-04/thumbs/1334944872_1270284708_tc_03.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: babaf438b676e127e1b3d842c9ea1cc8e5bf4fa6a1761a038f7d0e5bfaf3f230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:10:19 GMT
server: nginx
etag: W/"6527477b-29e6"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1656658249_spectre_cursor_animated_version_not_smooth_orange.jpg
winzoro.net/uploads/posts/2022-07/thumbs/ 22 KB
21 KB 535ms
532ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2022-07/thumbs/1656658249_spectre_cursor_animated_version_not_smooth_orange.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 36ea1c138e12c2a5f2f79d82855b047e6dc28453987430afc7bde42ba46e1de0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:09:35 GMT
server: nginx
etag: W/"6527474f-56a8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1334081377_224709.jpg
winzoro.net/uploads/posts/2012-04/thumbs/ 6 KB
6 KB 535ms
532ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2012-04/thumbs/1334081377_224709.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 1ba030b54b94fdc6a701f8cf7d8152a598f0dc0eca410a88cd124120c65191ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:10:20 GMT
server: nginx
etag: W/"6527477c-18ea"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 snimok-jekrana-135.webp
winzoro.net/uploads/posts/2023-09/thumbs/ 11 KB
12 KB 535ms
532ms Image
image/webp 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-09/thumbs/snimok-jekrana-135.webp
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 138313ba91a77c618c029500c84ae2867deb4eb88560b177941c913fa5e9917b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
last-modified: Thu, 12 Oct 2023 01:08:19 GMT
server: nginx
etag: "65274703-2d2c"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 11564
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1686656890_yae-miko-lying-down-relaxing-genshin-impact_previe.jpg
winzoro.net/uploads/posts/2023-06/thumbs/ 23 KB
23 KB 535ms
532ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-06/thumbs/1686656890_yae-miko-lying-down-relaxing-genshin-impact_previe.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: db191b86ceb259d81e84aea4841313360880f32a21236bdfd20a9ced1bc0e8ed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:08:43 GMT
server: nginx
etag: W/"6527471b-5d09"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1689924976_snimok-jekrana-134.png
winzoro.net/uploads/posts/2023-07/thumbs/ 62 KB
62 KB 535ms
532ms Image
image/png 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-07/thumbs/1689924976_snimok-jekrana-134.png
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: f3901fe1a0442e50f28c14d6eae3dec8c35e6271d6b8bff15df81b6d5f7495f1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:07:57 GMT
server: nginx
etag: W/"652746ed-f710"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1691583879_texas-cyberpunk-city-street-arknights_preview.jpg
winzoro.net/uploads/posts/2023-08/thumbs/ 13 KB
13 KB 535ms
532ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-08/thumbs/1691583879_texas-cyberpunk-city-street-arknights_preview.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: b306ba1af362db6ca00b654c6ddf9c3c84a448bacaf741277e525c782db9f336

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:08:45 GMT
server: nginx
etag: W/"6527471d-3563"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1693025324_preview.jpg
winzoro.net/uploads/posts/2023-08/thumbs/ 10 KB
10 KB 535ms
532ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-08/thumbs/1693025324_preview.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 39fe29cf7b41b3c265736d9c0a69cc6986ca78ccc31fdec26b8e25fba2cf2d99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:08:45 GMT
server: nginx
etag: W/"6527471d-2613"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1690385572_racing-in-the-rain-initial-d_preview.jpg
winzoro.net/uploads/posts/2023-07/thumbs/ 12 KB
12 KB 535ms
533ms Image
image/jpeg 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://winzoro.net/uploads/posts/2023-07/thumbs/1690385572_racing-in-the-rain-initial-d_preview.jpg
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 2236f8f79b3e2936da97c0a0f8da93b3e821e353f9ab1036ebb505c8c8714aff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:07:57 GMT
server: nginx
etag: W/"652746ed-31c6"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 index.php
winzoro.net/engine/classes/min/ 2 KB
1 KB 534ms
529ms Stylesheet
text/css 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://winzoro.net/engine/classes/min/index.php?f=engine/editor/css/default.css&v=yqxkp

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

194-67-68-223.cloudvps.regruhosting.ru

Software

nginx /

Resource Hash

f55a11baf33fb17425e40acd9266d2277424db4e0ae3bf3c703418de8b13101d

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
referrer-policy: same-origin, same-origin
last-modified: Thu, 12 Oct 2023 01:00:39 GMT
server: nginx
x-permitted-cross-domain-policies: master-only, master-only
etag: "pub1697072439;gz"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: max-age=31536000
content-length: 721
x-xss-protection: 1; mode=block, 1; mode=block
expires: Mon, 25 Nov 2024 14:45:46 GMT

GET
H2 200 index.php Show response
winzoro.net/engine/classes/min/ 84 KB
30 KB 534ms
530ms Script
application/x-javascript 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://winzoro.net/engine/classes/min/index.php?g=general&v=yqxkp

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

194-67-68-223.cloudvps.regruhosting.ru

Software

nginx /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
referrer-policy: same-origin, same-origin
last-modified: Thu, 12 Oct 2023 01:00:39 GMT
server: nginx
x-permitted-cross-domain-policies: master-only, master-only
etag: "pub1697072439;gz"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN
content-type: application/x-javascript; charset=utf-8
cache-control: max-age=31536000
content-length: 29771
x-xss-protection: 1; mode=block, 1; mode=block
expires: Mon, 25 Nov 2024 14:45:46 GMT

GET
H2 200 index.php Show response
winzoro.net/engine/classes/min/ 155 KB
39 KB 535ms
533ms Script
application/x-javascript 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://winzoro.net/engine/classes/min/index.php?f=engine/classes/js/jqueryui.js,engine/classes/js/dle_js.js&v=yqxkp

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

194-67-68-223.cloudvps.regruhosting.ru

Software

nginx /

Resource Hash

df301479921863d00f49551cae9e1cf786a17544c23839747864617049f9b51f

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
referrer-policy: same-origin, same-origin
last-modified: Thu, 12 Oct 2023 01:00:39 GMT
server: nginx
x-permitted-cross-domain-policies: master-only, master-only
etag: "pub1697072439;gz"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN
content-type: application/x-javascript; charset=utf-8
cache-control: max-age=31536000
content-length: 39723
x-xss-protection: 1; mode=block, 1; mode=block
expires: Mon, 25 Nov 2024 14:45:46 GMT

GET
H2 200 readmore.js Show response
winzoro.net/templates/alliline/scripts/min/ 4 KB
2 KB 535ms
533ms Script
application/javascript 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://winzoro.net/templates/alliline/scripts/min/readmore.js?1697072480
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 300f5b02f9f5a3977cefc61c55e73223b22aac671597c11012f4c8112a2af5f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Thu, 12 Oct 2023 01:01:20 GMT
server: nginx
etag: W/"65274560-101d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 scripts.js Show response
winzoro.net/templates/alliline/scripts/min/ 60 KB
16 KB 535ms
533ms Script
application/javascript 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://winzoro.net/templates/alliline/scripts/min/scripts.js?1699970664
Requested by: Host: winzoro.net
URL: https://winzoro.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: 194-67-68-223.cloudvps.regruhosting.ru
Software: nginx /
Resource Hash: 6b9d2722f54eab704e54d8f412c8958a14729d81c74422a483e2d5daea80deca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
last-modified: Tue, 14 Nov 2023 14:04:24 GMT
server: nginx
etag: W/"65537e68-f172"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 me4winzyha5ha3ddf4ztmobt Show response
broluckycode.site/code/ 10 B
321 B 148ms
43ms Script
application/javascript 185.177.94.152
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://broluckycode.site/code/me4winzyha5ha3ddf4ztmobt

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.177.94.152 Amsterdam, Netherlands, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

ip-185-177-94-152.ah-server.com

Software

nginx /

Resource Hash

3df65d7d6add27dd11c6f6a174f7940f193a6283948ad989f1462923cde8f229

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 26 Nov 2023 14:45:46 GMT
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
server: nginx
content-type: application/javascript; charset=UTF-8

GET
H2 200 joinchat Show response
winzoro.net/ 11 KB
8 KB 535ms
533ms Script
application/javascript 194.67.68.223
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL

https://winzoro.net/joinchat

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

194.67.68.223 , Russian Federation, ASN197695 (AS-REG, RU),

Reverse DNS

194-67-68-223.cloudvps.regruhosting.ru

Software

nginx /

Resource Hash

749a7c498aaf5b833bade4cdaa38bf40057a38c5f69a43e128c97c794d88398a

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://winzoro.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
x-content-type-options: nosniff, nosniff
referrer-policy: same-origin, same-origin
server: nginx
x-permitted-cross-domain-policies: master-only, master-only
vary: Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block, 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 7cHmv4okm5zmbtYoK-4.woff2
fonts.gstatic.com/s/exo2/v21/ 39 KB
40 KB 80ms
24ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/exo2/v21/7cHmv4okm5zmbtYoK-4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Exo+2:300,400,500,700&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9c1caceee24c82513919d61734ad3ccb66800fa0a92f71da617c49b8a872fb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 18:19:06 GMT
x-content-type-options: nosniff
age: 160000
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40316
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:31:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 18:19:06 GMT

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.2.0/webfonts/ 61 KB
61 KB 45ms
44ms Font
font/woff2 2606:4700:e2::ac40:8d0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.2.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.2.0/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8d0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c7df99df232586111917083a85aa31b82ee29e48ca2990e13fae0c0663a923f

Request headers

Referer: https://use.fontawesome.com/releases/v5.2.0/css/all.css
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1409425
alt-svc: h3=":443"; ma=86400
content-length: 62472
last-modified: Fri, 22 Sep 2023 01:45:27 GMT
server: cloudflare
etag: "b75b4bfe0d58faeced5006c785eaae23"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pK6aQNa%2FWgRpoJwsu0SL9LtYd%2BMFz6YsrflMR9%2FmDGDV3slkgdd%2Fy5Ap53IB33vJ1%2BcPut%2Fz7iAGLerVsbM1mnrjYCsnvEXJCOVDuDicnZKtewj%2BWhzFHYtwko8JCiUvA02srTqkcLAPG97xZfQ6IJjQ"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 82c2eac71c383c83-CDG

GET
H2 200 7cHmv4okm5zmbtYsK-4E4Q.woff2
fonts.gstatic.com/s/exo2/v21/ 20 KB
20 KB 104ms
49ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/exo2/v21/7cHmv4okm5zmbtYsK-4E4Q.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Exo+2:300,400,500,700&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20ac558ae4e736f5a22d58c1bcdab41693e106fb485d0c582be711621ef6456d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 03:53:53 GMT
x-content-type-options: nosniff
age: 211913
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20400
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:26:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 03:53:53 GMT

GET
H2 200 fa-regular-400.woff2
use.fontawesome.com/releases/v5.2.0/webfonts/ 15 KB
15 KB 85ms
85ms Font
font/woff2 2606:4700:e2::ac40:8d0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.2.0/webfonts/fa-regular-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.2.0/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8d0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ecd9f5bb492be71e3aacc8ca4f170c8f9890242a25e2c6ec9a42f13561b028f

Request headers

Referer: https://use.fontawesome.com/releases/v5.2.0/css/all.css
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1499439
alt-svc: h3=":443"; ma=86400
content-length: 14888
last-modified: Fri, 22 Sep 2023 01:45:27 GMT
server: cloudflare
etag: "8d9ab84bfe87a3f77112a6698cf639fb"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bjeca4LAiXmWFVdgF5Nu7lltve8FvktVuCtFlqMeJXNz%2BMh9EI6MrjH8rc9%2FSQftJtIKvKqmrfPDtPjkIYa0udPd%2Byr9om%2FdpGJwkZ5WrOpUP%2Bd3IMbcoTJi2CAnVRy4iwnJy0Nf0uJyG6IT0ByG9rmS"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 82c2eac71c3d3c83-CDG

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.2.0/webfonts/ 63 KB
63 KB 59ms
59ms Font
font/woff2 2606:4700:e2::ac40:8d0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.2.0/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.2.0/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8d0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d0130d314f1669c9ea5a911d401d6250f96386a52b0c38f7b3fb43cdcd10589

Request headers

Referer: https://use.fontawesome.com/releases/v5.2.0/css/all.css
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2104184
alt-svc: h3=":443"; ma=86400
content-length: 64144
last-modified: Fri, 22 Sep 2023 01:45:27 GMT
server: cloudflare
etag: "6814d0e8136d34e313623eb7129d538e"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0DPsoU7vO66RGNR6T60xf23%2BM4pCTV%2FAWnZ2lO7%2FhWsvYnK2le%2FXlvzNd4RR0mSVnO0C5xGVQXFQNvGAVkfP9zlve%2BueOoNNRRoIkh10l0xPSA6X2uuK%2Fc2Sh6DwRGkpgm7FaueJ39ABKukoDLCmOJ0h"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 82c2eac71c423c83-CDG

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 200 KB
70 KB 222ms
98ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

c3d606568f389989dd02561ca2b0d20d29eeb477ed633a690a518879748f487a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 24 Nov 2023 08:37:03 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "656060af-113c3"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 70595
expires: Sun, 26 Nov 2023 15:45:46 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t45.1;r;s1600*1200*24;uhttps%3A//winzoro.net/;0.8828468652926302
https://counter.yadro.ru/hit?q;t45.1;r;s1600*1200*24;uhttps%3A//winzoro.net/;0.8828468652926302

112 B
598 B

59ms
59ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t45.1;r;s1600*1200*24;uhttps%3A//winzoro.net/;0.8828468652926302

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

HTTP/1.1

Server

88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host204.rax.ru

Software

nginx/1.17.9 /

Resource Hash

bb51b9caddb8a0e55d70c819b8a8903fbf2f94b7ad453653ec6aa0e823524276

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 26 Nov 2023 14:45:46 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 112
Expires: Fri, 25 Nov 2022 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 26 Nov 2023 14:45:46 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit?q;t45.1;r;s1600*1200*24;uhttps%3A//winzoro.net/;0.8828468652926302
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Fri, 25 Nov 2022 21:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311130101/ 397 KB
134 KB 132ms
85ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311130101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4379353840599633&plah=winzoro.net&bust=31079654

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4379353840599633

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9756fa74b82514cbe0c183bf8f4f0b0fbee33d987b779afcf89a6851298e2b15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137193
x-xss-protection: 0
server: cafe
etag: 17368082980048212175
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:46 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/ Frame B131 9 KB
4 KB 80ms
22ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4379353840599633

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 80862
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:04 GMT
etag: 16674218716276178799
expires: Sat, 09 Dec 2023 16:18:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ed98de085e4a5e38713e.js Show response
yastatic.net/partner-code-bundles/916425/ 14 KB
5 KB 235ms
140ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/916425/ed98de085e4a5e38713e.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

11e783f59620c61937ff22d35ba27ce4a3fab3dd1b269898e930bbea01ff98de

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 4772
last-modified: Sat, 25 Nov 2023 11:30:19 GMT
server: nginx/1.17.9
etag: "8288b303847eb4a2e03c4a98519e1c5b"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 25 Nov 2053 21:21:38 GMT

GET
H2 200 20d7f4beb302b86f3532.js Show response
yastatic.net/partner-code-bundles/916425/ 24 KB
8 KB 250ms
155ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/916425/20d7f4beb302b86f3532.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

87c55f46a7dcc6c7c2b794142a65a1b7871bc50aa39770bb54887f93620543df

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 7949
last-modified: Sat, 25 Nov 2023 11:30:18 GMT
server: nginx/1.17.9
etag: "b7d777bf9da13413ddae1a164a651a2d"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 25 Nov 2053 21:21:38 GMT

GET
H2 200 90c7bb268594abd0bd74.js Show response
yastatic.net/partner-code-bundles/916425/ 117 KB
25 KB 218ms
123ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/916425/90c7bb268594abd0bd74.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

fa8b240fe98efa97446504fd81ecfce85030306c6c7af652ef96cc3b3b6ddd2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 24524
last-modified: Sat, 25 Nov 2023 11:30:18 GMT
server: nginx/1.17.9
etag: "9f194165c01f48537600e0b33a379b43"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 25 Nov 2053 21:21:38 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 243ms
148ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8878
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
server: nginx/1.17.9
etag: "f80882bf67cf261aa08d636da095149a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 25 Nov 2053 21:16:50 GMT

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 181ms
87ms Font
font/woff2 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 26004
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
server: nginx/1.17.9
etag: "7f0cdaf91230f9789ca4162aedff612e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31556952
x-nginx-request-id: 2d02e9639027a851
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Nov 2024 20:30:02 GMT

GET
H2 200 85c4d2b67149401d7068.js Show response
yastatic.net/partner-code-bundles/916425/ 34 KB
11 KB 234ms
154ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/916425/85c4d2b67149401d7068.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

bd7349560ec3799de7ee0053f3b861f068a6b67a0088f3f9ff994c9c5014871f

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:46 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 10656
last-modified: Sat, 25 Nov 2023 11:30:18 GMT
server: nginx/1.17.9
etag: "dfbc9327fa85a62742e5564963b10624"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 25 Nov 2053 21:17:13 GMT

GET
H2 200 294956 Show response
yandex.ru/ads/meta/ 437 B
684 B 179ms
178ms XHR
application/json 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/294956?target-ref=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&pcode-test-ids=909920%2C0%2C95%3B897721%2C0%2C1%3B911254%2C0%2C84%3B907877%2C0%2C42%3B912655%2C0%2C48%3B901185%2C0%2C64%3B908762%2C0%2C25%3B914672%2C0%2C49%3B786896%2C0%2C36%3B910731%2C0%2C47%3B908467%2C0%2C84%3B882595%2C0%2C64%3B907884%2C0%2C24%3B892904%2C0%2C20%3B906702%2C0%2C25%3B910443%2C0%2C55%3B909999%2C0%2C76%3B910216%2C0%2C35%3B910507%2C0%2C18%3B914206%2C0%2C8%3B913382%2C0%2C71%3B905414%2C0%2C37%3B916268%2C0%2C17%3B914861%2C0%2C75%3B912287%2C0%2C91&pcode-flags-map=eJy1Wdty2zgS%2FRc921neL3kDSVDCmrcFQdtKKoXSJtqMt2xnK3FmZpPKv083AEqkpEDjZMYPtkSrD4BG9%2BnTra%2BLa9LLftXeSFLIimS0kmXLJWtkRpqG8sXL118Xv27uP28XLxeCD3RxsXjafnpi7%2BB9FPl%2BEC%2B%2BvbnYw3S8LYZc9LJtZEeGnloRYjcNfI1QsJ5kFZV5OzRCclowTnMBOyFdZ8fwnCDwdruAJWU9VILxtqoArRH4gnJ5Q0S%2BooUUrKayLcueCjuu7znx%2FnScCr7GUzVU3LT8SlLOW7t%2F4jAK4nSHAKvnV%2BDkdTsI2Vct%2FGKvqMzgwAXhjPZ2sDhxA1eB4QkQo%2BNUHXJ%2F3GtW0Faa%2F8%2FgXAd%2BZnipn8bOGbxsKEtwHa07sZYVq9kh6LMRrzvCir9%2Bh%2BUAr38UtcFY%2FYt3%2Bh3Mn7qf05h%2Fnwd%2B9PYx2JecZLKizVKsZkaQrMnULHESJw52ZrRRJCA4gVS5Zv1AKs0ryEr0VlDewJOit1NC4nqR8wOg6kFPSipLTmo7dak1ND1wjjzTwyeAsGBBgWTaEYQA7F6hkqFgrcw5JYJdn0n1JHA8N9xtf7wk0QIJ9YJwgTRUMg4L5auhuZIlYdUMMZzfeBJ4sbcHJELgnfbPQfRtgHBWYN28YhSou6JL8CZrylberJhi9OaawhI6%2BNE%2FZ04fOkky4d2mgCAkGbqAFIjEengw8Ao3fUOz9pw3YyfYs%2FCSwhmHXrS1vK5Jt%2FPuNamG%2BY1HB3mTRKEf7QsNzQEiF0QHTU2qyr6NOAmC4NhaWcobJlZSQCw%2BB2O8u3oQUNfAGcclKZyZp57rRMq8B69KU3ILDFex7iiW%2Fa69oZyWJcvhMvP1DGz7%2B%2F%2FmcLPUJUUxZlpHllBiO8EgK3QiYKgpd1esubKfMU1TU%2BfGct5QJU%2FG5MGrt%2B0rdR3QBAqhy9uC%2FiSGkjZCnQuCr4czzQzhk34azm29wLhZr4%2FkAJlhWy8MQs9xZkLICKC851bD1IWgUIaKuLVsk0PDSgY3yxpgoJLk1I6ReEbpoJvg%2BiGyVrJqlyy32UVu4kd6bTgi0Ects%2FWYsJgVUFIyVlghICI9d3ZuuC0O8dMII5iwsPVwb7SR%2FQHvH%2B0ndU165JhUbTOSRwlekEyROhyLFNS%2BqThJI80YGDolaLOmqNa6KGCSHEpSu312pYSergOaBAED8j9r7ShpYAoMolQUwhcQaqtNlASRdufEbUsOQqag%2FZVo7ftOosD1p%2F5ThAI0DiATvAakq7rw5QA6HWQC6vWcQlpZ3Rq7ThCHY8XUkSYG3pjrgfIBty1WvB2WKytFxK47MnpFXq3VjUqValOzr4v%2FbJ%2Fe%2FlJvPr6%2Fe1y8dEPnYvHw4d9399v%2B7eb%2B7vH94qX3bYYaQhpodqyRVv810IGCPuhkVqFyqNi8cr1ePGzu7l98%2FAx7%2B%2F%2Fm8d32d3j9j7uHzfvtp9mj95sH9eTdl%2B2j%2Fvjm17unD%2Frlw4vJm3ePd%2BYpIu8Q4MHHzZf7D19%2BMf%2F%2B8lH%2F%2Ffxx8%2BJx%2B9unow%2F8d%2FPh4U6Zvjl9xEbTYE35En8XjEhBlr31%2FnzPM8Gl0oLC3QOd5orm7Yah73im7giIxJIAVekq0Qx1Rq0MF4eub4SlaihVS4j1BXpUmuuMBFHHgDvOwMSOjj6gEagFNRLcUlEOK0py4nrdpKBx4uSXZUryy6Ag3mUWkPDSh0IaeJ6TkDCa%2BzcJw9RUjVmeT7NHtEO%2B0jlUtb06hy7jnP4TCP9MDkGKBsmpFbSghbTNMFY7%2BAVPlK5jDRMnpMERchCE7hx5smtFZGwpSQ9X2CtCs6KlLlz6GU8gJkog0hT78YPp2O0BdQJ9glux5Qrk8orWf3aPwEdGumBsKAlvVKsdAPhWx%2FUaTCCjcp0VWdXCHQDpggAW9ERk8Ut26QUgFJzg0gXI6Xvv4L1%2F8D5Q78mlF0JnF3tgPw3BxEkjV4uPkt2CW0mnEl2PGoalVdC5IEOCCQOiVmY1pim6RVOGFSB0g1QDlD2kVwsdFbu1W%2Fi%2BKTmGkYBPsD%2FDSkdU%2BGJAgDAGkmoGO1SQGslm7kJVejXMOiMcksgLE72LFeGFEm16Az2wlSD5ymoNxBhFO%2Fm07ISEQGSdNXbQyLhKaTQ8fYtt6LP3DiI88k8AdUMGFRWYQNh3v7ffj%2BBqJEjd2MxXf52mWERi7yKFmwscP7qI%2FBTquh%2FOojABwk9noKYtzLHR%2FClcX3ttkq%2FYy%2BRwb%2Fa%2BIgljkxic1i1GGpSAzMozCQSGkWBlPyqosW2SkNuyJtgzQYbYGyXXSdIzZKga2xznEK0qDthOcUVkSI8VLYWeTBAouWcWi4yibujA0eeYwfZzgo2Jf8K4llKTnmfe7zjAecHc2g%2FiZGcNtQx5Ay%2BGFbNlX7tO6Dhvvm%2F67Ng%2FubKaIB%2FOU2FtJ40v0jS8cB24jgt878P7QL0Kv7OrPe%2BBilbVG6lIFUFr%2B%2Bg4YXhSCMAN5yPHrag657lamjpwO%2B406MeJStvBjrjIoKsgEmvY7ZmkejOD9aJUwyKE8hp2jr0igFoxr3o029vm%2Fn6%2BNx86Dt0yqG4NHcYpSGcoodAM6iiwny52jZhXH1blBttI5DHzNcKSHoWSH4Gdk84PBH2ss0NSVVy1%2FsjkOBsV4DpMJkhkxc%2BHrfzRztJ0MgPgQIo7WaUvYn4wEF%2F9wSgjjr39KGM%2F8rli0FNAHl91LWvsI5%2FUdb3wYGzUdqYs9whnN3fiZPIlxpE5gW6rp5X9HBMQUvTF1REluF4UHo5A8Ml5%2BbcbPioFzyom1rLNesrtQgNSwk2m%2BO0gegEerRWqmWDY%2B4rUSeJxnHeAsbPfTQd1i6o%2Fh%2BWxomK2QeguHee54DW5HXOl18k2gzwNh%2BfryLrGAYmqPRzluJJrgh20QG%2Bf5snqBlHszaqy4Ta9Rz0APh59H%2FcgSRqdulxDT2Og2%2FfixL7OjRUUY5wjmNZiBUVPKfiZ%2Baft%2Ffbt0%2FbdwQ3CgabEWLzC8cTsTKA1Vi1nr0BFEvMFzJma74VpeB50V6%2BfBXnosHk%2BWh0GSWgGfePl3bBCrCQ4TbBmaTWGhjU1X4h8ZyJVglrnIDrsW4hi08ebMSNrFDkjJqmM%2BAQvmQzGgg40TpfWMTJEQhD4U4dPOAKomi2b%2BeRMLIki47FI2Lecws%2Fu4KPnxrRG3KLNB5VN42Z32z8Tv56Rk8YXen8%2F64rQ6M0TtdBuGXhm5pxTLNoQEXr420PdY9hXHEipo%2FP4vulljTzG9hF3YSJlaKyz4Im9%2BiZSTfNGhf4nF6aNEp6oy9X3IWdG36kTBm6wn7Mfl6UQW6zZWpEXobD79geOl5dB&pcode-icookie=5NoJncC2hPv8vbDAhYlh6qgTSRFbNIFnmTX2r2Q76sP9b%2Fxm6LMvsqU29xiuR6ly8WJ%2Fi%2BbHyP5OeyJTeHFDM%2BJJnm0%3D&imp-id=12&enable-flat-highlight=1&comboblock-unencoded-vast=1&test-tag=532713383657474&ad-session-id=3774121701009946890&target-id=55024784&tga-with-creatives=1&top-ancestor=https%3A%2F%2Fwinzoro.net&top-ancestor-undetermined=0&pcode-version=916425&pcodever=916425&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A220%2C%22h%22%3A0%2C%22width%22%3A220%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A200%2C%22top%22%3A769%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=3964&grab=eyJncmFiX3ZlcnNpb24iOjJ9ChqkppDkNu4B1PrCjLLy1nat3_RPGqeJg1PexRSyIaUbt-N0Y56ZeSnNsMUpOL2hlJz8ZHpuh5zYv6FN_9J06bIOB_TMANeqKsybDG02PytlNXzXjVlFREVxUFREVOnMkdFES2cuuoWWLsojU0EbQg1ACuUBSagMsUNNqAjVoeYPXBEQhZqA5KBpQvABcaj9W9aGkG4JzsGFGMo_IL5l-cnUPmmeWVLS-MvSVbK4GFx2FyiI6VyNezpjEfXPurFAx2opYmuSG6I8zVjfmmZRkUXoWHkYXphj99-sK18Zqk98eYg3QBQBQQi-Gke9wPyB_nZPjBB3NwJi9y_PoTIgcLdt9Y2udu_8qltXHJj6bwc7wP9QdsLJDpbqIEC4dbzj94aSL8-7qbjZbn-hqALCG4J42bmiXDe1JzSEYy5RQPC7o7wN-XZtRce9TUIf-ElVhdqbRHtLsP7E0Bxc2XblBjy5rC7xTpEVOtI0scR1szzGemP4bXRfFw-Qxf0M7re7BbfG7Q0gF6q1m2-3vOYtE0R7VHVOqNXDrB2eoOqX2-vLSAZXy7HOfY1IH9xtPtwbSS4tpKQOAaztkquFN2Vq0bWQLpK3mnoco2P1gVKaUivZwSx6wkpLZ8nhexBIk24wFKLwmlxkBUX0eWbKs-JNB0J0GVlKnlZQ3pxbLEV2q52WLjb0jBZhngEuTVI61wClcx0M1wnvgQnzR5WTm7HkznYjWM2NT3-VMnFKOKJIE-OJ4QMU5hwI8fU9qTnfqSoW55kE-kwTwriWgN-28GW8D9YGENinNyS5sSe6xmrx9TjKrWQ6BIDVFwMl6wdFb_IgTTkPjimX9CuEvrl7-X6RFOCLD7ub4lsAnWwiDJWCN6Xj6ymRFpn-62KGkMUCD2ELPO7EBk74lbkTH1DHvs2OZZOKGynASqKHO2nQqojgThL0KpC4kwT0_fK-qoIbaVC8v-WKWfMZ86beJ3EnPDBzohBnEOUmMxb5Bu02VX8NaoVSzBGq993AKXEpkz0LVQD3WMVVtYC_qsHbhBOW6NKfj-6aQKwiLbcUlD1Bi9r2XvAJhUO9sLRnvy9P-Nxo7bmL3o65lC4jWhdcDArHfGJzKZDRPeqmlFzKjuowHY7qhsSgxeY0ifwh2uPszYguo5xva1WuYFTsIC1ZWKR_sed5tSC-9BoKRFaD9kreBTM9RpWmkZQulNLw1TpNj2ruZljBX_p32xDb7Us5ltxLbIt6FIuJXKVRDebJTnqUZ-SRzlAYTPqYlZaZQZprYgCrsB-4zneWkh1xqCzicFquYJlPQH3ZqJOue6oO_4RE2TPdNR9zCwi875hqOFo-Z8lT-cqnZ2Bmp_Ih7Fduim4yYW4dl45uPg5uqOVkDRl5qCEzAz071ZCqiJKU9CLwbfosLqJHU_TzW1ChRI25JQP4UbE4QxtwMu6YWXh4LRYmFnYqGmJTz658KcUf6P7G9YhN-VWJ9GLM0I80jmHDq6TnqVQMDjYqFvIii9JHcgUz5g9EPQJ9FOsfec_jEwETY4sTlJq95CG6GJ3sU7GUssjyR5mT99ic67qxY9jS0fNSOsczlmzkDosGHnXPyJ8ZOYYuHQO3Qedgp9JtP8jzxHS8ff_kyBW6N-gTw63E4_Ribr2gD8GBU5Sag5dqMT8TPf-HcnJXrQOLkBSksShGecN8kmJRmTI0Udbq3BYrjKQQmCUZjHvnY2doAhC9NOCPZxTrKQViaEMJsQPCxYYIwTccCzA9-VDlWc-sxVPoOU2CrbHEHgUNaA_6I0ZCzUl_08FTbtJ_WdPqYkRWMODIUeaURZIdWYjz9YQuhky5-GPKUBbACmA2jMIr36WNenAPB22Vk3fOA-VfspTsRPmjtUY5_Kuah2Z-ACLz2zqZPukP34neyfniQBn8gkWmUw7eEhEH8e54INwyPX1pB8tHANRXDpFZn510mm0ozULhQJQBZFBeOVlGRh4CkJnZzk4BaDMU1igpnkafxGnyaLPceCFneVCLJF7U7iyNPjZeQc2cL5c4cqEwUhlnMep4wXQtHV8ysRFGQQi0j85IND7SWsKTXHfUHkJfANLRnPiY650A8kIJnm-mjtMQ3DhbIR4cE4cd7OKc83dMwL57wpuXsqLLAsKN4CsTGOyj2HqUJvqnThGkTzoUhT4jX7lFjHFJFCW9nadctL-TLyYm-zsigO_FI83J0ke2SHuPOiXNnqowdZAXKHWRxeYjN6AwGro1wshFYuIF6cfB9E4GNsLnQl0Yj0awmbruqkyd6_QYuXrMvDgfZfkMjPRs5HsUIPfzQHRHxDHoM7KnySPd285FLKJHm5Bla6EYA8BViukZ-VaK_Z8IdRp157kZ0XkZ5EeuARKKj_VGI2ai2WF-1ezcV81Oz0bfRNWtS6mhyB6RuXiqvhRalkd5Nz1GRnwtWZh4IcWwvMNZcgpPBKz6HsIcYm3I58TKkA_K2HOsUc-a0Ix9Ad5azfDTzveM-84_UIz5g3aNNMYzUNK5zE6xSY_ujyruJIwD2_Z0Hs7iTQ8zhBQQBPDW9kEzJIcdBTSbe9Toh-1j9bImAEQ_avHYnm79N5LfTD5T7-ZasWgC2AN3lpuNgvbH6EkzhCm4Q4BSjMDbXQm2k6_4jrNmU2NTtPPjzfzL1t1fY4GdUfNjDz3DjRxpx0ZTXzEmAzdMAMKwZIYeqd48mh9Nfwie3MVF14wZ0xE_faEbnrmY6KswvmSO1rBhL7y6-sMAol1dJi9G97Vni96Ut2W-wr1m8NCwlyf1zOVjXxPV6vQDqZEL5L6S982imuKrt1AzPd5OOkjN1wn1Dq0cxffG_Qp9Qi6rtZJu-Dghox3fNM_xjoO5Z8XyBekg4PwW-qBcbk_u-uVpbIDdRqxYrAoI6wZrjjvldt0XcgqgPfEUfheXGSO2b1ADqWmke9N5GUQUEKD_EBAtlQCTJin6NTE-UeRbxWWEsAa4sH73WL1ce2F6asKEwqrPwirGXo4CcDrBOGIGCrWGMISqkJ5u8BRSNvbA-Mv2FmzKOecWPRPXsm3icNjWJwWJpxAkzSpkVaTlU4Zth6JhTbWCq9qKJIIUIs-ulHy7n5fiKNmhVvjpA-LqxqV2EQ8KYrfdzeBeRd3lm2isLJYVtU3L6A1v6l0q7FW2DvqxPhW7AWB7IbuNwN0Hk800eJIDvEnQZpYkzS3oQxhHywF3KQ21yVdOLl2nj1M4y8w5_-Fp05Rka6Vo88n9dWlw1YYIWCrs1sq8_ilW6qItpuHMswQgzDBzwG1fWF1VJEBvE8QWM_5DbvLwj8U9e7gjMo53UC11Bf9Qy2HiCvVz1i6kkObWJI3Tc1cRSoO8JTCE_bf383o6JGu50aJT25IcdruVo-mm39rNsW_jTxYpampQ02QT-1hk4FtYK6cHhHvjN69_ihM2t4ZfX0U7SZ_Fy-XQPPchOHPVbVe9M80P3DsGgK5P3n88jffZc6qq-f8W0e2zh8qVrab6yJNOrq7P1ftltU9Fj0Q8jwEbQw31ZnGUhpFeydU8UXSj_ij3qd35zyb1nsmji4jreK-oCVGqZWfGE-zMf2PKhPLu4V5Qtrc_uDhLgTfGQZ58mUTEm9eoNLKliSOJxxZ40v5MbT3b_Q3hze9r3VShJctmxvDayjkjHUh4YyKu8PTdPPoH39O62_Tb1s-Bw9gAVfhKeRDH_fYVgGFtuVu2-1Ngj3qwTx0dTFjzlII14rbl4FD8dvNt26QtxPHQPdbN47SUwx6ltsY_TvPQHvQf5On7SmgfAuxcMcgH6i7yjhHYAwFgvhqNA0bRSOS-s0ZRkcH5KNYJVLOmiFatDs1IE9M-FiGGU0S21LrkXrHNYzzU5vpOsPoe44TV6th2n5Qvztso1YlzNmp6rLR_jsFQ5pMLR6cAeXsLqu3InMYiRp8m5CvcuxaWPWrwYr1QW1u_D3RTFXON1guA_g%3D%3D&uniformat=true&callback=Ya%5B2952899894928%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

8f3c6146fa69a8923af33fc5454c4ca28bad620689a6faee97f2a04a6f6c134e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 26 Nov 2023 14:45:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1701009946932529-5028170551962070561-balancer-l7leveler-kubr-yp-vla-34-BAL-4334
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
uniformat-product-type: None
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sun, 26 Nov 2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
uniformat: true
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:47 GMT

GET
H2 200 7da69d276dd1890815a9.js Show response
yastatic.net/partner-code-bundles/916425/ 59 KB
15 KB 106ms
105ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/916425/7da69d276dd1890815a9.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

a6a3b1b01642f557afc02f2c9d8ea202d26ace9170e19f9b9b46f15849d1f9c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:47 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 14838
last-modified: Sat, 25 Nov 2023 11:30:18 GMT
server: nginx/1.17.9
etag: "3668fd7c505665ff1631ba9240c2da90"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 25 Nov 2053 21:21:38 GMT

GET
H2 200 c31e0c04632804a7f1a5.js Show response
yastatic.net/partner-code-bundles/916425/ 598 KB
115 KB 114ms
114ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/916425/c31e0c04632804a7f1a5.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

7437c02e9df1ef73382fa4358c15982d77a7216fb81db693e55e40b8c8fdaf59

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer
Origin: https://winzoro.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:47 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 117302
last-modified: Sat, 25 Nov 2023 11:30:19 GMT
server: nginx/1.17.9
etag: "1354166639660b8519a502598ceffb4f"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 25 Nov 2053 21:21:38 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 36E6 659 KB
113 KB 850ms
850ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&adk=1812271804&adf=3025194257&lmt=1701009946&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x810_l%7C188x810_r&format=0x0&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~5~6&ascmds=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009946736&bpp=6&bdt=256&idt=225&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6112926642607&frm=20&pv=2&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=247

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311130101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4379353840599633&plah=winzoro.net&bust=31079654

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00f98c29c5d375b8900f82b7d07e324748e9fee17f0592f0cc1bb0df71dd6e84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 115136
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:45:47 GMT
expires: Sun, 26 Nov 2023 14:45:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 53ms
53ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=HEADER&cls=header%20block%20clear&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10199.auMZIT22vzyt4f_g1FU5s-m-dd3g2KZZ-2Z9mHzY7dXSG3twsZ1hfgE27dJCFYZ6.6Z70It8UJSn7vRG2TgnR3r4pyLk%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10199.eLDsHoTLcFCUqje0nFem-V7aR3fqm65dgM-4NA8SFuzc61U6wNhyzEV1i6SlB3-Bu_v6q1NU9BiLzlIyxDXCAoAiEKYf8v7O3RMBEZt7x9BrsWSRpDihPEPUA99ItkDkf27Wr8PoY6...

43 B
493 B

64ms
64ms

Image
image/gif

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10199.eLDsHoTLcFCUqje0nFem-V7aR3fqm65dgM-4NA8SFuzc61U6wNhyzEV1i6SlB3-Bu_v6q1NU9BiLzlIyxDXCAoAiEKYf8v7O3RMBEZt7x9BrsWSRpDihPEPUA99ItkDkf27Wr8PoY6F9MQBtu1WraJf7HAxZMKIZUutimOmhUe4shN2NlThAYOZjrVJvpWi8JVElMRvaKQXrI37cidqoC9xearGYLFFVsVLwqdfTThg%2C.m8bh14dshTw95cxq2kndLr0_s-I%2C

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=10199.eLDsHoTLcFCUqje0nFem-V7aR3fqm65dgM-4NA8SFuzc61U6wNhyzEV1i6SlB3-Bu_v6q1NU9BiLzlIyxDXCAoAiEKYf8v7O3RMBEZt7x9BrsWSRpDihPEPUA99ItkDkf27Wr8PoY6F9MQBtu1WraJf7HAxZMKIZUutimOmhUe4shN2NlThAYOZjrVJvpWi8JVElMRvaKQXrI37cidqoC9xearGYLFFVsVLwqdfTThg%2C.m8bh14dshTw95cxq2kndLr0_s-I%2C
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

POST
H2 200 click
yandex.ru/clck/ 43 B
147 B 63ms
63ms Ping
image/gif 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/clck/click

Requested by

Host: yastatic.net
URL: https://yastatic.net/partner-code-bundles/916425/ed98de085e4a5e38713e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1701009947159707-17419179350058346444-balancer-l7leveler-kubr-yp-vla-34-BAL
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

1 Show response
mc.yandex.com/watch/294956/
Redirect Chain

https://mc.yandex.com/watch/294956?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3...
https://mc.yandex.com/watch/294956/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen...

256 B
348 B

62ms
61ms

Fetch
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/294956/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A2%3Adp%3A1%3Als%3A1360091472738%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A486988743%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=mc%28p-1%29clc%280-0-0%29aw%281%29ti%281%29

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

62caa3e1ed69014bfd8e4a608a3524de84a80dd2bb15a774c1a230a160312e00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Sun, 26-Nov-2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 256
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:47 GMT

Redirect headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/294956/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A2%3Adp%3A1%3Als%3A1360091472738%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A486988743%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=mc%28p-1%29clc%280-0-0%29aw%281%29ti%281%29
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:47 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/9377854/
Redirect Chain

https://mc.yandex.com/watch/9377854?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afp%3A1034%3Afu%3A0%3Aen%3Autf-8%...
https://mc.yandex.com/watch/9377854/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afp%3A1034%3Afu%3A0%3Aen%3Autf-...

420 B
455 B

66ms
65ms

Fetch
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9377854/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afp%3A1034%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A1%3Adp%3A0%3Als%3A1687920505372%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A992609575%3Arqn%3A1%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C142%2C255%2C2%2C138%2C0%2C%2C%2C%2C%2C%2C%2C%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=gdpr%2814%29mc%28p-1%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

80ecce8635f0960352aeb6d4360a057616bab020fe3f3dada78bfbd15451fdd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Sun, 26-Nov-2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 420
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:47 GMT

Redirect headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/9377854/1?wmode=7&page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afp%3A1034%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A1%3Adp%3A0%3Als%3A1687920505372%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A992609575%3Arqn%3A1%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C142%2C255%2C2%2C138%2C0%2C%2C%2C%2C%2C%2C%2C%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=gdpr%2814%29mc%28p-1%29clc%280-0-0%29rqnt%281%29aw%281%29ti%281%29
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:47 GMT

POST
H2 200 1
mc.yandex.com/watch/294956/ 43 B
74 B 73ms
73ms Ping
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/294956/1?page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1701009947_af4da8d68fd20ee10aa7940b27a732c0c16df59841d6dff3f6b0055e7d7c8465&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afp%3A1034%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A2%3Adp%3A1%3Als%3A1360091472738%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A744403965%3Arqn%3A1%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C142%2C255%2C2%2C138%2C0%2C%2C%2C%2C%2C%2C%2C%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947&t=mc(p-2-h-1)clc(0-0-0)rqnt(1)aw(1)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%223774121701009946890%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:47 GMT

GET
H2 200 294956
mc.yandex.com/watch/ 43 B
0 72ms
72ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/294956?page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1701009947_af4da8d68fd20ee10aa7940b27a732c0c16df59841d6dff3f6b0055e7d7c8465&browser-info=pv%3A1%3Aar%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A2%3Adp%3A1%3Als%3A1360091472738%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A930868035%3Arqn%3A2%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947%3At%3A%D0%9E%D1%84%D0%BE%D1%80%D0%BC%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B5%D0%B9%D1%81%D0%B0%20%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B5%D0%B3%D0%BE%20%D1%81%D1%82%D0%BE%D0%BB%D0%B0%20windows%2011%2F10%2F8%2F7%2FXP&t=mc(p-2-h-1)clc(0-0-0)rqnt(2)aw(1)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:47 GMT

POST
H2 200 1
mc.yandex.com/watch/9377854/ 43 B
74 B 65ms
65ms Ping
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9377854/1?page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&uah=chm%0A%3F0&hittoken=1701009947_a1fef087abd33c2766e0a5dbf01e4128dc1af419c1e52d3ecde3f32d01bd141c&browser-info=pa%3A1%3Aar%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A1%3Adp%3A1%3Als%3A1687920505372%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154547%3Aet%3A1701009947%3Ac%3A1%3Arn%3A973706373%3Arqn%3A2%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1701009945691%3Arqnl%3A1%3Ast%3A1701009947&t=gdpr(14%2C14)mc(p-2-h-1)clc(0-0-0)rqnt(2)aw(1)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%223774121701009946890%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:47 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:47 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311130101/ 160 KB
55 KB 115ms
115ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311130101/reactive_library_fy2021.js?bust=31079654

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80481e75d22187d02a61a359f770677a8e40966925473242ba9aff5d47b750c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55795
x-xss-protection: 0
server: cafe
etag: 14167550235853556430
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:47 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B848 108 KB
40 KB 358ms
358ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd6e6469b74eaf5b5db0bd9ed72c7da7284861278cfb28f8f2530ae5b2a41d77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40791
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:45:48 GMT
expires: Sun, 26 Nov 2023 14:45:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 4ED2 9 KB
4 KB 24ms
24ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 64531
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Sat, 09 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 475A 9 KB
4 KB 24ms
24ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 64531
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Sat, 09 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 5D7F 9 KB
4 KB 50ms
50ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 64531
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Sat, 09 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 208A 9 KB
4 KB 27ms
27ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 64531
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Sat, 09 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 4ED2 4 KB
769 B 39ms
39ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 26 Nov 2023 13:26:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 4ED2 205 B
297 B 171ms
110ms Image
image/png 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 23:26:56 GMT
x-content-type-options: nosniff
age: 227932
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 22 Nov 2024 23:26:56 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 4ED2 604 B
1 KB 109ms
48ms Image
image/png 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 20:49:16 GMT
x-content-type-options: nosniff
age: 323792
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 21 Nov 2024 20:49:16 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 4ED2 15 KB
7 KB 198ms
133ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2881d8eadc298102d2462e8d32e40792adce37b6cd89d99045f574eb3ecbb748

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 07:40:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25519
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6702
x-xss-protection: 0
server: cafe
etag: 11213825687312121238
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 07:40:29 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 4ED2 21 KB
9 KB 148ms
84ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8781
x-xss-protection: 0
server: cafe
etag: 9666818975682992898
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 475A 2 KB
856 B 185ms
132ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 475A 23 KB
9 KB 185ms
132ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 475A 3 KB
1 KB 183ms
131ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 475A 20 KB
8 KB 162ms
110ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 475A 202 KB
64 KB 172ms
109ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame 475A 37 KB
15 KB 158ms
111ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 457520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Feb 2024 07:40:28 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 208A 4 KB
730 B 35ms
35ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 26 Nov 2023 13:49:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 208A 2 KB
856 B 167ms
120ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 208A 23 KB
9 KB 157ms
111ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 208A 3 KB
1 KB 158ms
112ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 208A 20 KB
8 KB 131ms
85ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 208A 202 KB
64 KB 205ms
148ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame 208A 37 KB
15 KB 89ms
49ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 457520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Feb 2024 07:40:28 GMT

GET
H2 200 6592766407814317453
tpc.googlesyndication.com/simgad/3829778771229108095/ Frame 208A 35 KB
36 KB 179ms
135ms Image
image/jpeg 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3829778771229108095/6592766407814317453

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b9fcded3dc266892bfe2c8cb361496ef99fee57267f5b38a6df0eb652956e18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 23:13:01 GMT
x-content-type-options: nosniff
age: 55967
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36217
x-xss-protection: 0
last-modified: Sat, 18 Nov 2023 07:02:34 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 24 Nov 2024 23:13:01 GMT

GET
H2 200 13303234303783414542
tpc.googlesyndication.com/simgad/ Frame 208A 5 KB
6 KB 186ms
141ms Image
image/png 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13303234303783414542?w=100&h=100&tw=1&q=75

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a48682c3d7c0da087fc57642fff2362fe718e663579a4416926935dd6ee1f3b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 02:50:00 GMT
x-content-type-options: nosniff
age: 129348
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5579
x-xss-protection: 0
last-modified: Wed, 18 Oct 2023 10:31:51 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 24 Nov 2024 02:50:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5D7F 6 KB
781 B 58ms
58ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 26 Nov 2023 13:55:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 5D7F 2 KB
875 B 146ms
114ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 5D7F 23 KB
9 KB 150ms
118ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 5D7F 3 KB
1 KB 144ms
113ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 5D7F 20 KB
8 KB 123ms
92ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5D7F 202 KB
64 KB 202ms
161ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame 5D7F 37 KB
15 KB 84ms
58ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 457520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Feb 2024 07:40:28 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8A37 14 KB
1 KB 42ms
42ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 26 Nov 2023 14:13:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 8A37 2 KB
856 B 132ms
117ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 8A37 23 KB
9 KB 129ms
115ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 05D0 143 B
166 B 25ms
25ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1471
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:21:17 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 8A37 3 KB
1 KB 131ms
118ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 8A37 20 KB
8 KB 123ms
109ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8A37 202 KB
64 KB 223ms
199ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame 8A37 37 KB
15 KB 89ms
80ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 457520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Feb 2024 07:40:28 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 05D0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

32ms
31ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:45:48 GMT
expires: Sun, 26 Nov 2023 14:45:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:45:48 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 208A 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: faa84aa0046442cabef064339395109921b4ad2d31d43f3168bdc00bfa94e19e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 11049597608186591228
tpc.googlesyndication.com/simgad/ Frame B848 9 KB
9 KB 26ms
26ms Image
image/png 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11049597608186591228?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlXablu6mqrYrc6Kzm6CqN5CDqBlQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa417504e0f2de91fae19390e41a69769631e7508602d7472b72f1eb3a808755

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 23:12:04 GMT
x-content-type-options: nosniff
age: 228824
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9355
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 04:39:04 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 22 Nov 2024 23:12:04 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame B848 23 KB
9 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 69BF 143 B
166 B 78ms
76ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1471
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:21:17 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame B848 3 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8118 1 KB
643 B 27ms
27ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 80858
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:10 GMT
etag: 48472445140208031
expires: Sun, 26 Nov 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame B848 20 KB
8 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 16:17:19 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B848 0
0 85ms
32ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTRM_ibHk2rAavWXxWqiB291StfnkRMsQTFAJHVBgqztj-4_6Op2u7h08aWceKUB4OgqOOgYrW6W8BOxtjc99tFMDL36w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame B848 202 KB
64 KB 76ms
75ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:48 GMT

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame B848 36 KB
15 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e5c486ca9cab98b690f2f3fcc83c73141a667293c8a8236bb1e376313f0e36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:55:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78638
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14803
x-xss-protection: 0
server: cafe
etag: 12205605038930952422
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 16:55:10 GMT

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame B258 38 KB
15 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 162657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
DATA 200
OK truncated
/ Frame B848 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 14e77ff1225e5c2d97f7f2193257ce43e364e2f4149d3d8a4c4a07b017122514

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8118
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MW9XWmFCTFcxUjdnb2s1&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&google_cver=1&google_push=AXcoOmSuUGFJ5SdoKKCu47UJws9hzJQSh55NkDfZLHsesRy...

170 B
233 B

31ms
31ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MW9XWmFCTFcxUjdnb2s1&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&google_cver=1&google_push=AXcoOmSuUGFJ5SdoKKCu47UJws9hzJQSh55NkDfZLHsesRyNSLNdc1qHAI1ioSOzr-mgmAdvAn8pafIuCDKZgQmSyYlqmwWZqWSVKw

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 26 Nov 2023 14:45:48 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-0f7f5cc7c951f6e61@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=MW9XWmFCTFcxUjdnb2s1&google_gid=CAESEMdRQ7WV-mbljBT3fMw4pKQ&google_cver=1&google_push=AXcoOmSuUGFJ5SdoKKCu47UJws9hzJQSh55NkDfZLHsesRyNSLNdc1qHAI1ioSOzr-mgmAdvAn8pafIuCDKZgQmSyYlqmwWZqWSVKw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8118
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESELyBv8OGL3D2i402v-SINvo&google_push=AXcoOmSai_j4ICW0EGVFPBIsZjQ1yAShulcpLKlQMblKIX2WllSPViIIR5...

170 B
188 B

31ms
30ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESELyBv8OGL3D2i402v-SINvo&google_push=AXcoOmSai_j4ICW0EGVFPBIsZjQ1yAShulcpLKlQMblKIX2WllSPViIIR5497AmVKCldCCc3hzujgzyFsuLzSjj9_sngQY1jsqCzmxo

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320034-CPH
pragma: no-cache
date: Sun, 26 Nov 2023 14:45:48 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1701009949.505628,VS0,VE96
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESELyBv8OGL3D2i402v-SINvo&google_push=AXcoOmSai_j4ICW0EGVFPBIsZjQ1yAShulcpLKlQMblKIX2WllSPViIIR5497AmVKCldCCc3hzujgzyFsuLzSjj9_sngQY1jsqCzmxo
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8118
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEPdkXvC8md48oJDN8fZ9wzQ&google_cver=1&google_push=AXcoOmRV3DZ-08opPCNND3ziL78APgeYTYoGVbV4Xbe7mArELu-G3cDD1PRzT-z-sOdVoHpcP2WFIf96lIljky...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNTc4MjA5Njg0NTkyODYwOA%3D%3D&google_push=AXcoOmRV3DZ-08opPCNND3ziL78APgeYTYoGVbV4Xbe7mArELu-G3cDD1PRzT-z-sOdVoHpcP2WFIf96lIljkytnsc...

170 B
330 B

39ms
39ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNTc4MjA5Njg0NTkyODYwOA%3D%3D&google_push=AXcoOmRV3DZ-08opPCNND3ziL78APgeYTYoGVbV4Xbe7mArELu-G3cDD1PRzT-z-sOdVoHpcP2WFIf96lIljkytnsc88iY0x5BkpSlM

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNTc4MjA5Njg0NTkyODYwOA%3D%3D&google_push=AXcoOmRV3DZ-08opPCNND3ziL78APgeYTYoGVbV4Xbe7mArELu-G3cDD1PRzT-z-sOdVoHpcP2WFIf96lIljkytnsc88iY0x5BkpSlM
Date: Sun, 26 Nov 2023 14:45:48 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8118
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEHGSkVICjWhnU2W15HuusNI&google_cver=1&google_push=AXcoOmSThpxTnqRXiKSyI-qvL_oeVyzmD6yvXlvesM4pRESN4JqaOqyDlxYpryp9TAExM2xfVSQz7xMTwdcruNas...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=5xfJy0Z8Q0Ao2Eusn5USyA&google_push=AXcoOmSThpxTnqRXiKSyI-qvL_oeVyzmD6yvXlvesM4pRESN4JqaOqyDlxYpryp9TAExM2xfVSQz7xMTwdcruNas24TdFlvNUlAWz8Y

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=5xfJy0Z8Q0Ao2Eusn5USyA&google_push=AXcoOmSThpxTnqRXiKSyI-qvL_oeVyzmD6yvXlvesM4pRESN4JqaOqyDlxYpryp9TAExM2xfVSQz7xMTwdcruNas24TdFlvNUlAWz8Y

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 26 Nov 2023 14:45:48 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=5xfJy0Z8Q0Ao2Eusn5USyA&google_push=AXcoOmSThpxTnqRXiKSyI-qvL_oeVyzmD6yvXlvesM4pRESN4JqaOqyDlxYpryp9TAExM2xfVSQz7xMTwdcruNas24TdFlvNUlAWz8Y
x-host: tde-deliveryengine-production-bb588bf9-knm56
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame 8118 43 B
147 B 76ms
25ms Image
image/gif 52.59.98.46
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFfqzHLO6KhqwbRwLRxIDrM&google_cver=1&google_push=AXcoOmQKIEjDEXWbHRy6hwUJJRhz_83vzHgLC6QiYlTyQP8JiEiY3SOgr0juxjbSWH-VJ1T-7b_JtBfeqMz1fvCftchS-3ByXl26DCQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.98.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-98-46.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 8118 43 B
363 B 95ms
29ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmR7IHpwHQrj3BINq6QY81t5PBkAxnDVAKPOnt3ijYOze8_lL1Ivsiur0NxQ6twv6aI06E1CA04yqOonp1lEI6YfsVE0P6RGVnA&google_gid=CAESECycfTkSwEsbcO9dFn0ahwU&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:47 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 210076
expires: Sun, 26 Nov 2023 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8118
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEB9eaWxLpjOnqgGnyLNu3XI&google_cver=1&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1DwBjJGQ...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEB9eaWxLpjOnqgGnyLNu3XI&google_cver=1&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1Dw...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIyNzkxODUzOTIwOTc2Mjg0OQ&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1DwBjJ...

170 B
233 B

31ms
31ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIyNzkxODUzOTIwOTc2Mjg0OQ&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1DwBjJGQobXj3wetjXHwt43NudG9lg

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODIyNzkxODUzOTIwOTc2Mjg0OQ&google_push=AXcoOmSYPGdk-l0MTBMvZmX8B32k4lkyR4b8aTpFrLOijozw-U9Nhdj0wONN--mD72vAV1iO1DwBjJGQobXj3wetjXHwt43NudG9lg
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 8118 0
131 B 118ms
29ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IrJOCbj4v1LJH1de656IzZS8yjbHsQqTY2K90z2mL1r4hL2e8o6wYobvagpY46eixp1PF3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 208A 15 KB
16 KB 24ms
24ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 150929
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 20:50:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 208A 9 KB
10 KB 30ms
30ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a84eeee6a25e7c9a8a03191007a6720566b5a2aa2384d36168fb07f49e97e9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 03:53:38 GMT
x-content-type-options: nosniff
age: 211930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9644
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 03:53:38 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 208A 15 KB
15 KB 28ms
27ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 21:25:42 GMT
x-content-type-options: nosniff
age: 148806
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 21:25:42 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 208A 9 KB
9 KB 32ms
32ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 18:10:47 GMT
x-content-type-options: nosniff
age: 160501
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9628
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 18:10:47 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 69BF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

36ms
35ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:45:48 GMT
expires: Sun, 26 Nov 2023 14:45:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:45:48 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame 94E7 38 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 162657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 208A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=ClGxMG1pjZYHDAbaLwuIP1uO8-AKjh-mtdKzP_-bnEe3p2r_NARABIOOQ1RFglfrwgYwHoAGDrI2qKsgBCakCB8Q0K5Nasj6oAwHIA8sEqgS8AU_Qit3i1j89Yyykz8oOeFYxv1xOKDjY71o...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2214229431237440384029%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:...

0
0

103ms
58ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2214229431237440384029%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211362588163%22],%224%22:[%2211-26%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229621900983401509297%22}&andc=true

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"14229431237440384029","debug_reporting":true,"destination":"https://novapost.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11362588163"],"4":["11-26"],"6":["true"]},"priority":"500","source_event_id":"9621900983401509297"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 26 Nov 2023 14:45:48 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 26 Nov 2023 14:45:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"14229431237440384029","debug_reporting":true,"destination":"https://novapost.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11362588163"],"4":["11-26"],"6":["true"]},"priority":"500","source_event_id":"9621900983401509297"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame A2D1 38 KB
15 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 162657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame B848
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CeIqFHFpjZc8z2q63B7jykZgMyfaP0nLy3KDCoxKzvYus1g4QASDjkNURYJX68IGMB6AB5qD40ALIAQKoAwHIA8kEqgS5AU_QBpp_Nus-xHUm78z_mKsSjb9gUYrUkXvqbJi8DQwMXcm5_NN...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216325362202943824154%22,%22debug_reporting%22:true,%22destination%22:%22https://geteasypdf.com%22,%22event_report_window%2...

0
0

103ms
58ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216325362202943824154%22,%22debug_reporting%22:true,%22destination%22:%22https://geteasypdf.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22706613350%22],%224%22:[%2211-26%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%228370071914924008545%22}&andc=true

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"16325362202943824154","debug_reporting":true,"destination":"https://geteasypdf.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["706613350"],"4":["11-26"],"6":["true"]},"priority":"500","source_event_id":"8370071914924008545"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 26 Nov 2023 14:45:48 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 26 Nov 2023 14:45:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"16325362202943824154","debug_reporting":true,"destination":"https://geteasypdf.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["706613350"],"4":["11-26"],"6":["true"]},"priority":"500","source_event_id":"8370071914924008545"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame B098 38 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 162657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 107ms
54ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 26 Nov 2023 14:45:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 106ms
54ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 26 Nov 2023 14:45:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame 0F45 38 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 162657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
H2 200 294956 Show response
yandex.ru/ads/meta/ 437 B
451 B 124ms
123ms XHR
application/json 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/294956?target-ref=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&pcode-test-ids=909920%2C0%2C95%3B897721%2C0%2C1%3B911254%2C0%2C84%3B907877%2C0%2C42%3B912655%2C0%2C48%3B901185%2C0%2C64%3B908762%2C0%2C25%3B914672%2C0%2C49%3B786896%2C0%2C36%3B910731%2C0%2C47%3B908467%2C0%2C84%3B882595%2C0%2C64%3B907884%2C0%2C24%3B892904%2C0%2C20%3B906702%2C0%2C25%3B910443%2C0%2C55%3B909999%2C0%2C76%3B910216%2C0%2C35%3B910507%2C0%2C18%3B914206%2C0%2C8%3B913382%2C0%2C71%3B905414%2C0%2C37%3B916268%2C0%2C17%3B914861%2C0%2C75%3B912287%2C0%2C91&pcode-flags-map=eJy1Wdty2zgS%2FRc921neL3kDSVDCmrcFQdtKKoXSJtqMt2xnK3FmZpPKv083AEqkpEDjZMYPtkSrD4BG9%2BnTra%2BLa9LLftXeSFLIimS0kmXLJWtkRpqG8sXL118Xv27uP28XLxeCD3RxsXjafnpi7%2BB9FPl%2BEC%2B%2BvbnYw3S8LYZc9LJtZEeGnloRYjcNfI1QsJ5kFZV5OzRCclowTnMBOyFdZ8fwnCDwdruAJWU9VILxtqoArRH4gnJ5Q0S%2BooUUrKayLcueCjuu7znx%2FnScCr7GUzVU3LT8SlLOW7t%2F4jAK4nSHAKvnV%2BDkdTsI2Vct%2FGKvqMzgwAXhjPZ2sDhxA1eB4QkQo%2BNUHXJ%2F3GtW0Faa%2F8%2FgXAd%2BZnipn8bOGbxsKEtwHa07sZYVq9kh6LMRrzvCir9%2Bh%2BUAr38UtcFY%2FYt3%2Bh3Mn7qf05h%2Fnwd%2B9PYx2JecZLKizVKsZkaQrMnULHESJw52ZrRRJCA4gVS5Zv1AKs0ryEr0VlDewJOit1NC4nqR8wOg6kFPSipLTmo7dak1ND1wjjzTwyeAsGBBgWTaEYQA7F6hkqFgrcw5JYJdn0n1JHA8N9xtf7wk0QIJ9YJwgTRUMg4L5auhuZIlYdUMMZzfeBJ4sbcHJELgnfbPQfRtgHBWYN28YhSou6JL8CZrylberJhi9OaawhI6%2BNE%2FZ04fOkky4d2mgCAkGbqAFIjEengw8Ao3fUOz9pw3YyfYs%2FCSwhmHXrS1vK5Jt%2FPuNamG%2BY1HB3mTRKEf7QsNzQEiF0QHTU2qyr6NOAmC4NhaWcobJlZSQCw%2BB2O8u3oQUNfAGcclKZyZp57rRMq8B69KU3ILDFex7iiW%2Fa69oZyWJcvhMvP1DGz7%2B%2F%2FmcLPUJUUxZlpHllBiO8EgK3QiYKgpd1esubKfMU1TU%2BfGct5QJU%2FG5MGrt%2B0rdR3QBAqhy9uC%2FiSGkjZCnQuCr4czzQzhk34azm29wLhZr4%2FkAJlhWy8MQs9xZkLICKC851bD1IWgUIaKuLVsk0PDSgY3yxpgoJLk1I6ReEbpoJvg%2BiGyVrJqlyy32UVu4kd6bTgi0Ects%2FWYsJgVUFIyVlghICI9d3ZuuC0O8dMII5iwsPVwb7SR%2FQHvH%2B0ndU165JhUbTOSRwlekEyROhyLFNS%2BqThJI80YGDolaLOmqNa6KGCSHEpSu312pYSergOaBAED8j9r7ShpYAoMolQUwhcQaqtNlASRdufEbUsOQqag%2FZVo7ftOosD1p%2F5ThAI0DiATvAakq7rw5QA6HWQC6vWcQlpZ3Rq7ThCHY8XUkSYG3pjrgfIBty1WvB2WKytFxK47MnpFXq3VjUqValOzr4v%2FbJ%2Fe%2FlJvPr6%2Fe1y8dEPnYvHw4d9399v%2B7eb%2B7vH94qX3bYYaQhpodqyRVv810IGCPuhkVqFyqNi8cr1ePGzu7l98%2FAx7%2B%2F%2Fm8d32d3j9j7uHzfvtp9mj95sH9eTdl%2B2j%2Fvjm17unD%2Frlw4vJm3ePd%2BYpIu8Q4MHHzZf7D19%2BMf%2F%2B8lH%2F%2Ffxx8%2BJx%2B9unow%2F8d%2FPh4U6Zvjl9xEbTYE35En8XjEhBlr31%2FnzPM8Gl0oLC3QOd5orm7Yah73im7giIxJIAVekq0Qx1Rq0MF4eub4SlaihVS4j1BXpUmuuMBFHHgDvOwMSOjj6gEagFNRLcUlEOK0py4nrdpKBx4uSXZUryy6Ag3mUWkPDSh0IaeJ6TkDCa%2BzcJw9RUjVmeT7NHtEO%2B0jlUtb06hy7jnP4TCP9MDkGKBsmpFbSghbTNMFY7%2BAVPlK5jDRMnpMERchCE7hx5smtFZGwpSQ9X2CtCs6KlLlz6GU8gJkog0hT78YPp2O0BdQJ9glux5Qrk8orWf3aPwEdGumBsKAlvVKsdAPhWx%2FUaTCCjcp0VWdXCHQDpggAW9ERk8Ut26QUgFJzg0gXI6Xvv4L1%2F8D5Q78mlF0JnF3tgPw3BxEkjV4uPkt2CW0mnEl2PGoalVdC5IEOCCQOiVmY1pim6RVOGFSB0g1QDlD2kVwsdFbu1W%2Fi%2BKTmGkYBPsD%2FDSkdU%2BGJAgDAGkmoGO1SQGslm7kJVejXMOiMcksgLE72LFeGFEm16Az2wlSD5ymoNxBhFO%2Fm07ISEQGSdNXbQyLhKaTQ8fYtt6LP3DiI88k8AdUMGFRWYQNh3v7ffj%2BBqJEjd2MxXf52mWERi7yKFmwscP7qI%2FBTquh%2FOojABwk9noKYtzLHR%2FClcX3ttkq%2FYy%2BRwb%2Fa%2BIgljkxic1i1GGpSAzMozCQSGkWBlPyqosW2SkNuyJtgzQYbYGyXXSdIzZKga2xznEK0qDthOcUVkSI8VLYWeTBAouWcWi4yibujA0eeYwfZzgo2Jf8K4llKTnmfe7zjAecHc2g%2FiZGcNtQx5Ay%2BGFbNlX7tO6Dhvvm%2F67Ng%2FubKaIB%2FOU2FtJ40v0jS8cB24jgt878P7QL0Kv7OrPe%2BBilbVG6lIFUFr%2B%2Bg4YXhSCMAN5yPHrag657lamjpwO%2B406MeJStvBjrjIoKsgEmvY7ZmkejOD9aJUwyKE8hp2jr0igFoxr3o029vm%2Fn6%2BNx86Dt0yqG4NHcYpSGcoodAM6iiwny52jZhXH1blBttI5DHzNcKSHoWSH4Gdk84PBH2ss0NSVVy1%2FsjkOBsV4DpMJkhkxc%2BHrfzRztJ0MgPgQIo7WaUvYn4wEF%2F9wSgjjr39KGM%2F8rli0FNAHl91LWvsI5%2FUdb3wYGzUdqYs9whnN3fiZPIlxpE5gW6rp5X9HBMQUvTF1REluF4UHo5A8Ml5%2BbcbPioFzyom1rLNesrtQgNSwk2m%2BO0gegEerRWqmWDY%2B4rUSeJxnHeAsbPfTQd1i6o%2Fh%2BWxomK2QeguHee54DW5HXOl18k2gzwNh%2BfryLrGAYmqPRzluJJrgh20QG%2Bf5snqBlHszaqy4Ta9Rz0APh59H%2FcgSRqdulxDT2Og2%2FfixL7OjRUUY5wjmNZiBUVPKfiZ%2Baft%2Ffbt0%2FbdwQ3CgabEWLzC8cTsTKA1Vi1nr0BFEvMFzJma74VpeB50V6%2BfBXnosHk%2BWh0GSWgGfePl3bBCrCQ4TbBmaTWGhjU1X4h8ZyJVglrnIDrsW4hi08ebMSNrFDkjJqmM%2BAQvmQzGgg40TpfWMTJEQhD4U4dPOAKomi2b%2BeRMLIki47FI2Lecws%2Fu4KPnxrRG3KLNB5VN42Z32z8Tv56Rk8YXen8%2F64rQ6M0TtdBuGXhm5pxTLNoQEXr420PdY9hXHEipo%2FP4vulljTzG9hF3YSJlaKyz4Im9%2BiZSTfNGhf4nF6aNEp6oy9X3IWdG36kTBm6wn7Mfl6UQW6zZWpEXobD79geOl5dB&pcode-icookie=5NoJncC2hPv8vbDAhYlh6qgTSRFbNIFnmTX2r2Q76sP9b%2Fxm6LMvsqU29xiuR6ly8WJ%2Fi%2BbHyP5OeyJTeHFDM%2BJJnm0%3D&duid=MTcwMTAwOTk0NzQ1NDAzODEyNA%3D%3D&imp-id=16&enable-flat-highlight=1&comboblock-unencoded-vast=1&test-tag=532713383657474&ad-session-id=3774121701009946890&target-id=5656730&tga-with-creatives=1&top-ancestor=https%3A%2F%2Fwinzoro.net&top-ancestor-undetermined=0&pcode-version=916425&pcodever=916425&flash-ver=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A1598%2C%22h%22%3A90%2C%22width%22%3A1598%2C%22height%22%3A90%2C%22visible%22%3A0%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1%2C%22top%22%3A1231%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A19%2C%22right%22%3A19%7D%2C%22req_no%22%3A1%7D&grab-orig-len=3964&grab=eyJncmFiX3ZlcnNpb24iOjJ9ChqkppDkNu4B1PrCjLLy1nat3_RPGqeJg1PexRSyIaUbt-N0Y56ZeSnNsMUpOL2hlJz8ZHpuh5zYv6FN_9J06bIOB_TMANeqKsybDG02PytlNXzXjVlFREVxUFREVOnMkdFES2cuuoWWLsojU0EbQg1ACuUBSagMsUNNqAjVoeYPXBEQhZqA5KBpQvABcaj9W9aGkG4JzsGFGMo_IL5l-cnUPmmeWVLS-MvSVbK4GFx2FyiI6VyNezpjEfXPurFAx2opYmuSG6I8zVjfmmZRkUXoWHkYXphj99-sK18Zqk98eYg3QBQBQQi-Gke9wPyB_nZPjBB3NwJi9y_PoTIgcLdt9Y2udu_8qltXHJj6bwc7wP9QdsLJDpbqIEC4dbzj94aSL8-7qbjZbn-hqALCG4J42bmiXDe1JzSEYy5RQPC7o7wN-XZtRce9TUIf-ElVhdqbRHtLsP7E0Bxc2XblBjy5rC7xTpEVOtI0scR1szzGemP4bXRfFw-Qxf0M7re7BbfG7Q0gF6q1m2-3vOYtE0R7VHVOqNXDrB2eoOqX2-vLSAZXy7HOfY1IH9xtPtwbSS4tpKQOAaztkquFN2Vq0bWQLpK3mnoco2P1gVKaUivZwSx6wkpLZ8nhexBIk24wFKLwmlxkBUX0eWbKs-JNB0J0GVlKnlZQ3pxbLEV2q52WLjb0jBZhngEuTVI61wClcx0M1wnvgQnzR5WTm7HkznYjWM2NT3-VMnFKOKJIE-OJ4QMU5hwI8fU9qTnfqSoW55kE-kwTwriWgN-28GW8D9YGENinNyS5sSe6xmrx9TjKrWQ6BIDVFwMl6wdFb_IgTTkPjimX9CuEvrl7-X6RFOCLD7ub4lsAnWwiDJWCN6Xj6ymRFpn-62KGkMUCD2ELPO7EBk74lbkTH1DHvs2OZZOKGynASqKHO2nQqojgThL0KpC4kwT0_fK-qoIbaVC8v-WKWfMZ86beJ3EnPDBzohBnEOUmMxb5Bu02VX8NaoVSzBGq993AKXEpkz0LVQD3WMVVtYC_qsHbhBOW6NKfj-6aQKwiLbcUlD1Bi9r2XvAJhUO9sLRnvy9P-Nxo7bmL3o65lC4jWhdcDArHfGJzKZDRPeqmlFzKjuowHY7qhsSgxeY0ifwh2uPszYguo5xva1WuYFTsIC1ZWKR_sed5tSC-9BoKRFaD9kreBTM9RpWmkZQulNLw1TpNj2ruZljBX_p32xDb7Us5ltxLbIt6FIuJXKVRDebJTnqUZ-SRzlAYTPqYlZaZQZprYgCrsB-4zneWkh1xqCzicFquYJlPQH3ZqJOue6oO_4RE2TPdNR9zCwi875hqOFo-Z8lT-cqnZ2Bmp_Ih7Fduim4yYW4dl45uPg5uqOVkDRl5qCEzAz071ZCqiJKU9CLwbfosLqJHU_TzW1ChRI25JQP4UbE4QxtwMu6YWXh4LRYmFnYqGmJTz658KcUf6P7G9YhN-VWJ9GLM0I80jmHDq6TnqVQMDjYqFvIii9JHcgUz5g9EPQJ9FOsfec_jEwETY4sTlJq95CG6GJ3sU7GUssjyR5mT99ic67qxY9jS0fNSOsczlmzkDosGHnXPyJ8ZOYYuHQO3Qedgp9JtP8jzxHS8ff_kyBW6N-gTw63E4_Ribr2gD8GBU5Sag5dqMT8TPf-HcnJXrQOLkBSksShGecN8kmJRmTI0Udbq3BYrjKQQmCUZjHvnY2doAhC9NOCPZxTrKQViaEMJsQPCxYYIwTccCzA9-VDlWc-sxVPoOU2CrbHEHgUNaA_6I0ZCzUl_08FTbtJ_WdPqYkRWMODIUeaURZIdWYjz9YQuhky5-GPKUBbACmA2jMIr36WNenAPB22Vk3fOA-VfspTsRPmjtUY5_Kuah2Z-ACLz2zqZPukP34neyfniQBn8gkWmUw7eEhEH8e54INwyPX1pB8tHANRXDpFZn510mm0ozULhQJQBZFBeOVlGRh4CkJnZzk4BaDMU1igpnkafxGnyaLPceCFneVCLJF7U7iyNPjZeQc2cL5c4cqEwUhlnMep4wXQtHV8ysRFGQQi0j85IND7SWsKTXHfUHkJfANLRnPiY650A8kIJnm-mjtMQ3DhbIR4cE4cd7OKc83dMwL57wpuXsqLLAsKN4CsTGOyj2HqUJvqnThGkTzoUhT4jX7lFjHFJFCW9nadctL-TLyYm-zsigO_FI83J0ke2SHuPOiXNnqowdZAXKHWRxeYjN6AwGro1wshFYuIF6cfB9E4GNsLnQl0Yj0awmbruqkyd6_QYuXrMvDgfZfkMjPRs5HsUIPfzQHRHxDHoM7KnySPd285FLKJHm5Bla6EYA8BViukZ-VaK_Z8IdRp157kZ0XkZ5EeuARKKj_VGI2ai2WF-1ezcV81Oz0bfRNWtS6mhyB6RuXiqvhRalkd5Nz1GRnwtWZh4IcWwvMNZcgpPBKz6HsIcYm3I58TKkA_K2HOsUc-a0Ix9Ad5azfDTzveM-84_UIz5g3aNNMYzUNK5zE6xSY_ujyruJIwD2_Z0Hs7iTQ8zhBQQBPDW9kEzJIcdBTSbe9Toh-1j9bImAEQ_avHYnm79N5LfTD5T7-ZasWgC2AN3lpuNgvbH6EkzhCm4Q4BSjMDbXQm2k6_4jrNmU2NTtPPjzfzL1t1fY4GdUfNjDz3DjRxpx0ZTXzEmAzdMAMKwZIYeqd48mh9Nfwie3MVF14wZ0xE_faEbnrmY6KswvmSO1rBhL7y6-sMAol1dJi9G97Vni96Ut2W-wr1m8NCwlyf1zOVjXxPV6vQDqZEL5L6S982imuKrt1AzPd5OOkjN1wn1Dq0cxffG_Qp9Qi6rtZJu-Dghox3fNM_xjoO5Z8XyBekg4PwW-qBcbk_u-uVpbIDdRqxYrAoI6wZrjjvldt0XcgqgPfEUfheXGSO2b1ADqWmke9N5GUQUEKD_EBAtlQCTJin6NTE-UeRbxWWEsAa4sH73WL1ce2F6asKEwqrPwirGXo4CcDrBOGIGCrWGMISqkJ5u8BRSNvbA-Mv2FmzKOecWPRPXsm3icNjWJwWJpxAkzSpkVaTlU4Zth6JhTbWCq9qKJIIUIs-ulHy7n5fiKNmhVvjpA-LqxqV2EQ8KYrfdzeBeRd3lm2isLJYVtU3L6A1v6l0q7FW2DvqxPhW7AWB7IbuNwN0Hk800eJIDvEnQZpYkzS3oQxhHywF3KQ21yVdOLl2nj1M4y8w5_-Fp05Rka6Vo88n9dWlw1YYIWCrs1sq8_ilW6qItpuHMswQgzDBzwG1fWF1VJEBvE8QWM_5DbvLwj8U9e7gjMo53UC11Bf9Qy2HiCvVz1i6kkObWJI3Tc1cRSoO8JTCE_bf383o6JGu50aJT25IcdruVo-mm39rNsW_jTxYpampQ02QT-1hk4FtYK6cHhHvjN69_ihM2t4ZfX0U7SZ_Fy-XQPPchOHPVbVe9M80P3DsGgK5P3n88jffZc6qq-f8W0e2zh8qVrab6yJNOrq7P1ftltU9Fj0Q8jwEbQw31ZnGUhpFeydU8UXSj_ij3qd35zyb1nsmji4jreK-oCVGqZWfGE-zMf2PKhPLu4V5Qtrc_uDhLgTfGQZ58mUTEm9eoNLKliSOJxxZ40v5MbT3b_Q3hze9r3VShJctmxvDayjkjHUh4YyKu8PTdPPoH39O62_Tb1s-Bw9gAVfhKeRDH_fYVgGFtuVu2-1Ngj3qwTx0dTFjzlII14rbl4FD8dvNt26QtxPHQPdbN47SUwx6ltsY_TvPQHvQf5On7SmgfAuxcMcgH6i7yjhHYAwFgvhqNA0bRSOS-s0ZRkcH5KNYJVLOmiFatDs1IE9M-FiGGU0S21LrkXrHNYzzU5vpOsPoe44TV6th2n5Qvztso1YlzNmp6rLR_jsFQ5pMLR6cAeXsLqu3InMYiRp8m5CvcuxaWPWrwYr1QW1u_D3RTFXON1guA_g%3D%3D&uniformat=true&callback=Ya%5B8527287277858%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

d9a5d77d4989ad2a00390e58816eb476ab59366a4fd767f1132fd08b957c77be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 26 Nov 2023 14:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1701009948921969-10422367081077503786-balancer-l7leveler-kubr-yp-vla-34-BAL-8112
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
uniformat-product-type: None
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sun, 26 Nov 2023 14:45:48 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
uniformat: true
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 26 Nov 2023 14:45:48 GMT

POST
H2 200 click
yandex.ru/clck/ 43 B
126 B 60ms
59ms Ping
image/gif 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/clck/click

Requested by

Host: yastatic.net
URL: https://yastatic.net/partner-code-bundles/916425/ed98de085e4a5e38713e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1701009949238570-9451248734059498277-balancer-l7leveler-kubr-yp-vla-34-BAL
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 208A 42 B
175 B 60ms
59ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssHWgXGZNKo5N5ub6fXnYEelThzAkMQgEyIWurXlLUbjJEfHG368CHQ-_cXqUhu_yTMyxr2EHL41Hve6iyhyNtgUvKlSDSaLuvSS8zhTE6eFCD9UkPYtOA0ivhB1NrPrGOSnPI3AYaItIskrv0KPQ-RbmXcmwCUFPvPZ3DdvYkiu3Kioz3EY54GWjLpBVMw8isyo5nscBz9X6tYGDPwuwetogSvSPaK0sMbFl6kaciuiSoD7QvQng_8vRGhO4gumBOoMG3CmcKp7CjXsNY6jcsb3GpcVGRIB6eLQ6mSwnNF-bvaiLsmKzWi0YbbaUIYLeh9Jyvi7xKcnjHkbOAnp6G4eCuSkHE9CyFh_VL2vis3cg579dakbtmm_1rYuBSHx97PVYhhej_SrQBlu1kb6pD7_E-xP3b_ZZ0r1rD5_qCsttlD4e4p-59XkKj4jOQoYuJtm1-SaPx7L-P5B5HWo2GIw-8pU0_48iPyT661XlDiIJySYLoydswfNPndHz0r3KLedsa2FXTV1-8Fkz0RB5q9yJiWmQdLHkIdR65p_yUEt4auZvm4RzdG2oJzskfIBCrSnmrHcYLECTJUmZQB-M_r1S2E4m9a_HxwS9QpHWLAashg1Sv-RAHNI0WxhyrKhBMTBFIuEGrLi8qGTlotuGTkReuImj3QQGz6KXSAm2376SVvITOFCx5O3jRmb7Fc31lMU1bhXm5ZZ4h2W3yw090Vr1ZJwEYc_N5REM1ZyvQ_5me1nR1Mdenx1RhCbqHbj6W_0OPkPL8EPJJH1oswDnE6duew_vQ0nCAbVASvnE868GNmv_HkRvIu0k6EI8pW5f-giLq83p1QUD4uY6ZsfPrOHG9twV6vRt3nyHCdKmYOZnvhjbZrQr7L6MBjWWFPjtQTsSnfnnaKAN5QW8tWqcZinOLfSgnHSv-AM-9Fuls2TNaX2Ws-ZxsIXUZyjyATUQt09Bmz29VM-hzAVriCTwdJLmM0rk5rzegtJqVBAwnQhcFEu8ZAPQWo5ErBBxWinGQa17-Om8yABJj0acNZD4KzDECPoVd4kxNsHx5JGh-19IuIbpKCb1TN2n-7ympXXphfGzVoScMxK1NCHKeUw0owy89IN3VYES_ZxA5mr6AbctFfwbe4vPof&sai=AMfl-YQb-uyifxxJ2UTXWKeDE0FCu-zncHDX2KYvg5F0nuOg8wy3h8xOrzxA_7U03_6exLpLbxdS0An1bqi5LSyEJ1gt6O6k3kYvm5nS1j13VX7d9DwRmvZ3Ez7pMBESSscAse4K2YpwkZwXF5ff0CQkXzrjTArrV3vqp21OKMw&sig=Cg0ArKJSzMpc2N2XKV7uEAE&cid=CAQSTwDICaaNbVtFdCyRHHtHnbJFuhDhh02dGQN7vgqF4SWL6XquAWecd_66fdr2Bn-ynEXz--ridQCTzqUoQYFiy-Uv8PpsFOf0qmg575zLLSUYAQ&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=126,810,1000,1000,1000&tos=126,684,190,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701009948082&rpt=429&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 9377854
mc.yandex.com/webvisor/ 43 B
0 321ms
199ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/9377854?wv-part=1&wv-type=7&wmode=0&wv-hit=571151070&page-url=https%3A%2F%2Fwinzoro.net%2F&rn=540468027&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1701009950%3Aw%3A1600x1200%3Av%3A1170%3Az%3A60%3Ai%3A20231126154550%3Au%3A1701009947454038124%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Ast%3A1701009950&t=gdpr(14%2C14)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:50 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:50 GMT
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:50 GMT

POST
H2 200 9377854
mc.yandex.com/webvisor/ 43 B
0 64ms
64ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/9377854?wv-part=1&wv-type=7&wmode=0&wv-hit=571151070&page-url=https%3A%2F%2Fwinzoro.net%2F&rn=401175825&browser-info=we%3A1%3Aet%3A1701009950%3Aw%3A1600x1200%3Av%3A1170%3Az%3A60%3Ai%3A20231126154550%3Au%3A1701009947454038124%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Ast%3A1701009950&t=gdpr(14%2C14)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:50 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:50 GMT
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:50 GMT

POST
H2 200 9377854
mc.yandex.com/webvisor/ 43 B
0 67ms
67ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/9377854?wv-part=2&wv-type=7&wmode=0&wv-hit=571151070&page-url=https%3A%2F%2Fwinzoro.net%2F&rn=368007798&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1701009952%3Aw%3A1600x1200%3Av%3A1170%3Az%3A60%3Ai%3A20231126154551%3Au%3A1701009947454038124%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Ast%3A1701009952&t=gdpr(14%2C14)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:51 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:51 GMT
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:51 GMT

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
331 B 68ms
68ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: winzoro.net
URL: https://winzoro.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:52 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 24 Nov 2023 08:37:03 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "656060af-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Sun, 26 Nov 2023 15:45:52 GMT

GET ads
googleads.g.doubleclick.net/pagead/ Frame AB25 0
0

POST
H2 200 click
yandex.ru/clck/ 43 B
246 B 62ms
62ms Ping
image/gif 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/clck/click

Requested by

Host: yastatic.net
URL: https://yastatic.net/partner-code-bundles/916425/ed98de085e4a5e38713e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1701009952333864-8993972394591499636-balancer-l7leveler-kubr-yp-vla-34-BAL
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 73ms
73ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231109&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d2545a5baafc27e998fd52fc78b6702d2c243180aa0c592cbd3ac82fb4edb1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12120
x-xss-protection: 0

POST
H2 200 click
yandex.ru/clck/ 43 B
125 B 62ms
62ms Ping
image/gif 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/clck/click

Requested by

Host: yastatic.net
URL: https://yastatic.net/partner-code-bundles/916425/ed98de085e4a5e38713e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1701009952392489-16299180581502441913-balancer-l7leveler-kubr-yp-vla-34-BAL
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: image/gif
cache-control: no-cache
content-length: 43

GET ads
googleads.g.doubleclick.net/pagead/ Frame FAF6 0
0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 26 Nov 2023 14:45:52 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8EBB 13 KB
5 KB 25ms
24ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 16147
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 10:16:45 GMT
expires: Mon, 25 Nov 2024 10:16:45 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 83AF 829 B
559 B 34ms
34ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0254ffa3ea87960d96e8dc1edab35d0ccd4cbab610e323aec57ddcac6566d9a2

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-u3y7vt1AT4tVDP0DYnmN5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-u3y7vt1AT4tVDP0DYnmN5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 14:45:52 GMT
expires: Sun, 26 Nov 2023 14:45:52 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 8EBB 39 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:18:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Nov 2024 16:18:14 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 83AF 0
0 54ms
54ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231109&jk=703821719693504&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8EBB 0
10 B 19ms
19ms Image
text/plain 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?0w0BBw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 14:45:52 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 61ms
61ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231109&jk=703821719693504&bg=!np2lndLNAAZxrfrxUa07ADQBe5WfOK93ZgzMFG4VvW__tLdjahw23BzU786n_5uV6Gbw2lWjAC-uCPfRSK3ORMhY732xAgAAADVSAAAAA2gBBwoAGi3vXHNBsMfJdB5OZpH0tHalbkydmjouj8rvmQKtYik_aX-2xRnKXiwq2wwIfYjJzgA1XW2SfHIdTA1ry_lHkHXv8V18UfgIR-2R-YTO6HOdTIww6e6fl9ZUiQLaP8atgUhk8wYgexsQXlcb1PlaodifgSM9y5kWCifbdor_8_KeIq-Ffi3KxEdKOL8dXNemQttusLFLSQmPwrrtf2qBSx2Fi_6uNnsx3bf6OduCQTBabhkD3antzAH-WrdMKXv6l84Zx1iLi5mRa4hnxdk0tVAxhQLrnr5MWmOACT-XEMMzkc0kyToU6CCsEW2HRojdItXunbbbBM4vRCJN7Ov7wYeZgFTHsL4HWTaIR9EaNO90iViE-epulRZK4ZYRQl8dyo0K8Dgz1sMiztxzxfNX0h-rpM4O85RsZpdSY__5sQzZgOCpjCcDlQ23Db1pSAiCPijH8KjXMXd163LyCSWzPQ-AoW3-vmOWnKjYdp4bEfWKIEhthG9R9UezGeI69dCVqf-C5RvJxfJS5zrTvvKtDC7Jdo459Rq_N6yNoRKhC3z4kFfEll7-NrOCNtnGEBP_VD2-YT_VVXNP0ffSGAxqYrXwOOoLRwqCe8Fcfe_9__23s4qvU_bIxjKA4MZC5eULfpS5Ipvblq4ti0DJIZkzGo6fXAIPM0FVSf4tCy3qPueUbpdld1b3Q3G92FUIzXa9VwX91BYSJEPLcJkZ5VJx4SlE0rSIESr2CmHHV6cEE4Hdi1F1OmmxHD0FBihT-xK6PHLcKOr3P2D3xBOsAWWZ5KVl6c0tGtFy5uTYirrYvmTFloMA1uYzF_Rlt-pZRDv2boaEewRGTayW8yDigvT56iHij2V_pGIH5DWnKp6NuWLIfhQW29BCY5AcMsipswQ47mTKfjIymTfWCUId-9Wt1imFZ0dhO9XqydpuGvSYT2fyylyQ4gw-C2gqAQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

POST
H2 200 9377854
mc.yandex.com/webvisor/ 43 B
0 61ms
61ms Fetch
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/9377854?wv-part=3&wv-type=7&wmode=0&wv-hit=571151070&page-url=https%3A%2F%2Fwinzoro.net%2F&rn=558681917&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1701009954%3Aw%3A1600x1200%3Av%3A1170%3Az%3A60%3Ai%3A20231126154553%3Au%3A1701009947454038124%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Ast%3A1701009954&t=gdpr(14%2C14)ti(1)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:45:53 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:45:53 GMT
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:45:53 GMT

POST
H2 200 click
yandex.ru/clck/ 43 B
125 B 61ms
61ms Ping
image/gif 2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/clck/click

Requested by

Host: yastatic.net
URL: https://yastatic.net/partner-code-bundles/916425/ed98de085e4a5e38713e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1701009955337304-2200068199938456314-balancer-l7leveler-kubr-yp-vla-34-BAL
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 1
mc.yandex.com/watch/9377854/ 43 B
146 B 71ms
71ms Ping
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9377854/1?page-url=https%3A%2F%2Fwinzoro.net%2F&charset=utf-8&hittoken=1701009947_a1fef087abd33c2766e0a5dbf01e4128dc1af419c1e52d3ecde3f32d01bd141c&browser-info=nb%3A1%3Acl%3A344%3Aar%3A1%3Avf%3A3akmpckrufnt9afj6lckkvrv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1170%3Acn%3A1%3Adp%3A1%3Als%3A1687920505372%3Ahid%3A571151070%3Az%3A60%3Ai%3A20231126154602%3Aet%3A1701009962%3Ac%3A1%3Arn%3A518438401%3Arqn%3A3%3Au%3A1701009947454038124%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C1804%2C13%2C6655%2C6655%2C0%2C6584%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1701009945691%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1701009962&t=gdpr(14%2C14)mc(p-2-h-1)clc(0-0-0)rqnt(3)aw(1)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22ct.e%22%3A%22ns%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Nov 2023 14:46:02 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 26-Nov-2023 14:46:02 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://winzoro.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 26-Nov-2023 14:46:02 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4379353840599633&output=html&h=280&adk=281093907&adf=495251238&pi=t.aa~a.3502614405~i.2~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1701009947&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=7633074340&ad_type=text_image&format=960x280&url=https%3A%2F%2Fwinzoro.net%2F&ea=0&fwr=0&pra=3&rh=200&rw=960&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701009947963&bpp=3&bdt=1484&idt=3&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=6112926642607&frm=20&pv=1&ga_vid=1725048316.1701009947&ga_sid=1701009947&ga_hid=2052711838&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=440&ady=2294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31078301%2C31079654%2C44807754%2C44807764%2C44808148%2C44808284%2C44809057&oid=2&pvsid=703821719693504&tmod=159807793&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7

Verdicts & Comments Add Verdict or Comment

185 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
winzoro.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: 756l8kn0abcfdh9ksrk00usq1a
.broluckycode.site/	1970-01-20 17:13:21	Name: uuid Value: 64dc8e52-6bdd-4ace-b145-0d15162dd6b3
.yandex.ru/	1970-01-21 02:06:09	Name: i Value: WYMrGipH6SpDWdYDujpazSKMADVISkmKoSIkezTrWlwvP1vLrEgatvWc5YCxtomc5BWDOMaK3hSjUvNhMJpW9fwdxIs=
.yandex.ru/	1970-01-21 02:06:09	Name: yandexuid Value: 5059770281701009946
.yandex.ru/	1970-01-21 01:15:45	Name: yashr Value: 1445271051701009946
.yadro.ru/	1970-01-21 01:14:42	Name: FTID Value: 1bOreQ0eUweh1bOreQ0024Us
.yadro.ru/	1970-01-21 01:14:42	Name: VID Value: 3o8ufh37kLeh1bOreQ002G8f
.winzoro.net/	1970-01-21 01:15:45	Name: _ym_uid Value: 1701009947454038124
.winzoro.net/	1970-01-21 01:15:45	Name: _ym_d Value: 1701009947
.mc.yandex.com/	1970-01-20 16:30:10	Name: sync_cookie_csrf Value: 9208520fake
.mc.yandex.ru/	1970-01-20 16:30:10	Name: sync_cookie_csrf Value: 2311187562fake
.yandex.com/	1970-01-21 01:15:45	Name: yandexuid Value: 5059770281701009946
.yandex.com/	1970-01-21 01:15:45	Name: yuidss Value: 5059770281701009946
.yandex.com/	1970-01-21 02:06:09	Name: i Value: WYMrGipH6SpDWdYDujpazSKMADVISkmKoSIkezTrWlwvP1vLrEgatvWc5YCxtomc5BWDOMaK3hSjUvNhMJpW9fwdxIs=
.mc.yandex.com/	1970-01-20 16:31:36	Name: sync_cookie_ok Value: synced
.yandex.com/	1970-01-21 01:15:45	Name: ymex Value: 1732545947.yrts.1701009947
.yandex.com/	1970-01-21 01:15:45	Name: bh Value: KgI/MA==
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 800288571701009947
.winzoro.net/	1970-01-20 16:30:11	Name: _ym_visorc Value: w
.winzoro.net/	1970-01-21 01:51:45	Name: __gads Value: ID=fc3b00ebd7027804:T=1701009947:RT=1701009947:S=ALNI_MY74e20kDPSgFfWkbQNaedLa4Uyeg
.winzoro.net/	1970-01-21 01:51:45	Name: __gpi Value: UID=00000ce0db1adabd:T=1701009947:RT=1701009947:S=ALNI_MY9z24313eerRTAKvVgYMN1ss7XmA
.doubleclick.net/	1970-01-21 01:51:45	Name: IDE Value: AHWqTUmrQKe4YkjJdD88F99ok-fpX1EDe3_dk2cDvbaPwhPu5mcvKhon64QMZBYO1Pc
.doubleclick.net/	1970-01-20 16:30:13	Name: DSID Value: NO_DATA
.adform.net/	1970-01-20 17:13:21	Name: C Value: 1
.adfarm1.adition.com/	1970-01-20 18:39:45	Name: UserID1 Value: 7305782096845928608
.w55c.net/	1970-01-21 02:00:24	Name: wfivefivec Value: 1oWZaBLW1R7gok5
.adform.net/	1970-01-20 17:56:33	Name: uid Value: 8227918539209762849
.w55c.net/	1970-01-20 17:13:21	Name: matchgoogle Value: 5
.everesttech.net/	1970-01-21 01:15:45	Name: everest_g_v2 Value: g_surferid~ZWNaHAAChgEW0QBU
.travelaudience.com/	1970-01-21 02:00:24	Name: _tracker Value: %7B%22UUID%22%3A%22E717C9CB-467C-4340-28D8-4BAC9F9512C8%22%7D
.googleadservices.com/	1970-01-20 18:39:45	Name: ar_debug Value: 1
.winzoro.net/	1970-01-20 16:31:21	Name: _ym_isad Value: 2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.travelaudience.com
broluckycode.site
c1.adform.net
cm.g.doubleclick.net
counter.yadro.ru
dis.criteo.com
dsp.adfarm1.adition.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
mc.yandex.com
mc.yandex.ru
pagead2.googlesyndication.com
pm.w55c.net
sync-tm.everesttech.net
tpc.googlesyndication.com
use.fontawesome.com
winzoro.net
www.google.com
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
yandex.ru
yastatic.net
googleads.g.doubleclick.net
142.250.184.226
142.250.185.130
151.101.2.49
178.250.1.9
185.177.94.152
194.67.68.223
2606:4700:e2::ac40:8d0d
2a00:1450:4001:802::2001
2a00:1450:4001:803::2002
2a00:1450:4001:808::200a
2a00:1450:4001:80f::2003
2a00:1450:4001:811::2004
2a00:1450:4001:828::2003
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2002
2a02:6b8:20::215
2a02:6b8::1:119
2a02:6b8:a::a
35.190.0.66
37.157.4.29
52.28.224.148
52.59.98.46
85.114.159.93
88.212.201.204
00f98c29c5d375b8900f82b7d07e324748e9fee17f0592f0cc1bb0df71dd6e84
0254ffa3ea87960d96e8dc1edab35d0ccd4cbab610e323aec57ddcac6566d9a2
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
093c1fcee545ef703fcb79c1c4c835a32e67081bf651d44253cfdc68a31bf869
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e
0ecd9f5bb492be71e3aacc8ca4f170c8f9890242a25e2c6ec9a42f13561b028f
11e783f59620c61937ff22d35ba27ce4a3fab3dd1b269898e930bbea01ff98de
138313ba91a77c618c029500c84ae2867deb4eb88560b177941c913fa5e9917b
13d62575f2afbe06a27270e0ad31a53dc50a0bbea757e043cf8e2eb4d1c9fc9c
14e77ff1225e5c2d97f7f2193257ce43e364e2f4149d3d8a4c4a07b017122514
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf
1ba030b54b94fdc6a701f8cf7d8152a598f0dc0eca410a88cd124120c65191ca
1d2545a5baafc27e998fd52fc78b6702d2c243180aa0c592cbd3ac82fb4edb1a
1d5d9b1390a089fb79129a1c6b7778945bdd2dd34eef49fd2acdc8a05162d1eb
1f753192dcf35c9feebe309f936821c36a397a993388b992158458c505fe386a
20ac558ae4e736f5a22d58c1bcdab41693e106fb485d0c582be711621ef6456d
2236f8f79b3e2936da97c0a0f8da93b3e821e353f9ab1036ebb505c8c8714aff
227ebeadeabf720faa659ed7547a50ca7e2a9a19648ca781a13dbba37d04f958
25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af
2881d8eadc298102d2462e8d32e40792adce37b6cd89d99045f574eb3ecbb748
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2d6d9dba2794d20680a5c8d13858b6d93ee95adf68f6a391530b0ce3dd3f9595
300f5b02f9f5a3977cefc61c55e73223b22aac671597c11012f4c8112a2af5f5
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
36ea1c138e12c2a5f2f79d82855b047e6dc28453987430afc7bde42ba46e1de0
39fe29cf7b41b3c265736d9c0a69cc6986ca78ccc31fdec26b8e25fba2cf2d99
3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658
3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e
3df65d7d6add27dd11c6f6a174f7940f193a6283948ad989f1462923cde8f229
3fed9e40fb165dcb840e9b2965ce16e1842a6e83aaddaf06214605437a414314
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9
4b9fcded3dc266892bfe2c8cb361496ef99fee57267f5b38a6df0eb652956e18
4d0130d314f1669c9ea5a911d401d6250f96386a52b0c38f7b3fb43cdcd10589
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
574b35072c523a94f489167282a8ce8eff008f8817d84aed7a8740190f04bdf2
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c7df99df232586111917083a85aa31b82ee29e48ca2990e13fae0c0663a923f
5e96accf2e0a2a0978c6e5669ff9b79f65fb177ddf743a9c1e49a4462f035bb0
5f7a93f16adf719ae19ef85b86d769b943b3b93a13d76d20fc19d121d911179b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300
623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016
62caa3e1ed69014bfd8e4a608a3524de84a80dd2bb15a774c1a230a160312e00
67706e53b38e25f14acc64b5eca990ed4fe7be666019862acb40603fbd79480c
6a84eeee6a25e7c9a8a03191007a6720566b5a2aa2384d36168fb07f49e97e9e
6b9d2722f54eab704e54d8f412c8958a14729d81c74422a483e2d5daea80deca
7437c02e9df1ef73382fa4358c15982d77a7216fb81db693e55e40b8c8fdaf59
749a7c498aaf5b833bade4cdaa38bf40057a38c5f69a43e128c97c794d88398a
7610c8eff28cc17e0461f966280f48e3f3c88914b4028eb841c80750dd3d1fb1
7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd
80481e75d22187d02a61a359f770677a8e40966925473242ba9aff5d47b750c8
80ecce8635f0960352aeb6d4360a057616bab020fe3f3dada78bfbd15451fdd9
87c55f46a7dcc6c7c2b794142a65a1b7871bc50aa39770bb54887f93620543df
8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984
8f3c6146fa69a8923af33fc5454c4ca28bad620689a6faee97f2a04a6f6c134e
8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a
92a198bd1a2c8dec4aebbef1fe41a1219a0dd5061bf57ec3ca53773bc3169c6a
9756fa74b82514cbe0c183bf8f4f0b0fbee33d987b779afcf89a6851298e2b15
9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b67e1e53d9fe07a1569190b3c25ae4ab4d57a49b2515d30c20d32a6689683bf
9ffef098b884c7af804c3cdc2ef744a2d3837a7fa303d317a2002cc7629463ab
a3e5c486ca9cab98b690f2f3fcc83c73141a667293c8a8236bb1e376313f0e36
a48682c3d7c0da087fc57642fff2362fe718e663579a4416926935dd6ee1f3b7
a6a3b1b01642f557afc02f2c9d8ea202d26ace9170e19f9b9b46f15849d1f9c1
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
b306ba1af362db6ca00b654c6ddf9c3c84a448bacaf741277e525c782db9f336
babaf438b676e127e1b3d842c9ea1cc8e5bf4fa6a1761a038f7d0e5bfaf3f230
bb51b9caddb8a0e55d70c819b8a8903fbf2f94b7ad453653ec6aa0e823524276
bc8cbd85bd12b9715d6195b68e3e2c338630a13d763321cffc0a34d040c79ac7
bd30ecd5ff9d522e69153382b6304c2b571e1a205f5b2c5728cb5e0c2e4b0181
bd7349560ec3799de7ee0053f3b861f068a6b67a0088f3f9ff994c9c5014871f
c319c3284c41a16507218acb514dc14a91498790752f85279455c3224528f775
c3d606568f389989dd02561ca2b0d20d29eeb477ed633a690a518879748f487a
c9c1caceee24c82513919d61734ad3ccb66800fa0a92f71da617c49b8a872fb1
d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68
d18f91781d6892fc24796d9253c6b82869799d2995b7ebdf90b835877df718ea
d9a5d77d4989ad2a00390e58816eb476ab59366a4fd767f1132fd08b957c77be
db191b86ceb259d81e84aea4841313360880f32a21236bdfd20a9ced1bc0e8ed
df301479921863d00f49551cae9e1cf786a17544c23839747864617049f9b51f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3901fe1a0442e50f28c14d6eae3dec8c35e6271d6b8bff15df81b6d5f7495f1
f55a11baf33fb17425e40acd9266d2277424db4e0ae3bf3c703418de8b13101d
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f99a2c60ac365f5cebd3b520372c07dac909708e0fb5f8848a0a967c7fc0b98e
fa417504e0f2de91fae19390e41a69769631e7508602d7472b72f1eb3a808755
fa8b240fe98efa97446504fd81ecfce85030306c6c7af652ef96cc3b3b6ddd2d
faa84aa0046442cabef064339395109921b4ad2d31d43f3168bdc00bfa94e19e
fd6e6469b74eaf5b5db0bd9ed72c7da7284861278cfb28f8f2530ae5b2a41d77

winzoro.net Open in urlscan Pro 194.67.68.223 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

159 Requests

92 %HTTPS

50 %IPv6

21 Domains

25 Subdomains

20 IPs

6 Countries

3249 kBTransfer

6905 kBSize

32 Cookies

6 Outgoing links

Page URL History

Redirected requests

159 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

winzoro.net Open in urlscan Pro
194.67.68.223 Public Scan

Screenshot
Live screenshot

Full Image

159
Requests

92 %
HTTPS

50 %
IPv6

21
Domains

25
Subdomains

20
IPs

6
Countries

3249 kB
Transfer

6905 kB
Size

32
Cookies

159 HTTP transactions
2 data transactions