www.zarplata.co.ua Open in urlscan Pro
2a00:7a60:0:1055::1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://zarplata.co.ua/
Effective URL:
http://www.zarplata.co.ua/
Submission: On November 27 via api (November 27th 2022, 5:18:57 am UTC) from GB — Scanned from GB

Summary HTTP 113 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 19 IPs in 4 countries across 16 domains to perform 113 HTTP transactions. The main IP is 2a00:7a60:0:1055::1, located in Ukraine and belongs to UKRAINE-AS, UA. The main domain is www.zarplata.co.ua.

This is the only time www.zarplata.co.ua was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 24	2a00:7a60:0:1... 2a00:7a60:0:1055::1	200000 (UKRAINE-AS) (UKRAINE-AS)
29	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
8 10	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
4 8	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
4 6	37.252.171.85 37.252.171.85	29990 (ASN-APPNEX) (ASN-APPNEX)
6	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80b::2006	15169 (GOOGLE) (GOOGLE)
2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
113	19

24 2a00:7a60:0:1055::1 (Ukraine) 1 redirects

ASN200000 (UKRAINE-AS, UA)

zarplata.co.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zarplata.co.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.186.98 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.80.39.216 (Canada) 4 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 37.252.171.85 (Frankfurt am Main, Germany) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany) 1 redirects

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 131 tpc.googlesyndication.com — Cisco Umbrella Rank: 182	490 KB
27	doubleclick.net 8 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 64 cm.g.doubleclick.net — Cisco Umbrella Rank: 271 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 356	134 KB
24	co.ua 1 redirects zarplata.co.ua www.zarplata.co.ua	243 KB
8	casalemedia.com 4 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 705	6 KB
6	adnxs.com 4 redirects ib.adnxs.com — Cisco Umbrella Rank: 276	6 KB
3	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 332	179 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 219	142 KB
3	google.com adservice.google.com — Cisco Umbrella Rank: 121 www.google.com — Cisco Umbrella Rank: 16	2 KB
2	facebook.com 1 redirects www.facebook.com — Cisco Umbrella Rank: 102	3 KB
2	teads.tv sync.teads.tv — Cisco Umbrella Rank: 1439	344 B
2	openx.net us-u.openx.net — Cisco Umbrella Rank: 585	418 B
2	google.co.uk adservice.google.co.uk — Cisco Umbrella Rank: 2819	914 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 84	20 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 165	88 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 961	699 B
0	cloudfront.net Failed d31j93rd8oukbv.cloudfront.net Failed
113	16

	Domain	Requested by
28	pagead2.googlesyndication.com	www.zarplata.co.ua pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
20	www.zarplata.co.ua	www.zarplata.co.ua
15	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com pagead2.googlesyndication.com
11	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.zarplata.co.ua
10	cm.g.doubleclick.net	8 redirects googleads.g.doubleclick.net
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
6	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
6	ib.adnxs.com	4 redirects googleads.g.doubleclick.net
4	zarplata.co.ua	1 redirects www.zarplata.co.ua
3	s0.2mdn.net	googleads.g.doubleclick.net
3	www.googletagservices.com	googleads.g.doubleclick.net
2	www.facebook.com	1 redirects connect.facebook.net
2	sync.teads.tv	googleads.g.doubleclick.net
2	us-u.openx.net	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.co.uk	pagead2.googlesyndication.com
2	www.google-analytics.com	www.zarplata.co.ua www.google-analytics.com
2	connect.facebook.net	www.zarplata.co.ua connect.facebook.net
1	www.google.com	tpc.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
0	d31j93rd8oukbv.cloudfront.net Failed	www.zarplata.co.ua
113	21

This site contains links to these domains. Also see Links.

Domain
bank.gov.ua

Subject Issuer	Validity	Valid
*.g.doubleclick.net GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-09-05` - `2022-12-04`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google.co.uk GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
teads.tv R3	`2022-10-27` - `2023-01-25`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh

This page contains 15 frames:

Primary Page: http://www.zarplata.co.ua/
Frame ID: A773F0FF34BCB6AC5BC212A548BB7278
Requests: 42 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/zrt_lookup.html
Frame ID: 7F9ADB4EDCA07FF02389670F7A976D06
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&adk=1812271804&adf=3025194257&lmt=1669526331&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&ea=0&pra=5&wgl=1&dt=1669526331536&bpp=5&bdt=620&idt=321&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4164366462731&frm=20&pv=2&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=347
Frame ID: 86347F2DD65BE79D1D911105799F7F8B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=90&slotname=2532873631&adk=927460884&adf=3100205728&pi=t.ma~as.2532873631&w=728&lmt=1669526331&format=728x90&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331541&bpp=1&bdt=624&idt=349&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=277&ady=210&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=X1ba9AAbQ5&p=http%3A//www.zarplata.co.ua&dtd=355
Frame ID: 2A78DD8D5CE5315E9083BFEF605B0159
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=600&slotname=5097890431&adk=2307036630&adf=3430811229&pi=t.ma~as.5097890431&w=300&lmt=1669526331&format=300x600&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331545&bpp=1&bdt=629&idt=356&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=807&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=4&uci=a!4&fsb=1&xpc=HDLQBILWmB&p=http%3A//www.zarplata.co.ua&dtd=359
Frame ID: 043DA41BBBEBA5E6A937D836C5A48307
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNUfuERs0PpbaB5wNMrAmsr7k-JYcY2KEFeSitb4udDjdnsN8IV0dqQ_bp5RepZPdaOt85ihl3PwG91AJGkH-K8bJpdna0w6yfkZi8UEv_pj8y1wmtGcXRXFqJUDozNQBulekCsh7K8xCfNcgJbiILUsRQLEwGQPwq_Dx9TvpuZaLd0b4q0
Frame ID: CDCE80F46288BC3013E99A16CAFB4398
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNU9NcswY-i_fN8OiT3j7L1TFdOScLNUsguAyGlclZsl3cnpZQvBffHhi2UYtb5u_3uYz6vGFMIMMsKEAmwSODsfEFXC_idTNR_R3U-hq_k2M8cbq63j4pFft5K9qCkHqD5m8Q9Qof-xK67r1jYBcbSdeSDecTT3l6W52pmTrc7O_zE4LDg
Frame ID: 29B7A6DE0A7FAB56AE4991B4B18F5FC7
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Frame ID: 14B2DD8FC085057F7DCCB7709B7E490C
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNWovmmkHvbjigBi_lrhKEZI8lSYlBFqsLMgOX1_zuokDYmkvQZWOvzo31g5aa0iVgfpkW6W3DEAl_Wl_wbB3VB_QKHOLiDoFreG5TOKIp8n1Q5-RYUgCsJbu09YojMZYoGKeyWgjbR1iJ3sj60uyHYab2RnhEDk9tWyFeenGJ-ZC63AgP8
Frame ID: AE5C0FFFE5F65FD174F1528BC6EB5C61
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: F4AEBE93B3C9304E85813745E0806D33
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 6DADC0B86B50BCB1F420502344D5EF8D
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 43B0F56C063F77FFCB674D5282029347
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff2488b9f7249c%2526domain%253Dwww.zarplata.co.ua%2526is_canvas%253Dfalse%2526origin%253Dhttp%25253A%25252F%25252Fwww.zarplata.co.ua%25252Ff1d68e57205886%2526relation%253Dparent.parent%26container_width%3D300%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fzarobitna.plata%252F%26locale%3Dru_RU%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dtimeline%26width
Frame ID: 115A7A5D6CA116E0582C62362E157097
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 55FAFC8F1B7E316F744EF11D157AD695
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: CE111EA1FE96C96B5E6A3AC9DCA78403
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Заробітна плата

Page URL History Show full URLs

http://zarplata.co.ua/ HTTP 301
http://www.zarplata.co.ua/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

113
Requests

68 %
HTTPS

67 %
IPv6

16
Domains

21
Subdomains

19
IPs

4
Countries

1305 kB
Transfer

3536 kB
Size

11
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://bank.gov.ua/ua/news/all/natsionalniy-bank-vidkriv-spetsrahunok-dlya-zboru-koshtiv-na-potrebi-armiyi

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://zarplata.co.ua/ HTTP 301
http://www.zarplata.co.ua/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 43

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGKva0KcFxywvg4NeGmZJdk&google_cver=1

Request Chain 44

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4LzPE.F3AR9y2JlJKlzBQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2

Request Chain 45

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEMEw1M4nV2exq8rcRbihHsg&google_cver=1

Request Chain 46

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D

Request Chain 60

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1

Request Chain 61

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4LzPE.F3AR9y2JlJKlzBgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2

Request Chain 62

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDRAkug_B_yI7jw3LMgIy2k&google_cver=1

Request Chain 63

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D

Request Chain 84

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJhsN9WpzO_acnqOaQt_OHQ&google_cver=1

Request Chain 86

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESELaR4JizaPh2hRynyYzreqs&google_cver=1

Request Chain 99

https://www.facebook.com/v7.0/plugins/page.php?adapt_container_width=true&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dff2488b9f7249c%26domain%3Dwww.zarplata.co.ua%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Fwww.zarplata.co.ua%252Ff1d68e57205886%26relation%3Dparent.parent&container_width=300&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fzarobitna.plata%2F&locale=ru_RU&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width= HTTP 302
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff2488b9f7249c%2526domain%253Dwww.zarplata.co.ua%2526is_canvas%253Dfalse%2526origin%253Dhttp%25253A%25252F%25252Fwww.zarplata.co.ua%25252Ff1d68e57205886%2526relation%253Dparent.parent%26container_width%3D300%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fzarobitna.plata%252F%26locale%3Dru_RU%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dtimeline%26width

113 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.zarplata.co.ua/
Redirect Chain

http://zarplata.co.ua/
http://www.zarplata.co.ua/

546 KB
50 KB

533ms
388ms

Document
text/html

2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: e0521ba97e5480555c2cd91084db75dcec219911b2c4d23a4c771d2eaf0ba0a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sun, 27 Nov 2022 05:18:50 GMT
Link: <http://www.zarplata.co.ua/index.php?rest_route=/>; rel="https://api.w.org/"
Server: nginx
Transfer-Encoding: chunked
x-ray: p1053:0.310/wn21225:0.300/wa21225:D=301440

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sun, 27 Nov 2022 05:18:50 GMT
Location: http://www.zarplata.co.ua/
Server: nginx
X-Redirect-By: WordPress
x-ray: p1053:0.540/wn21225:0.530/wa21225:D=535642

GET
H/1.1 200
OK screen.css
www.zarplata.co.ua/wp-content/themes/zarplata/css/ 11 KB
3 KB 144ms
73ms Stylesheet
text/css 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/css/screen.css
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: fbba2bcc7c593e366ad34e8a5f752fd9077431c191e51dc23ed8784c38d8247d

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Tue, 03 Dec 2019 07:28:27 GMT
Server: nginx
ETag: W/"5de60e9b-2d8d"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK style.css
www.zarplata.co.ua/wp-content/themes/zarplata/ 10 KB
3 KB 152ms
77ms Stylesheet
text/css 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 60d47122b1a34d8f911c2e82f992ac471881594d657e6b88ee81481ceb720705

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Tue, 22 Mar 2022 05:30:48 GMT
Server: nginx
ETag: W/"62395f08-27ab"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK style.min.css
www.zarplata.co.ua/wp-includes/css/dist/block-library/ 81 KB
12 KB 154ms
79ms Stylesheet
text/css 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-includes/css/dist/block-library/style.min.css?ver=5.9.5
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Wed, 06 Apr 2022 07:20:13 GMT
Server: nginx
ETag: W/"624d3f2d-145db"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK front_end_style.css
www.zarplata.co.ua/wp-content/plugins/captcha/css/ 2 KB
2 KB 157ms
81ms Stylesheet
text/css 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-content/plugins/captcha/css/front_end_style.css?ver=4.4.5
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: c4cd126b21a4a71df6b2eb9210d37eca993c879b5fff2eb5808741c5b3069d03

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Wed, 13 Dec 2017 19:20:15 GMT
Server: nginx
ETag: "5a317d6f-724"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1828

GET
H/1.1 200
OK dashicons.min.css
www.zarplata.co.ua/wp-includes/css/ 58 KB
35 KB 155ms
79ms Stylesheet
text/css 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-includes/css/dashicons.min.css?ver=5.9.5
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Sat, 19 Mar 2022 07:29:55 GMT
Server: nginx
ETag: W/"62358673-e688"
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive

GET
H/1.1 200
OK desktop_style.css
www.zarplata.co.ua/wp-content/plugins/captcha/css/ 2 KB
2 KB 218ms
72ms Stylesheet
text/css 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-content/plugins/captcha/css/desktop_style.css?ver=4.4.5
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 7694092db9514c6643c47d692e5ac7bc1c924c3aa712c8ae4504a5cdd6cfb420

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Wed, 13 Dec 2017 19:20:15 GMT
Server: nginx
ETag: "5a317d6f-6d3"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1747

GET
H/1.1 200
OK jquery.min.js Show response
www.zarplata.co.ua/wp-includes/js/jquery/ 87 KB
31 KB 237ms
77ms Script
application/javascript 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.001/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Sat, 19 Mar 2022 07:29:55 GMT
Server: nginx
ETag: W/"62358673-15db1"
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK jquery-migrate.min.js Show response
www.zarplata.co.ua/wp-includes/js/jquery/ 11 KB
4 KB 236ms
76ms Script
application/javascript 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.011/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Sat, 19 Mar 2022 07:29:55 GMT
Server: nginx
ETag: W/"62358673-2bd8"
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK logo.png
zarplata.co.ua/wp-content/themes/zarplata/images/ 13 KB
13 KB 77ms
76ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zarplata.co.ua/wp-content/themes/zarplata/images/logo.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 8506505979ebe8ca52756ac41824ff956e25f90e6af724d8fd038f7576d9c9cc

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Sat, 12 Nov 2016 11:17:45 GMT
Server: nginx
ETag: "5826fa59-33b1"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13233

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
51 KB 109ms
64ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/

Protocol

HTTP/1.1

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3a9c079962ceaf1a02159487a57a5c6379df0567dc6742914ed489a1eaadaf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Length: 51901
X-XSS-Protection: 0
Server: cafe
ETag: 1850279754869915671
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=3600
Timing-Allow-Origin: *
Expires: Sun, 27 Nov 2022 05:18:51 GMT

GET
H/1.1 200
OK folder.png
www.zarplata.co.ua/wp-content/themes/zarplata/images/ 501 B
767 B 78ms
76ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/images/folder.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 4a1e5a63fae6dff3176fff767ab6a3617736fb3749ea97ec37dda6774490c98e

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Wed, 23 Apr 2014 13:14:26 GMT
Server: nginx
ETag: "5357bcb2-1f5"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 501

GET
H/1.1 200
OK comments.png
www.zarplata.co.ua/wp-content/themes/zarplata/images/ 2 KB
2 KB 78ms
76ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/images/comments.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 60c66f214f69fc809429b26102b2eab18214327382ea2508702b4e53a975507d

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Tue, 17 Dec 2013 09:31:41 GMT
Server: nginx
ETag: "52b019fd-605"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1541

GET
H/1.1 200
OK print.css
www.zarplata.co.ua/wp-content/themes/zarplata/css/ 1 KB
2 KB 76ms
76ms Stylesheet
text/css 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/css/print.css
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 07c45dc5395f6cd0d45f6bfa2674bad171ac1b1e5c9428dae975249b1ecf940d

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.001/wn21225:0.000/
Last-Modified: Tue, 17 Dec 2013 09:31:40 GMT
Server: nginx
ETag: "52b019fc-51f"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1311

GET
H/1.1 200
OK search.gif
www.zarplata.co.ua/wp-content/themes/zarplata/images/ 972 B
1 KB 78ms
76ms Image
image/gif 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/images/search.gif
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 3f1814518564a4817006cbbc23340939c4bde9104e8cd0c06c6914bdfc4bb7c8

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Tue, 17 Dec 2013 09:31:41 GMT
Server: nginx
ETag: "52b019fd-3cc"
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 972

GET
H/1.1 200
OK dopomoga.png
zarplata.co.ua/wp-content/themes/zarplata/images/ 2 KB
2 KB 144ms
72ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zarplata.co.ua/wp-content/themes/zarplata/images/dopomoga.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 2972577f55b5ffcea533c9732c1bd10accb12512870d74214b53469db8b84b0f

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Thu, 03 Mar 2022 06:55:02 GMT
Server: nginx
ETag: "62206646-7eb"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2027

GET
H/1.1 200
OK ua.png
zarplata.co.ua/wp-content/themes/zarplata/images/ 1 KB
2 KB 152ms
76ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://zarplata.co.ua/wp-content/themes/zarplata/images/ua.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 91af42200b22fcc1ab74bf28021efc28451536eba12e2856a3604c002ea4da9d

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Thu, 11 Sep 2014 05:22:42 GMT
Server: nginx
ETag: "541131a2-541"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1345

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
49 KB 169ms
71ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b32c78f8efa1f0a9f18f7f4925e8704d672b8b9c67e955367fe9f54650dfbf71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49239
x-xss-protection: 0
server: cafe
etag: 464801656202555258
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 27 Nov 2022 05:18:51 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/ru_RU/ 3 KB
2 KB 161ms
53ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/ru_RU/sdk.js

Requested by

Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

304ed07f9851d6485954ee24e5f98931a19cca21ed558f169712b8aa6fb13000

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://www.zarplata.co.ua/
Origin: http://www.zarplata.co.ua
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 27 Nov 2022 05:18:51 GMT
content-md5: E2KovW53cd0/uUu0RXnGRA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: n5tyOdic5VhsZ2bBPZXVXWOVwHK3RcO3Xa4l8pN03kk2PGPtqpKuTVXDKkywKl3szGx/AmRssNpSFd1aCUlW9A==
x-fb-trip-id: 917726464
x-fb-content-md5: 6b5a76f1e1cb60b23cf483228de16c49
cross-origin-opener-policy: same-origin-allow-popups
etag: "22c2aaf246d78068af0eb1576fe80d25"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 27 Nov 2022 05:36:32 GMT

GET
H/1.1 200
OK jquery.easing.js Show response
www.zarplata.co.ua/wp-content/plugins/dynamic-to-top/js/libs/ 4 KB
1 KB 76ms
76ms Script
application/javascript 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-content/plugins/dynamic-to-top/js/libs/jquery.easing.js?ver=1.3
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: ce64de193caea884bd4d4a7723933ab844506b7a62ec35c52911e72588c0e62f

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.001/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Fri, 22 Dec 2017 03:38:32 GMT
Server: nginx
ETag: W/"5a3c7e38-e5e"
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK dynamic.to.top.min.js Show response
www.zarplata.co.ua/wp-content/plugins/dynamic-to-top/js/ 1 KB
1 KB 76ms
76ms Script
application/javascript 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-content/plugins/dynamic-to-top/js/dynamic.to.top.min.js?ver=3.5
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: ec62de9c54033f0163588e9d274e822708dc8e6d11c0b62cdd6c6fb16331df6d

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Fri, 22 Dec 2017 03:38:32 GMT
Server: nginx
ETag: "5a3c7e38-4a8"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1192

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
www.zarplata.co.ua/wp-includes/js/ 18 KB
5 KB 77ms
76ms Script
application/javascript 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.zarplata.co.ua/wp-includes/js/wp-emoji-release.min.js?ver=5.9.5
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Content-Encoding: gzip
Last-Modified: Sat, 19 Mar 2022 07:29:55 GMT
Server: nginx
ETag: W/"62358673-4705"
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK pagenav-bg.png
www.zarplata.co.ua/wp-content/themes/zarplata/images/ 166 B
431 B 73ms
72ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/images/pagenav-bg.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: fca88c737f86d0b13a80127030497129417e6b9f2290272cc88da2f450ceda86

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Wed, 23 Apr 2014 14:02:38 GMT
Server: nginx
ETag: "5357c7fe-a6"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 166

GET
H/1.1 200
OK pagenav-hover.png
www.zarplata.co.ua/wp-content/themes/zarplata/images/ 265 B
531 B 99ms
76ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/images/pagenav-hover.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: f960374da81d06bb0b99e0f360eb9441066894f867e3d7e9a11e4808e258bebf

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Wed, 09 Nov 2016 18:53:58 GMT
Server: nginx
ETag: "582370c6-109"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 265

GET
H/1.1 200
OK bg-header.png
www.zarplata.co.ua/wp-content/themes/zarplata/images/ 69 KB
70 KB 77ms
77ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/images/bg-header.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 67efe2b88f4bd39d89cb48ad50c00a1e703c78e48e7ac86ba8593a2173f61e99

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.000/wn21225:0.000/
Last-Modified: Sat, 12 Nov 2016 09:53:14 GMT
Server: nginx
ETag: "5826e68a-11555"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 70997

GET
H/1.1 200
OK sidebar-line.png
www.zarplata.co.ua/wp-content/themes/zarplata/images/ 127 B
392 B 76ms
76ms Image
image/png 2a00:7a60:0:1055::1
UKRAINE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/images/sidebar-line.png
Requested by: Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
Protocol: HTTP/1.1
Server: 2a00:7a60:0:1055::1 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 1fd07881ff52c7fe5772035169fa9bd11f0db238c977b4be19ff36f964c45595

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/wp-content/themes/zarplata/style.css?=16
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 27 Nov 2022 05:18:51 GMT
x-ray: p1053:0.001/wn21225:0.000/
Last-Modified: Thu, 11 Sep 2014 07:12:19 GMT
Server: nginx
ETag: "54114b53-7f"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 127

GET
H2

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

49 KB
20 KB

146ms
43ms

Script
text/javascript

2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/

Protocol

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 27 Nov 2022 03:24:49 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 6842
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Sun, 27 Nov 2022 05:24:49 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET watch_ua.js
d31j93rd8oukbv.cloudfront.net/metrika/ 0
0

GET
H2 200 sdk.js Show response
connect.facebook.net/ru_RU/ 301 KB
85 KB 54ms
53ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/ru_RU/sdk.js?hash=bb362f4954058b0a47b73b3ebe38ca7d

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/ru_RU/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2453805ee1836744dceb53d68e7ba9c3f34badae017dd532cf18b81c3b85e087

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://www.zarplata.co.ua/
Origin: http://www.zarplata.co.ua
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 27 Nov 2022 05:18:51 GMT
content-md5: ZXZApzpvOshZYYv8Aa5/1A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87130
x-fb-rlafr: 0
x-fb-debug: HGm5gfsjBdQ/Vyqi6m4wbY3yS3j5+FnqL9/5y1n/LSDc5v27BbCq6QzomjUamRig7oddpkmYU/ZxUzc9d0kXPw==
x-fb-trip-id: 917726464
x-fb-content-md5: 01573128ca7baf71604f7599e6bb807e
cross-origin-opener-policy: same-origin-allow-popups
etag: "2ca77d7a3f460e7ca13d13ea3c66140f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:16:33 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/ 355 KB
117 KB 171ms
80ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5959581822882463&plah=www.zarplata.co.ua

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0de25efd930b02fd449159ebccd63c0bca2558b7812d8f66a7e24c7c79bb1d46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119606
x-xss-protection: 0
server: cafe
etag: 16635015327770973271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 27 Nov 2022 05:18:51 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/ Frame 7F9A 10 KB
5 KB 153ms
44ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 59901
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 12:40:30 GMT
etag: 10353107486223812946
expires: Sat, 10 Dec 2022 12:40:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 144ms
51ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1624312412&t=pageview&_s=1&dl=http%3A%2F%2Fwww.zarplata.co.ua%2F&ul=en-us&de=UTF-8&dt=%D0%97%D0%B0%D1%80%D0%BE%D0%B1%D1%96%D1%82%D0%BD%D0%B0%20%D0%BF%D0%BB%D0%B0%D1%82%D0%B0&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=309425127&gjid=706454193&cid=1339064746.1669526332&tid=UA-48706083-1&_gid=26476491.1669526332&_r=1&_slc=1&z=1763797157

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.zarplata.co.ua/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://www.zarplata.co.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 395 B
699 B 149ms
53ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.zarplata.co.ua&callback=_gfp_s_&client=ca-pub-5959581822882463&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5959581822882463&plah=www.zarplata.co.ua

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c3a4cab1452215e2b919b01a35053e875a544c17ec3e5b5de8035163daaf629c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 254
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
792 B 149ms
53ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=www.zarplata.co.ua

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 150ms
54ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zarplata.co.ua

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8634 25 KB
11 KB 423ms
333ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&adk=1812271804&adf=3025194257&lmt=1669526331&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&ea=0&pra=5&wgl=1&dt=1669526331536&bpp=5&bdt=620&idt=321&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4164366462731&frm=20&pv=2&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=347

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d68031ee75996d47232dbb267e2398813e26c7aea36a15931cb3ccfc281a6db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 11456
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Nov 2022 05:18:52 GMT
expires: Sun, 27 Nov 2022 05:18:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2A78 14 KB
8 KB 244ms
166ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=90&slotname=2532873631&adk=927460884&adf=3100205728&pi=t.ma~as.2532873631&w=728&lmt=1669526331&format=728x90&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331541&bpp=1&bdt=624&idt=349&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=277&ady=210&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=X1ba9AAbQ5&p=http%3A//www.zarplata.co.ua&dtd=355

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd23821665e155abd3b9a4fa293abc62715508d6e35e49fea5ac330b28df465

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 7776
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Nov 2022 05:18:52 GMT
expires: Sun, 27 Nov 2022 05:18:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 043D 14 KB
8 KB 387ms
317ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=600&slotname=5097890431&adk=2307036630&adf=3430811229&pi=t.ma~as.5097890431&w=300&lmt=1669526331&format=300x600&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331545&bpp=1&bdt=629&idt=356&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=807&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=4&uci=a!4&fsb=1&xpc=HDLQBILWmB&p=http%3A//www.zarplata.co.ua&dtd=359

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b43cfdf5ce34f3d6daea195e25442ad28f4e08b6512e731116d37d71c55f1377

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 7800
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Nov 2022 05:18:52 GMT
expires: Sun, 27 Nov 2022 05:18:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A78 42 B
63 B 80ms
79ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BwOeiKS9Auo5M_CMnqYnWwlbthNE753F4Mp2eJBMu4JgvYBT6wfA4nhXzVYCXJURLPaHfiw9oLv71J3wyqsVXB_aWekZLXbJLLlTv9a8UZc_meNzE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=90&slotname=2532873631&adk=927460884&adf=3100205728&pi=t.ma~as.2532873631&w=728&lmt=1669526331&format=728x90&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331541&bpp=1&bdt=624&idt=349&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=277&ady=210&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=X1ba9AAbQ5&p=http%3A//www.zarplata.co.ua&dtd=355

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 2A78 3 KB
1 KB 146ms
48ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 17:59:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40737
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 17:59:55 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 2A78 18 KB
8 KB 141ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 12:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 12:23:48 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2A78 154 KB
48 KB 153ms
55ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CDCE 624 B
246 B 55ms
54ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNUfuERs0PpbaB5wNMrAmsr7k-JYcY2KEFeSitb4udDjdnsN8IV0dqQ_bp5RepZPdaOt85ihl3PwG91AJGkH-K8bJpdna0w6yfkZi8UEv_pj8y1wmtGcXRXFqJUDozNQBulekCsh7K8xCfNcgJbiILUsRQLEwGQPwq_Dx9TvpuZaLd0b4q0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=90&slotname=2532873631&adk=927460884&adf=3100205728&pi=t.ma~as.2532873631&w=728&lmt=1669526331&format=728x90&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331541&bpp=1&bdt=624&idt=349&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=277&ady=210&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=X1ba9AAbQ5&p=http%3A//www.zarplata.co.ua&dtd=355
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Nov 2022 05:18:52 GMT
expires: Sun, 27 Nov 2022 05:18:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2A78 67 KB
32 KB 114ms
113ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A2CBkInfdKfknRy9BrBJ7D1e4ukKEwigiqIOhYjT936tB8uImSbOSXssEi3x8MRGJkgFMAGUPFSp4plOWnDyAuEuFNAg&cry=1&dbm_d=AKAmf-CiN7nqUvYtM3wQbNdNs4bkZ2p2JmN2eibWL2wsgg0M6Za3zbNtNt9Y4UlnYfQ0iLKx--_lh4sBfjQ8IWarNkKrrLyqJPQEyCBEkeTKhoqGdzaCKVbhKC0HydTc45jhZIRliS3beeOI8PMhbI0pb6tjYA1f5jraoleY9HxaXIgg9ssjMBzdERjvOyqG8sQyC0rdlG33x07D6k_HFfkWhwimLnUSWDyvn0lkUk8kbmPPZmJCcN6g4MvpCU0nqy7sRILE58VxQtQyqZyPBXcvnAtV9TkXOe9SfDGoN-stBPqdSnH4YxBcCnNx9eqoAKN-lPTc8Xu4FUf-SJzyXvygyLuSet_8r0iKZdTlurGt8AEn3ua_8wu9jrsvX-4Csjnh55yhrpSfpyLL87eZQRkYuTtajSiNhCi7gbKW1UoMuMlyFLs6ZlGu0z7CkbaIYNnAHsWwuS1OG7UiN3X9GsHpkFGS57zljj889iE1_dg4_HU7l_UJBXIl8fYtj9Pp1uoDby6NcA4OKaOO0MIFTGtlavkO-2Di8ldIP9dJWcqOC85QBaVl1uCKZG1qTJnxzW2Zz3N7MT6jk8pBQgp2p2WRMLTZ_3RfKXl9m4oAJBHLM6r4z3D5b34-R-P_EqAmYgRpkrhitrK2GGFuz7YOaTFzd3jodW5p9TrSyJKZbeUzgAmGvJ9p55UexB3NuYdYs3kU5lW0dMmLwPivtZgPUQ0OPs7WRKlLOXcl2JPn1r5u2gN07-nnk3F73KqsSxmCfSlzEIwPwWln0fz8prmqFWk2UtOyrQEdVzPGBh0g4gs0BNNeIq9JQfsqIagkZmgO9pHVOUernsI5Kj-gHnESJoCHanwh1pK-89AczTjvEhgvUz5OcMqYz48wwggrz3xPWbQ1fE5lq0_NEjahEXD2iQHE-9uqyA5CMUvHqVqxiKzLJnZ3vmxTeyYGWzHRTH2JXyxGpurOTmXnO1-rXxJ_uG6gkJhLb2QpWi1eZ_O1GF6XD9lMY0S-dOx0JuVJhYN6dgf--2Gu2jjiGEu_s9rZkRZ_aY1OfcNwjdz-pAHGtVH4IbBKHERBBfGWxtzmI4cMLUMXkueyyi0b10o7D3TvCvcvRaemUYEIiZ-BbPGma9SkLHFqDzPLLAqAEN7ALE1UuCbpPNXwi6A0Pe9QABIBkNzWXl_xq67a1HBm_ZJGIs-Vw3eShw2cCgHhn3zOgLR4NM2CeEQqX6KmlghS3mCMUsT3iz_0PLBRaj9qqSJNPzcxBcPsvhbmVIKAONzh0Ggb8AmgR3VTMcvhP2tuV4d-muakYhAto0jRpL9NkX2s35-2u7QNkSy2bI0k8aOHGOJ41FWJyYkjXEeLqRNP3pbONpwnktdXAr5flb0u9NywggzUKYpGWz8zg0R3gmvc_-w98wq_D2XdC8O1_GzIcC5dP1hcqne9dc2b1-jwNipfkoqCUcS87PRq6lXZ168kBzpklADH29lpvGmPAKQt_YVXAs2SIaXJFO_fnDMLH2mwleeNAAjnbQwt8T-2ggTvohDDvkebZRaGTyMr-IBn9P1MxbPOYs3cWpSiK71LvI9Gf9ZlZnjCSb1jgRvvEaMqAC09jmbilxNQcv_jYgwfaA9YzswczXBxCc92KMzMouSY6kAMdzKkJJTst_DunwVfK-MNM_3zaG1l-mkplNd0mU0BOCQSHv0AZC98KLFZG5Da4rbOXxGlq9JJDZiIEpt4uGMFu9ramLXBOYQZlv4bw8yY-5_4Uf3y7n3KYushWr7p9ZhjYsQDSWOmK6xdb8piFrHAiQrDghVlf9SgY6gE1NMx4VcOcBOK4Zoh2Jokye6IlZZJDiGQLur0LwAeclZknBrP4Ux_77GqKzjSI11mvunaeoWMXLAihn-jLEYm4puuDMpKU7l-bSOicN-ScS1mcdy_CnexVM_RqIUr_S-4C0pzU3l6XiN5FBHm2v8eTTupimAOInEFAFichUjY3X8eK7nRtrIwIRfeTgxQHe9Dxm7R8RyssweT1SGtGJWKNTotxZJlIcppPj3l87U_PcHt6EDBitx-GiOd0Osl2dpoQi5_5Eh2sk2QqmgTHArtY4s-Xb0lIOb2mzKGgYjS46azc_nRWVvg1BGr1UyK_DmyS6WMwbZk_ReVujC1DsV9CCv0pyfxZ1ICnaqasr3E4Z7Qr5T76CZiUmSMbc7t0tmYEZLVYCAXZ51JDMumZm_6uGDZSdpHmYuhJBAGyVvpYjN0YDjYjmFlzK9eWRq2l8BuICF_irzvXKM5m-1qSEX0J7b-zOyTm03nwXFPzTdMbMOlhF441nFRo_-eVm5poSi0ogHpUwfmFgS3-LAgXBx627fCiajISJ6wBb-Ja-HfS12vd1tj6EcoRNhN1qKlg-Rox76t5xqVlo_y21mLcedfutDm70tfx_1A8bmumpY7CZqrwKToLu9D2_Cv_b7FDo9uHKE5ULsRGGG3DaC-BJ234-PmYuOsEOeHke6zgcOKreUcSlFxjDIa_zF7YNcaA4k_aMeVonjGddoDyiLY2xVs1C-XyrkAuIG5koNWZJz2b9onCdzOS0bf0UtXijcMNhj2cnKXEc9Vm2v8K6ui65nGCiUcy1sSYhv8Q-Wn6USEesQNgAfOzf3i4gJF6VTIU9Sicf15rPJYsS2oe6YAHeuk-AQ0R50o5dxqZhg-poC58Ez5e6WLnPtAZa96ygUO9han4mQA2j4hEkWjyxpSbUdeaXQj7Q1w_80IhzTEpcEm6fFOfun6SDO8sNZAhmaBp7ACu_nYyLhH-DqGuclB8ZZF9hLJy7YZWubCgu9CRqxE8INgsz1PrzNF9JxxkvgPD-Za8zTXbgZNIEdLaYCM34Znt9my6ekB9Ih4N-iAXABdYWuHrdJxxP4IDDNZNq16DaLwgJeswN1Amg2wDmIpNSASEwCdt-aQqkTA8icpsKakH5j3ZgPWg-snzAXeoDHk2LZvqzxsWNWR6rcnVTa9mKFL7JQBJdj5B-Ml-UjgeV5GuoiPhILrzyBdiUHAhvjLxRNnMYmBklLXyxYBLQ0SVZGJHoLZO6TVi0Bg4oD0C07PIY-wAzvmm2OoHlbrOUzlnmO7jdWl_i84zacwX7V67BoadysDLgdwj_7FqGV5L-JWSA-dNrn6Y1b_qBqDYcvOG-yVMleCGEpHZioW62gG80hDPvvljrIRrPIPvhaZfEBqv4RuuXOHFwxeqkTpDSuH&cid=CAQSGwDq26N9QleHYaN2PjzAwgSiwUG7Rp-9pudUSBgBIBM&rfl=1%2Chttp%253A%252F%252Fwww.zarplata.co.ua%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d72dc6b2df6c67009634ddd8b536a85d8aa3062303090ce3c172f6c9094abf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=90&slotname=2532873631&adk=927460884&adf=3100205728&pi=t.ma~as.2532873631&w=728&lmt=1669526331&format=728x90&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331541&bpp=1&bdt=624&idt=349&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=277&ady=210&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=X1ba9AAbQ5&p=http%3A//www.zarplata.co.ua&dtd=355
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33122
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CDCE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGKva0KcFxywvg4NeGmZJdk&google_cver=1

43 B
766 B

80ms
44ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGKva0KcFxywvg4NeGmZJdk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNUfuERs0PpbaB5wNMrAmsr7k-JYcY2KEFeSitb4udDjdnsN8IV0dqQ_bp5RepZPdaOt85ihl3PwG91AJGkH-K8bJpdna0w6yfkZi8UEv_pj8y1wmtGcXRXFqJUDozNQBulekCsh7K8xCfNcgJbiILUsRQLEwGQPwq_Dx9TvpuZaLd0b4q0
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGKva0KcFxywvg4NeGmZJdk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CDCE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4LzPE.F3AR9y2JlJKlzBQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2

43 B
766 B

71ms
47ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNUfuERs0PpbaB5wNMrAmsr7k-JYcY2KEFeSitb4udDjdnsN8IV0dqQ_bp5RepZPdaOt85ihl3PwG91AJGkH-K8bJpdna0w6yfkZi8UEv_pj8y1wmtGcXRXFqJUDozNQBulekCsh7K8xCfNcgJbiILUsRQLEwGQPwq_Dx9TvpuZaLd0b4q0
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame CDCE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMEw1M4nV2exq8rcRbihHsg&google_cver=1

43 B
1021 B

137ms
47ms

Image
image/gif

37.252.171.85
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMEw1M4nV2exq8rcRbihHsg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNUfuERs0PpbaB5wNMrAmsr7k-JYcY2KEFeSitb4udDjdnsN8IV0dqQ_bp5RepZPdaOt85ihl3PwG91AJGkH-K8bJpdna0w6yfkZi8UEv_pj8y1wmtGcXRXFqJUDozNQBulekCsh7K8xCfNcgJbiILUsRQLEwGQPwq_Dx9TvpuZaLd0b4q0

Protocol

HTTP/1.1

Server

37.252.171.85 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
AN-X-Request-Uuid: c4edc8a7-ad06-48e6-b618-2bd26c0c1189
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 217.138.196.109; 217.138.196.109; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMEw1M4nV2exq8rcRbihHsg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CDCE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D

170 B
188 B

144ms
60ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
AN-X-Request-Uuid: ac37971f-05d9-4d21-b5ac-a837d5312379
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D
Connection: keep-alive
X-Proxy-Origin: 217.138.196.109; 217.138.196.109; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 043D 42 B
63 B 78ms
77ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D1JN_cEj-wWSuyTUrwumGVjykEVuuIlTEbWClC4aMJKqv6KbOPJoBpG0XLJ3lQkDEEXSBIhdBjOsYw4WFf30gQ4ge0E7kz2jaYX2aB6ain9jdpi4c

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=600&slotname=5097890431&adk=2307036630&adf=3430811229&pi=t.ma~as.5097890431&w=300&lmt=1669526331&format=300x600&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331545&bpp=1&bdt=629&idt=356&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=807&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=4&uci=a!4&fsb=1&xpc=HDLQBILWmB&p=http%3A//www.zarplata.co.ua&dtd=359

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 043D 3 KB
1 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 17:59:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40737
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 17:59:55 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 043D 18 KB
7 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 12:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 12:23:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 29B7 624 B
245 B 56ms
56ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNU9NcswY-i_fN8OiT3j7L1TFdOScLNUsguAyGlclZsl3cnpZQvBffHhi2UYtb5u_3uYz6vGFMIMMsKEAmwSODsfEFXC_idTNR_R3U-hq_k2M8cbq63j4pFft5K9qCkHqD5m8Q9Qof-xK67r1jYBcbSdeSDecTT3l6W52pmTrc7O_zE4LDg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=600&slotname=5097890431&adk=2307036630&adf=3430811229&pi=t.ma~as.5097890431&w=300&lmt=1669526331&format=300x600&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331545&bpp=1&bdt=629&idt=356&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=807&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=4&uci=a!4&fsb=1&xpc=HDLQBILWmB&p=http%3A//www.zarplata.co.ua&dtd=359
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Nov 2022 05:18:52 GMT
expires: Sun, 27 Nov 2022 05:18:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 043D 67 KB
32 KB 81ms
80ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DCFkW-1-icwNqird2rpfW1Y7JLtzyaGiEtOsUCwOA6B1wBsNQkV0PFWMHIFGMclRMJciXjpAE8HhHkinu3edu0k_AyGA&cry=1&dbm_d=AKAmf-BIfxx83DZSlrsjPnH_zGBIecn7AjVLYtFaqgxb_8JWUNrMvMYvECXKBd16hQnM0eOsFDe-wYBQYY5ugX8UvpFNHfcRpKFc2h1B4mKKvpEV2NPYHHucQtngHQh18L6y1kBZIjeuTbVQYERKgnvfyqal7KuwdawyP8X-jlS2kFwavz5lUi7LE9OxPaTtvpJRv4cg-otCDIuH9fN9X6tEPU_c9pbUQrfmVyp9sLecklhA1YSUFM7FUiJcCO4Jn865po5cXdXQ2o73bOYxU2PH0o3571txkAOsjmQFaxn6jjepkOcmsoJXYHbOcGDykp8IhP3SsEAXTl2VJQPrTMZbZ7IWUuk6MFoUYytQsgD3w-ewqBm01VUoqvBnG6tWUXdU07YmFYLQAlXB_f9K9dGoIr_7HyU_AyWhDDYV_FlApKWaaapT-APLmyXlcpvSE82Eb6R_mx66-8ifroAODaAyMeHOsB4bCaHj_jLeyO6fmRpXURjMeONYXUPZun0Wdo3aUsV2CbSiBvAI4tApkxY3Ub2bFj7lFKQvmWxZqr9JXM2M2dzNYvPdIRxWEYfn4EA0y6RJ-QNG2IvA_JiWTxc--5tz_8uj24BmPOUd-4d_tWjLcTEJxX2Nsqi8jpdD7hMhAfwu0rWon1EwQBXO3ra0w6Wo6gMGAYUZuKiGtAIE-n6wpGGqHqadx0lwvXH8LM0jRGLUIC5qXU0q8Sq3pP408HYKko1PpIRy01e2f87JWUyPascOZk22hHw4wb11MdQNMILOH2bsUr00dQA2YU1iKdZhmTaQCw70AppqeeNCe7_SlDdsAqsrcoV6Ziokol42oh5WDDerGUox9kMs4KMoBKBeI6TsoRJVC2iNb4Yhh-1aXWkUEa1B-8lRCdxtcCK2s8_gTdKYHq8QL89oO6e0LJBYi5i48NBJ7Rll6ONGLfFQwBkx0MFhMoKCwVy-cYQII5GkiyMhIQAWAErOxSUeNWlhiCUAGh5c4j4uqJfrEFvzR5xJCMwjUOPxv5rPwWZcmtZkhHmrXdB-AjEWyDk0GYGF5aHjVMaXdqMSiu1ypMyfmsilAjf0uJWJx30OD4Bid-32Eb3Dm5xV_V46zzjri7tO6LjwWXE78pOy5dfClXtrA2T_ViLDSElBhpHnJOkVryETiWpzses3HSF3VXnEIuJvMD-r65Kb3d_6ny9tgVmFxTCD0WjajCCFWwL_lDgt-2eQenr4K0fmo97lNGVUy2K2Lt-KUo6XXkP_rGxDzbj4cvB7bDh2-gwNZN369Me69MpYT97zAWr1OkDWEFL1J8uFUwmMPidsc-t_k6-zoc8OIIdgN-a7GS-CJCC4GKfOScgPadluOzgp1ZywDeshO4c_MCC6Rp8mWJ8I0J0GMbB-O-75sQ2Xg481gz4xsD5kpalE3Y18OfVs0HlHRqHvcTTe7LC5_g5Y46lvKwJPzEnnssA7emSnqJ2rMZo3_vzoCnj1mS_Y5sJGQGFLzmEOhMkTPcXX67Jr9seNXoOmV-W8GIn5dlWjVygDx_2x7W0ToYrWYnufVZI0YCUQJK7vUU0QkvMYHZXk-xPlY0vLUEYQA_kWlmd3YOEtMdob2lj7zBqbqE2vwRXUy-cT2DzMFRQewqZpHRy2y6rPHJt349NJqHqNFm6WPSiWZ0ZleOH4Uy6MOkINfXCGyxZ-iGKnNR4T2qF_Jl_zben9OKjhehXC0D0JfhFBHgaCo9EUq7oOjHHNOta_O7ODtNCgiKBjOE_z38aiy-uxjgCFiOj5XhdHmi3EyrN70PXPubjmhNoaQn-Hwi-5R3aRa0gHzAUFLzDh027EPyuFrdpFETKg_QKFEjNr89WjxFJZL3E2xYYSOuNIFjStQwqGqfVKE069GhaL9bOqIBFGs_OfC9ShrUY8bflNjywvaIyVzDVNs1_A6lWvVDBG2ac6RIM-LdUvmsOyxHxXt9UTq9uTlJRDb89cGEfiB0GSDk_plqfW3fdMclBJhS1vIN7X3dR2lkNCS9R3gdkvBGd_ex30h-NEPSRYhUaS0gBNfntiKduTZaXvG8X2S5mijhuG7LOPbmzaJUDoEynYbNtS5zYZMqCSBI8u-r-jF2DbCrZ3gEQ8uA5Zq5BEiwRntMVuS_4kzcgnsosTvC39u7NM7CRkJ0JPGYSEHbvuzDO9LLNJHWNwNk46jpKRJqK_fCpkXJyeATyxcsfUpstY3qKRnIbrsVcart4kQg_EY3sdHk3AHfiB0WrG9gjIAq_uyGujdC0FyUqO_UqAZbZQ8x-Js6Xe5tYSssiJZdzXFGPFlIUlQp-1SIKha8DCfUjFysKC1iNcCA3N5zvBHK_vBJUtolknGNjUpXY3m1rGVk3rfFzesZWaDA9QV972bckZQNYL16N9t4Q4sFIBGUQ51Y3bAS1EA91hKgsDwx4GhoqaMMbyrI6yD_Bwrx5eXQ3tCaOKh3ABcWVUHY-cu-ExDtNAoHQP12nSJGaFph8Q_Rj-FdhVMovjES4S_nqV_e0olI4Hj9vv6PQX1XqKT_ipkNY_z9h5YxcrJONnV1jN40up59OyySKfSIl5iTeBe1z7dJ4JSyVtXBoKtEuuUpftb70r8fv-ZzClb6WRDz54fXrJcE5Gy6nmnRPGZRV3kkbNucxkTLxoMwlVhXHYe7f00T4v7T06RyHNoXGhIwW6Pj1besuG388qS1fYteZ0FLSN2itTi2ivKo-eeg8ZMZVPnl8PYVqrQ0TokJ3nnysJlTAnNaEOmCoBg4Fkp-UHdmtew3DB3M2qYSSKlb0XW6I1w_hgmm1Mr9TshtsqKjMKzASq9hyIeL_JnStcJFHE6O2yr0YHx6tZqIh-CGarGR0aVJz8kJLHxKTq_12K51Jej1pdd8k2LuLEm2Q0fh1uLP6uwr0wWBBZ0wbnklMYLTv-1Q-3ohetKOI1KxOCXxbcqpzOGCKQatWEv5LY2ndRCC6OrPJLOPk3_KGbbsl-WqT9ttEPfmgvNofNpHkvgZkaEAZED2hUQ0RsmaB9SNCN9uNWf7Zj5eB1hg6wCAL8zuXXaiwShC7RowdrgB3olVQ_zJrwLEc4u7FiODeLtZkIlCefwAtJRyiQ0tmFNV16qtnsxOG2M8yV9K11H8WffbVT_9NmnWWTtAo75B_VPkU8nJp2dhXiLIvwDM3l4UbC5rPLx0Ip_yQBJzobqHK5uvZCZ_D-_xs5UBrUKKHgr-CR6LCdKarwrQNjGeYAY3xoSKEp_A&cid=CAQSGwDq26N95cJQTT8XC-AMzvwxCwjWRP69HygPbxgBIBM&rfl=1%2Chttp%253A%252F%252Fwww.zarplata.co.ua%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c0d210973ef664ad56411aaa13fb0082d986564a70b0945fd6b9e376651c4a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5959581822882463&output=html&h=600&slotname=5097890431&adk=2307036630&adf=3430811229&pi=t.ma~as.5097890431&w=300&lmt=1669526331&format=300x600&url=http%3A%2F%2Fwww.zarplata.co.ua%2F&wgl=1&dt=1669526331545&bpp=1&bdt=629&idt=356&shv=r20221110&mjsv=m202211100101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=4164366462731&frm=20&pv=1&ga_vid=1339064746.1669526332&ga_sid=1669526332&ga_hid=1624312412&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=807&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949&oid=2&pvsid=4103470979128758&tmod=704182209&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=4&uci=a!4&fsb=1&xpc=HDLQBILWmB&p=http%3A//www.zarplata.co.ua&dtd=359
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32812
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 043D 154 KB
47 KB 83ms
83ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/ 150 KB
51 KB 67ms
67ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

750abf47367b9997bc860b7bc559dff05eebe900ebf78a8b33d3b43a782ffd71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52295
x-xss-protection: 0
server: cafe
etag: 1948403487213539985
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 79ms
78ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pm&rt=1&c=ca-pub-5959581822882463&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949

Requested by

Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 2A78 29 KB
11 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A2CBkInfdKfknRy9BrBJ7D1e4ukKEwigiqIOhYjT936tB8uImSbOSXssEi3x8MRGJkgFMAGUPFSp4plOWnDyAuEuFNAg&cry=1&dbm_d=AKAmf-CiN7nqUvYtM3wQbNdNs4bkZ2p2JmN2eibWL2wsgg0M6Za3zbNtNt9Y4UlnYfQ0iLKx--_lh4sBfjQ8IWarNkKrrLyqJPQEyCBEkeTKhoqGdzaCKVbhKC0HydTc45jhZIRliS3beeOI8PMhbI0pb6tjYA1f5jraoleY9HxaXIgg9ssjMBzdERjvOyqG8sQyC0rdlG33x07D6k_HFfkWhwimLnUSWDyvn0lkUk8kbmPPZmJCcN6g4MvpCU0nqy7sRILE58VxQtQyqZyPBXcvnAtV9TkXOe9SfDGoN-stBPqdSnH4YxBcCnNx9eqoAKN-lPTc8Xu4FUf-SJzyXvygyLuSet_8r0iKZdTlurGt8AEn3ua_8wu9jrsvX-4Csjnh55yhrpSfpyLL87eZQRkYuTtajSiNhCi7gbKW1UoMuMlyFLs6ZlGu0z7CkbaIYNnAHsWwuS1OG7UiN3X9GsHpkFGS57zljj889iE1_dg4_HU7l_UJBXIl8fYtj9Pp1uoDby6NcA4OKaOO0MIFTGtlavkO-2Di8ldIP9dJWcqOC85QBaVl1uCKZG1qTJnxzW2Zz3N7MT6jk8pBQgp2p2WRMLTZ_3RfKXl9m4oAJBHLM6r4z3D5b34-R-P_EqAmYgRpkrhitrK2GGFuz7YOaTFzd3jodW5p9TrSyJKZbeUzgAmGvJ9p55UexB3NuYdYs3kU5lW0dMmLwPivtZgPUQ0OPs7WRKlLOXcl2JPn1r5u2gN07-nnk3F73KqsSxmCfSlzEIwPwWln0fz8prmqFWk2UtOyrQEdVzPGBh0g4gs0BNNeIq9JQfsqIagkZmgO9pHVOUernsI5Kj-gHnESJoCHanwh1pK-89AczTjvEhgvUz5OcMqYz48wwggrz3xPWbQ1fE5lq0_NEjahEXD2iQHE-9uqyA5CMUvHqVqxiKzLJnZ3vmxTeyYGWzHRTH2JXyxGpurOTmXnO1-rXxJ_uG6gkJhLb2QpWi1eZ_O1GF6XD9lMY0S-dOx0JuVJhYN6dgf--2Gu2jjiGEu_s9rZkRZ_aY1OfcNwjdz-pAHGtVH4IbBKHERBBfGWxtzmI4cMLUMXkueyyi0b10o7D3TvCvcvRaemUYEIiZ-BbPGma9SkLHFqDzPLLAqAEN7ALE1UuCbpPNXwi6A0Pe9QABIBkNzWXl_xq67a1HBm_ZJGIs-Vw3eShw2cCgHhn3zOgLR4NM2CeEQqX6KmlghS3mCMUsT3iz_0PLBRaj9qqSJNPzcxBcPsvhbmVIKAONzh0Ggb8AmgR3VTMcvhP2tuV4d-muakYhAto0jRpL9NkX2s35-2u7QNkSy2bI0k8aOHGOJ41FWJyYkjXEeLqRNP3pbONpwnktdXAr5flb0u9NywggzUKYpGWz8zg0R3gmvc_-w98wq_D2XdC8O1_GzIcC5dP1hcqne9dc2b1-jwNipfkoqCUcS87PRq6lXZ168kBzpklADH29lpvGmPAKQt_YVXAs2SIaXJFO_fnDMLH2mwleeNAAjnbQwt8T-2ggTvohDDvkebZRaGTyMr-IBn9P1MxbPOYs3cWpSiK71LvI9Gf9ZlZnjCSb1jgRvvEaMqAC09jmbilxNQcv_jYgwfaA9YzswczXBxCc92KMzMouSY6kAMdzKkJJTst_DunwVfK-MNM_3zaG1l-mkplNd0mU0BOCQSHv0AZC98KLFZG5Da4rbOXxGlq9JJDZiIEpt4uGMFu9ramLXBOYQZlv4bw8yY-5_4Uf3y7n3KYushWr7p9ZhjYsQDSWOmK6xdb8piFrHAiQrDghVlf9SgY6gE1NMx4VcOcBOK4Zoh2Jokye6IlZZJDiGQLur0LwAeclZknBrP4Ux_77GqKzjSI11mvunaeoWMXLAihn-jLEYm4puuDMpKU7l-bSOicN-ScS1mcdy_CnexVM_RqIUr_S-4C0pzU3l6XiN5FBHm2v8eTTupimAOInEFAFichUjY3X8eK7nRtrIwIRfeTgxQHe9Dxm7R8RyssweT1SGtGJWKNTotxZJlIcppPj3l87U_PcHt6EDBitx-GiOd0Osl2dpoQi5_5Eh2sk2QqmgTHArtY4s-Xb0lIOb2mzKGgYjS46azc_nRWVvg1BGr1UyK_DmyS6WMwbZk_ReVujC1DsV9CCv0pyfxZ1ICnaqasr3E4Z7Qr5T76CZiUmSMbc7t0tmYEZLVYCAXZ51JDMumZm_6uGDZSdpHmYuhJBAGyVvpYjN0YDjYjmFlzK9eWRq2l8BuICF_irzvXKM5m-1qSEX0J7b-zOyTm03nwXFPzTdMbMOlhF441nFRo_-eVm5poSi0ogHpUwfmFgS3-LAgXBx627fCiajISJ6wBb-Ja-HfS12vd1tj6EcoRNhN1qKlg-Rox76t5xqVlo_y21mLcedfutDm70tfx_1A8bmumpY7CZqrwKToLu9D2_Cv_b7FDo9uHKE5ULsRGGG3DaC-BJ234-PmYuOsEOeHke6zgcOKreUcSlFxjDIa_zF7YNcaA4k_aMeVonjGddoDyiLY2xVs1C-XyrkAuIG5koNWZJz2b9onCdzOS0bf0UtXijcMNhj2cnKXEc9Vm2v8K6ui65nGCiUcy1sSYhv8Q-Wn6USEesQNgAfOzf3i4gJF6VTIU9Sicf15rPJYsS2oe6YAHeuk-AQ0R50o5dxqZhg-poC58Ez5e6WLnPtAZa96ygUO9han4mQA2j4hEkWjyxpSbUdeaXQj7Q1w_80IhzTEpcEm6fFOfun6SDO8sNZAhmaBp7ACu_nYyLhH-DqGuclB8ZZF9hLJy7YZWubCgu9CRqxE8INgsz1PrzNF9JxxkvgPD-Za8zTXbgZNIEdLaYCM34Znt9my6ekB9Ih4N-iAXABdYWuHrdJxxP4IDDNZNq16DaLwgJeswN1Amg2wDmIpNSASEwCdt-aQqkTA8icpsKakH5j3ZgPWg-snzAXeoDHk2LZvqzxsWNWR6rcnVTa9mKFL7JQBJdj5B-Ml-UjgeV5GuoiPhILrzyBdiUHAhvjLxRNnMYmBklLXyxYBLQ0SVZGJHoLZO6TVi0Bg4oD0C07PIY-wAzvmm2OoHlbrOUzlnmO7jdWl_i84zacwX7V67BoadysDLgdwj_7FqGV5L-JWSA-dNrn6Y1b_qBqDYcvOG-yVMleCGEpHZioW62gG80hDPvvljrIRrPIPvhaZfEBqv4RuuXOHFwxeqkTpDSuH&cid=CAQSGwDq26N9QleHYaN2PjzAwgSiwUG7Rp-9pudUSBgBIBM&rfl=1%2Chttp%253A%252F%252Fwww.zarplata.co.ua%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 16:51:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44861
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 16:51:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame 2A78 8 KB
3 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 11:55:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 11:55:20 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2A78 0
0 189ms
91ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu_cOFUirgqO01J9FCEfk2hHGfJl9Kw82Fru1aEO4MUQlBrTnBKiXSQ15hz8kFiyK2VTg3f5OD-Qm2LJiFbDibETtdCtNigvg7UJBMVoNasq7YdUy4UVsDMTEwWIEbreI4_qbxgvP-OWTWMQt0vIMxMdENzPYXePSm8RofGa_zEyzlMN4W_tDOavyhzCMBgoTXNRq13o7Om1RJtEG1_wg8peUgt127cNDMGuqY5q4D_j9UCIc5v1WoFkbYSyHPsZYEF9SczvIrSKixZj78XVZF4vYJNsxdwyCwlt1USvHye_tXCxHioxxUba_Xkx3wdvECAVYyzepxkKXjfRuNAMaE5-KJruraB2c9sxuOqfVZ38h_-aK3ujyHL8h7Cp58JuBW28KFPi0m67Frr5yIB4FbvC-aHUGFz_4xkR2fwTY62-DM89RikIIwTeeSt1SzIGG8lVZGASLo75IOE5jFg6x53gQX9A3lsU4sCEAqat0nVOX6xLMSZN4c_zYyfP-Eux_n0dLFvWdRNbrO7nirTSiQOpSzU5SezXuiSry8A4X25kunSb5EujMI4ULryQafl-fCYl0MFQTz3P_JkLBExqFYDLJ0t5TdVGuzehBkQAFfLLAXbOdthP86U1AM19plstuq_KtVdEQ76kYfuUpRRgkekEuEtbN8ddrhsoU5gVhtqPZ6J67gr6ck266N1YLz4AkUse1c1LOCueB9Qh-3tWk24YmpNnOZD0qpFo6AXexXvZOMJdnwtAg63msXD96x3woDUYsTAq94EndFne1AQ2MPnvyDtRi3ZqCD2ScwGQPkq_pb9aDNy22ai8rJ-0mZ6flot48vO6rF3QNsQHNFrLlrINH0XMkE0M2wzVVevrwEHQ4H9QCFXw3AXjNBKkxix6S24yX-yT2n3RwLbrsebChDd5HX-9nyqar2tyBIwdW4UJpMIy2JNCIKA_itaynqhaLGwc_PB1LQSdj6u5vyLR3VnDLCsjlpRVOTd7vuIcHrJJT664GIW3GdGWNzBgQmJrlgC8qlLATN-zpykBCzyCcCMazu7asgmM1KcvMAff9bHVpkWI4yVA95Rb-34MFqOWdiVqWb1WklnNjhomXSbOaz25BG49qH8QxzXRvjePk1dBKLxJiWKWATYQWQ5Up1wcEmn5iEDNrhVWTAGW2pivb4gWkKMmw95PexBgENpNSLZZa8D_7r6fzBN&sai=AMfl-YTQvA2Spcr2sp-sJdoez66bCSvCk3rle5i_V6troUGulR7cby-3ls5966nlHrYrUUgJCqDijrtBL7zJb04pqxZphKrQ855GkqJekDvkHje3aZW7po2na5aoSevAfiMui9f9PYmyKHXtg1q_EAv-YEcLNAMf6HO330mvTD9l3uXII7t9qP1w2W3Xfg&sig=Cg0ArKJSzBGa-6gyRUOwEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221110.62503&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2A78 41 KB
15 KB 136ms
46ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 23:12:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108391
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 Nov 2023 23:12:21 GMT

GET
H2 200 10770626425131159775
s0.2mdn.net/simgad/ Frame 2A78 46 KB
46 KB 141ms
46ms Image
image/gif 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10770626425131159775

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a557c40ebf092ba76950ab7044ebbab32bbf485afc8c6507cae5b93945d00718

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 18:23:27 GMT
x-content-type-options: nosniff
age: 39325
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46656
x-xss-protection: 0
last-modified: Wed, 07 Sep 2022 13:13:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 18:23:27 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 29B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1

43 B
766 B

85ms
43ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNU9NcswY-i_fN8OiT3j7L1TFdOScLNUsguAyGlclZsl3cnpZQvBffHhi2UYtb5u_3uYz6vGFMIMMsKEAmwSODsfEFXC_idTNR_R3U-hq_k2M8cbq63j4pFft5K9qCkHqD5m8Q9Qof-xK67r1jYBcbSdeSDecTT3l6W52pmTrc7O_zE4LDg
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 29B7
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4LzPE.F3AR9y2JlJKlzBgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2

43 B
894 B

67ms
47ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNU9NcswY-i_fN8OiT3j7L1TFdOScLNUsguAyGlclZsl3cnpZQvBffHhi2UYtb5u_3uYz6vGFMIMMsKEAmwSODsfEFXC_idTNR_R3U-hq_k2M8cbq63j4pFft5K9qCkHqD5m8Q9Qof-xK67r1jYBcbSdeSDecTT3l6W52pmTrc7O_zE4LDg
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAJtqTBjX8G7-G-uCfdI0CE&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 29B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDRAkug_B_yI7jw3LMgIy2k&google_cver=1

43 B
1021 B

129ms
46ms

Image
image/gif

37.252.171.85
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDRAkug_B_yI7jw3LMgIy2k&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNU9NcswY-i_fN8OiT3j7L1TFdOScLNUsguAyGlclZsl3cnpZQvBffHhi2UYtb5u_3uYz6vGFMIMMsKEAmwSODsfEFXC_idTNR_R3U-hq_k2M8cbq63j4pFft5K9qCkHqD5m8Q9Qof-xK67r1jYBcbSdeSDecTT3l6W52pmTrc7O_zE4LDg

Protocol

HTTP/1.1

Server

37.252.171.85 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
AN-X-Request-Uuid: a92118ca-0d2b-42c5-b4bf-07a3577bc6d4
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 217.138.196.109; 217.138.196.109; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDRAkug_B_yI7jw3LMgIy2k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 29B7
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D

170 B
188 B

100ms
57ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 27 Nov 2022 05:18:52 GMT
AN-X-Request-Uuid: 5f1ab031-517b-427f-9435-7d36c186cc89
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTIxMDc3MDg0NDQzODU3NzU3OA%3D%3D
Connection: keep-alive
X-Proxy-Origin: 217.138.196.109; 217.138.196.109; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 2A78 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b680dc294467de91ef84a91cf380e67e9fc69b8b2a5baa6991c9cdec466c53d

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 043D 29 KB
11 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DCFkW-1-icwNqird2rpfW1Y7JLtzyaGiEtOsUCwOA6B1wBsNQkV0PFWMHIFGMclRMJciXjpAE8HhHkinu3edu0k_AyGA&cry=1&dbm_d=AKAmf-BIfxx83DZSlrsjPnH_zGBIecn7AjVLYtFaqgxb_8JWUNrMvMYvECXKBd16hQnM0eOsFDe-wYBQYY5ugX8UvpFNHfcRpKFc2h1B4mKKvpEV2NPYHHucQtngHQh18L6y1kBZIjeuTbVQYERKgnvfyqal7KuwdawyP8X-jlS2kFwavz5lUi7LE9OxPaTtvpJRv4cg-otCDIuH9fN9X6tEPU_c9pbUQrfmVyp9sLecklhA1YSUFM7FUiJcCO4Jn865po5cXdXQ2o73bOYxU2PH0o3571txkAOsjmQFaxn6jjepkOcmsoJXYHbOcGDykp8IhP3SsEAXTl2VJQPrTMZbZ7IWUuk6MFoUYytQsgD3w-ewqBm01VUoqvBnG6tWUXdU07YmFYLQAlXB_f9K9dGoIr_7HyU_AyWhDDYV_FlApKWaaapT-APLmyXlcpvSE82Eb6R_mx66-8ifroAODaAyMeHOsB4bCaHj_jLeyO6fmRpXURjMeONYXUPZun0Wdo3aUsV2CbSiBvAI4tApkxY3Ub2bFj7lFKQvmWxZqr9JXM2M2dzNYvPdIRxWEYfn4EA0y6RJ-QNG2IvA_JiWTxc--5tz_8uj24BmPOUd-4d_tWjLcTEJxX2Nsqi8jpdD7hMhAfwu0rWon1EwQBXO3ra0w6Wo6gMGAYUZuKiGtAIE-n6wpGGqHqadx0lwvXH8LM0jRGLUIC5qXU0q8Sq3pP408HYKko1PpIRy01e2f87JWUyPascOZk22hHw4wb11MdQNMILOH2bsUr00dQA2YU1iKdZhmTaQCw70AppqeeNCe7_SlDdsAqsrcoV6Ziokol42oh5WDDerGUox9kMs4KMoBKBeI6TsoRJVC2iNb4Yhh-1aXWkUEa1B-8lRCdxtcCK2s8_gTdKYHq8QL89oO6e0LJBYi5i48NBJ7Rll6ONGLfFQwBkx0MFhMoKCwVy-cYQII5GkiyMhIQAWAErOxSUeNWlhiCUAGh5c4j4uqJfrEFvzR5xJCMwjUOPxv5rPwWZcmtZkhHmrXdB-AjEWyDk0GYGF5aHjVMaXdqMSiu1ypMyfmsilAjf0uJWJx30OD4Bid-32Eb3Dm5xV_V46zzjri7tO6LjwWXE78pOy5dfClXtrA2T_ViLDSElBhpHnJOkVryETiWpzses3HSF3VXnEIuJvMD-r65Kb3d_6ny9tgVmFxTCD0WjajCCFWwL_lDgt-2eQenr4K0fmo97lNGVUy2K2Lt-KUo6XXkP_rGxDzbj4cvB7bDh2-gwNZN369Me69MpYT97zAWr1OkDWEFL1J8uFUwmMPidsc-t_k6-zoc8OIIdgN-a7GS-CJCC4GKfOScgPadluOzgp1ZywDeshO4c_MCC6Rp8mWJ8I0J0GMbB-O-75sQ2Xg481gz4xsD5kpalE3Y18OfVs0HlHRqHvcTTe7LC5_g5Y46lvKwJPzEnnssA7emSnqJ2rMZo3_vzoCnj1mS_Y5sJGQGFLzmEOhMkTPcXX67Jr9seNXoOmV-W8GIn5dlWjVygDx_2x7W0ToYrWYnufVZI0YCUQJK7vUU0QkvMYHZXk-xPlY0vLUEYQA_kWlmd3YOEtMdob2lj7zBqbqE2vwRXUy-cT2DzMFRQewqZpHRy2y6rPHJt349NJqHqNFm6WPSiWZ0ZleOH4Uy6MOkINfXCGyxZ-iGKnNR4T2qF_Jl_zben9OKjhehXC0D0JfhFBHgaCo9EUq7oOjHHNOta_O7ODtNCgiKBjOE_z38aiy-uxjgCFiOj5XhdHmi3EyrN70PXPubjmhNoaQn-Hwi-5R3aRa0gHzAUFLzDh027EPyuFrdpFETKg_QKFEjNr89WjxFJZL3E2xYYSOuNIFjStQwqGqfVKE069GhaL9bOqIBFGs_OfC9ShrUY8bflNjywvaIyVzDVNs1_A6lWvVDBG2ac6RIM-LdUvmsOyxHxXt9UTq9uTlJRDb89cGEfiB0GSDk_plqfW3fdMclBJhS1vIN7X3dR2lkNCS9R3gdkvBGd_ex30h-NEPSRYhUaS0gBNfntiKduTZaXvG8X2S5mijhuG7LOPbmzaJUDoEynYbNtS5zYZMqCSBI8u-r-jF2DbCrZ3gEQ8uA5Zq5BEiwRntMVuS_4kzcgnsosTvC39u7NM7CRkJ0JPGYSEHbvuzDO9LLNJHWNwNk46jpKRJqK_fCpkXJyeATyxcsfUpstY3qKRnIbrsVcart4kQg_EY3sdHk3AHfiB0WrG9gjIAq_uyGujdC0FyUqO_UqAZbZQ8x-Js6Xe5tYSssiJZdzXFGPFlIUlQp-1SIKha8DCfUjFysKC1iNcCA3N5zvBHK_vBJUtolknGNjUpXY3m1rGVk3rfFzesZWaDA9QV972bckZQNYL16N9t4Q4sFIBGUQ51Y3bAS1EA91hKgsDwx4GhoqaMMbyrI6yD_Bwrx5eXQ3tCaOKh3ABcWVUHY-cu-ExDtNAoHQP12nSJGaFph8Q_Rj-FdhVMovjES4S_nqV_e0olI4Hj9vv6PQX1XqKT_ipkNY_z9h5YxcrJONnV1jN40up59OyySKfSIl5iTeBe1z7dJ4JSyVtXBoKtEuuUpftb70r8fv-ZzClb6WRDz54fXrJcE5Gy6nmnRPGZRV3kkbNucxkTLxoMwlVhXHYe7f00T4v7T06RyHNoXGhIwW6Pj1besuG388qS1fYteZ0FLSN2itTi2ivKo-eeg8ZMZVPnl8PYVqrQ0TokJ3nnysJlTAnNaEOmCoBg4Fkp-UHdmtew3DB3M2qYSSKlb0XW6I1w_hgmm1Mr9TshtsqKjMKzASq9hyIeL_JnStcJFHE6O2yr0YHx6tZqIh-CGarGR0aVJz8kJLHxKTq_12K51Jej1pdd8k2LuLEm2Q0fh1uLP6uwr0wWBBZ0wbnklMYLTv-1Q-3ohetKOI1KxOCXxbcqpzOGCKQatWEv5LY2ndRCC6OrPJLOPk3_KGbbsl-WqT9ttEPfmgvNofNpHkvgZkaEAZED2hUQ0RsmaB9SNCN9uNWf7Zj5eB1hg6wCAL8zuXXaiwShC7RowdrgB3olVQ_zJrwLEc4u7FiODeLtZkIlCefwAtJRyiQ0tmFNV16qtnsxOG2M8yV9K11H8WffbVT_9NmnWWTtAo75B_VPkU8nJp2dhXiLIvwDM3l4UbC5rPLx0Ip_yQBJzobqHK5uvZCZ_D-_xs5UBrUKKHgr-CR6LCdKarwrQNjGeYAY3xoSKEp_A&cid=CAQSGwDq26N95cJQTT8XC-AMzvwxCwjWRP69HygPbxgBIBM&rfl=1%2Chttp%253A%252F%252Fwww.zarplata.co.ua%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 16:51:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44861
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 16:51:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame 043D 8 KB
3 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 11:55:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 11:55:20 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 043D 0
0 104ms
89ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstEnYn5vnjClwcH_QzYI8_3vimYW89ImzphLKHFsF3PEccQ1KG8tJ7ULGxp-QzkILLlDVn6SmLk3OERPR80EWOhCp_krh-0o_anWdFkZq-yrZc519CoXA78U6A0EPtsZ6Q26qZVIXe2v4d0fqC3ifjgXZDv5qctZ3DYEApFYwabZ0trkKrdAAvutGevldkVywvoAcHU1EBu7P-rCVc9DiF2IqGDi_JKQW4P_9ACc7-DJl8BbOo_Fjnj66Z6n7lYkC9aOsdqrHz6PMREicFFqIxJzzStqAmWN-R58CJPo4Yymlz3yKAk0jbrkB1uIP6mGkMS0cZsjPEtoOFhhmpIqUWm0HWyH1ZZY5diB0Dm_aGwo8SBl5z88o8iqoijulSrdCXFSdXV1gKv9EyNg8YdScgXFZuvfbY9V_rv5qNRB8bv3iFBZ_zxYNyrqJ5TL3p8NWP2v5zWmu8yjwiMC4faJ4u-rlXtnKL43k_41Ep5KlnfZ5f6X4hp8b-DUvH5FKxe77ri7XaYGZ3h-eoaJtVP88bJBPkJTKEQDFaXjt1APOK053jTxLMRlq7bESjcQjlHiLkhnHvoBHGPcu0Q0e9uudaGXwe-BzH8WIQIz5O-iAu1jiuZDg_ROMj9RWkVE2_0DUb-5-aD5w4pbHuyh3TZVUkAQxSI7PZ5Z8UjAbcc6eJNoHV9AzhbZYhxddwBWEshQqw_jfR5WVSd7wzZ6mcst_FhezdOGI4RxtdqPiL938VJrigAOnsB2HKyHvgtRutve_BeH5iz62P1Gh_wE_siK8aXPJTEucMhZit5qtLaFqFePv1O46IWCVfqmMRNgYIKiobTrG76nX3eBMvwb9gx1FBWTBDdL04Yno131ANC18URV9sOXp3UQfStAGYg-ovW6Ics9Chod6lhuVlaWzD3hUMuMw4cM-kqhY2ZfxPq3JEorl8pGnhqXyNHPLhq_M6zpBjrNBDo08te7oRIHHppZ-PFsy43BWUhIrOk6mKFP9tID5Lb0omy1Hn0p5-VBd-wrrrpCdae2tPbS4lXSpyPtH5_f5qVILrcPOlRKDFqiSkRaXhIREA6JS-ie9D7ZJGoCUfxq4sT1TZ21daUGHG0uy-4j8i-V10aQQnAsb9cp41_NVKev4qyhf9JTjID7eBxUagzCd3934IVnV1nJ0vVjBCFlhtN4kz0oU-XVaclBjzD-PKylunlzP8rnA&sai=AMfl-YTreIurbxwek4zuIN02QOE8zdmAU-IB_3thGFPBw_BrRlmIk4TLjBBc8PoO0tbJBdTXsGAB_EviMWcuR2wsoJiz1uJyIzsI_omEH8Lx2C-idFnV_GvVyQ5x--gdqq2rLGdkhMdMXvQyrFqdKYTAEMzgz2b_Ji0dg5cdZruyhvg3ylxidgaxD0OThA&sig=Cg0ArKJSzC65G64Qq5OZEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20221110.75248&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 043D 41 KB
15 KB 50ms
43ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 23:12:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108391
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 Nov 2023 23:12:21 GMT

GET
H2 200 17797101563932872323
s0.2mdn.net/simgad/ Frame 043D 87 KB
87 KB 119ms
107ms Image
image/gif 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17797101563932872323

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091ad0461b3d8801ba0e737c168d00162c2ef8fa5181bc8705fcc366ea3123f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 18:23:27 GMT
x-content-type-options: nosniff
age: 39325
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89008
x-xss-protection: 0
last-modified: Wed, 07 Sep 2022 13:12:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 18:23:27 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 78ms
78ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pr&rt=1&c=ca-pub-5959581822882463&eid=44759876%2C44759927%2C44759837%2C42531706%2C44770880%2C44774292%2C31070949

Requested by

Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
122 B 142ms
53ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=www.zarplata.co.ua

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 143ms
53ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zarplata.co.ua

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/ Frame 14B2 10 KB
4 KB 44ms
44ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 29246
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 21:11:26 GMT
etag: 10353107486223812946
expires: Sat, 10 Dec 2022 21:11:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AE5C 640 B
262 B 54ms
54ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNWovmmkHvbjigBi_lrhKEZI8lSYlBFqsLMgOX1_zuokDYmkvQZWOvzo31g5aa0iVgfpkW6W3DEAl_Wl_wbB3VB_QKHOLiDoFreG5TOKIp8n1Q5-RYUgCsJbu09YojMZYoGKeyWgjbR1iJ3sj60uyHYab2RnhEDk9tWyFeenGJ-ZC63AgP8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Nov 2022 05:18:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 14B2 67 KB
32 KB 77ms
77ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BFw6L0V5GhvORVgeDzvw3vvINwG9fXYse35tJ_U2U_4jnksNPb_dQ2rccdKJWE6skmyEjs4ZHsmTqwkMWrA4od1ABxAg&cry=1&dbm_d=AKAmf-Bif8B9nPdrm7KJ3Dqvzh3WZFDVgvM8sOaoteaF30ElvqyaxcJ86q5IdUlPlmrihh9YL0FvY1DGH5Crl7fLPEWNPxdtY7eRnuxZFs_vuuHQOSQ3RcSUG3QvmSNPK3Jnwt-KUBwS1FVs7RWU5WiuX5y--q3kPEQvk3aFgtt2CqX5EtGYPkpfZ2Ayq_6R-8E32k-csoXWATymwHnr9_hqdkgMUDFPCJmYsFpsIRKZvQLC3UEf8REsqOgU4Ds2YBAgccddWA4aw013A9lFLb_TWpAu277wJ0LIVmTgzaX4XwWW0gOCNSQKxztNHlerhLESmUXSpVnMIYHsPOdsWnbBRMgzX2sgyYX6cYfjwKoUWSS2SWWqM4LW9ULaVkwIxS130ybTDxpNiUqbpeRtBIvSR_HyjIkYVI7IVkM1d-hYvEgI9pNK-ycYofhy_-Zk9PyO9gQkO5EBwa-usnDhqLe9kB2S-qmF4rg_H1CRc2JZqHPHAkq8n2Uv_qUJVi-pZ8ZEmYbMlQoxB7WF0AU62vFdlN-a4uYDMfResYFfogLVpHovc9rBKpGYz0n05vUEEOwSlJh_ZbO6SjUo2ysV-OKoKMU2ESHZPfW0F416fx5PEoZPfpffKo7IDzmZmwMfPS1zl99zKcqlgbBNsMGs43_l9DH9hRA89OFSLknY6HQqJbK31nsqjghf20fuTQcbAg84KQjNkCDbNY3oTYRPc97ws-IJX9-SKvMW4BZfuruHxAwDx3_8QbbsyNhGU7n856N3-FmMGVz4KM6oo-Ne15R_Qsv6jiC3oY9RXh-kAuujkXQZvL96Zh1VBvNhz-kVfv6XP0MxIkHUfILAE037Hyx6uaQetzyuJBMSiWk9JXSphAr3_7LMkw9R2lw8kQS0IUZ3fZno08ursWknpbX9sLBernK2oWPMrYo-ziNWy6gXHZD9RI16NvQkdUkJhvdiEO7ST-fOdFn6t-GULJWuDovI3V7q7DdjTFCtATfVusv4uNYIehHc-dhCcQ7u3V82n61Hybc03NFrTggya1zM3KIRLHeUHxgHM0feX9z03Kl4D7NQCVau4NnASLgryN3rg_gSxoO7HoFPbAR8kaaLxjP_NZGmjSX591yC1AjlaY8kK-fPrAhfVLlgESAMJqKSu05jjLL1cUUr9sbO4ZW42GBXAnuw1pDwI59YbuCwGImEQVS66tM_FFSnXlgIwFa_N8QU8jhOLKvRfzOY_BJj_B1AMK3eMhypiWN6lX94H72NPz-XZ1N8-Ur4__XZHgC_eZI-9sjHXmQ64VOvkZp_Czuhr3xHY09zK1G4Yq79YzHIFoDCcUKc7jQhwxpUBEdQZu4AZnLly8D-HSU47uOyiNTkwNlI-2YQ_KNj8RtpKOAYzzxhC0QFenrkvEPJEK0qwUjy4vj690wpH8DoS6ayNyUJmrqVGUfOfshUDBBjGQC9nEzahG5knd59Y2IX9F5b6Ad6dWO3ouZdKPWwAr6d8k_rriWzXSugcQjyt7-yowAgBtVwISuON5E1Sd9v3IfQFxGPvPRF2_gsK3S7tBOwUoWTRucYS_huJ74i50nTf4OLLmpURB2mkRB88-q0cbbq6soFLoD3jGbnASfu85EYfcmpo9BfzUhFf3duy8wQM2nkVphXbrctR7pkX-ovZ0PsXEFxuW5wUXW06CtKf10PW5wc9ra56c_-H3vs1p--FpsORjpsjtHMJxLbV-D9hW3lmRG1A3aQXBkvSCvh13BLhuSJ4WfHTxztDfNkIIHHLaXshBbtXffLmn4Ilhgb3u2xqArmMogJg95Y7seem0i4U5rRtlRHqTEr-9eTOxRjhAsp6fRobsHgNJ0cn2E6xBhME7iFcNB8Xfh8PtD853OdL0z1lr-fzrbuQZ5OeWEWnJ8PK-otQRKkyAafmlPRKWLoaG2CeiVzbpD0nAKH7hrTiVPp3rPsiOsXozbeq4KuGGCJzy4nu1GLrWxvFKZ1TtEGLV1k35G1pjz-mANIDKbjFU14pKEYE_NAWV0IOqj1G03C7Oge_ixkUM1XNKAORtRcoI4MiR632_PaZEpPeOS66armq0GPuTtIQpPUn4Z5lembaIRuks37FCW9vLjvI4e-8iQt5OHy8yUZMKeYGLO1KBO9etxMfdgPyyXCV2V3Z9AiJdN4EywaXmykEPRqoj06B1XT6xl1b046GfZuF5PfL01Z2DYl_zM-8lw4vUnrLvRlaKgXgkoqt4178AngzXhVLMsXwf9ld40jr6l7LQ209PaL8_fOfxJC8JsezQPqihOY2-y-WDjvGaN_XohJhp0Sy922SaYqjRYmlQozt262r3TK6mMRQyIjXqaXMZSMofNCpQDsk9E2AND-16rC8ySw5Xh9MWYLDz2Rd0S4wS-tMWOl_Iajlu6eHb60Ryhkg5A6tF5jBTRo1QhFd1z_GXDuplNL0-vlqP-E2ouqPi0YYSShY3Sl7ItDQHak5vx3AFdQFyBANkYdz4xJcyFWUR2DfPFEgPs-KjfbMv4Ge1zcajTT81DxPKOcuM-Z8SPnpUgkuTaAwf2JQDIIbClihtTfYO9g3861wrn3_teApYTlY026DKzUjcudEUdKXqQO1RpBB09I_RXNJCGsffOhydyvngQjuoZChMJbeVOcDTdPMF0lj2e-CKlCqOVqgSdGOYCNPAulC3rnlQY5A8K9GVkFuHTYy4A8WkuerjMSQsJ8q-am_wfeY3L9DdFTaUCLXCC27HfqhOUJK_cGs-0DLPfIF3cNa2WJhRqMI4_MVa3VvBVA6pe04WU2J7W1_Y4UMGvu4qYjqqAn4hq7bUx0vrQlbIuZr-ooEjz-sggs27c2IcXaZ86cRpTei_LRQxfIqRYoCZ7uUhQF4EaDHxWs_3SqXtA5cyFlmN6V3CLwKu-hh9fLDyqPiKqz887ENL3fOfozLG2TGibNdbiDoDV2bidwb_1gobsCSRlm7I3P4KU2F-eESs4M8GARV0bc9Ht8n35CyDukMaD_n_NbdIS7VZbwpLWHY0fBPDv8iRpTkVs-JQ2Dh22e-Im5uUxA80XHQpBWQFXg82mHN4cSU1jgVdDrd4LKjuWoLfThd-cHhAN-6mK5KdT9QHkCVGzsqADady27JEWLJJL0qQjKpWX_iM8mDZ3gj0kk2CDIY4qZHPlPioXGzlsPFtHCc9ne9hVl4bozCdZ1Yh7acuA&cid=CAQSGwDq26N9_RvpnGlYBQs1c_hCpp-rO4IEs9quhBgBIBM&rfl=1%2Chttp%253A%252F%252Fwww.zarplata.co.ua%252F%240

Requested by

Host: www.zarplata.co.ua
URL: http://www.zarplata.co.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c480ef9ac6113a8801e66caef02a0137e4e9e68e8c9fa3494e0bc1f4df22b8f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33064
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 14B2 42 B
63 B 78ms
77ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BLrLnrK7HUbljapFO9QWfU5jlH182ojpSTG8EYKN-Fpa7PN1uKlLroLMw1PDJWwzYuG5835NGjQEaM-TjbuY6TjGjOUPFonfTELMhGS2dJgB1ORws

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 14B2 3 KB
1 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 17:59:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40737
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 17:59:55 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 14B2 18 KB
7 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 12:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 12:23:48 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 14B2 154 KB
47 KB 162ms
72ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F4AE 22 KB
8 KB 44ms
43ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 147301
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 12:23:51 GMT
expires: Sat, 25 Nov 2023 12:23:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6DAD 22 KB
8 KB 47ms
47ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 147301
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 12:23:51 GMT
expires: Sat, 25 Nov 2023 12:23:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 043D 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44b3163f460f1c9f882ebfb6173b76a6a926d3d75a5f03d94e0fd534231dfc7c

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2A78 0
0 180ms
89ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu_cOFUirgqO01J9FCEfk2hHGfJl9Kw82Fru1aEO4MUQlBrTnBKiXSQ15hz8kFiyK2VTg3f5OD-Qm2LJiFbDibETtdCtNigvg7UJBMVoNasq7YdUy4UVsDMTEwWIEbreI4_qbxgvP-OWTWMQt0vIMxMdENzPYXePSm8RofGa_zEyzlMN4W_tDOavyhzCMBgoTXNRq13o7Om1RJtEG1_wg8peUgt127cNDMGuqY5q4D_j9UCIc5v1WoFkbYSyHPsZYEF9SczvIrSKixZj78XVZF4vYJNsxdwyCwlt1USvHye_tXCxHioxxUba_Xkx3wdvECAVYyzepxkKXjfRuNAMaE5-KJruraB2c9sxuOqfVZ38h_-aK3ujyHL8h7Cp58JuBW28KFPi0m67Frr5yIB4FbvC-aHUGFz_4xkR2fwTY62-DM89RikIIwTeeSt1SzIGG8lVZGASLo75IOE5jFg6x53gQX9A3lsU4sCEAqat0nVOX6xLMSZN4c_zYyfP-Eux_n0dLFvWdRNbrO7nirTSiQOpSzU5SezXuiSry8A4X25kunSb5EujMI4ULryQafl-fCYl0MFQTz3P_JkLBExqFYDLJ0t5TdVGuzehBkQAFfLLAXbOdthP86U1AM19plstuq_KtVdEQ76kYfuUpRRgkekEuEtbN8ddrhsoU5gVhtqPZ6J67gr6ck266N1YLz4AkUse1c1LOCueB9Qh-3tWk24YmpNnOZD0qpFo6AXexXvZOMJdnwtAg63msXD96x3woDUYsTAq94EndFne1AQ2MPnvyDtRi3ZqCD2ScwGQPkq_pb9aDNy22ai8rJ-0mZ6flot48vO6rF3QNsQHNFrLlrINH0XMkE0M2wzVVevrwEHQ4H9QCFXw3AXjNBKkxix6S24yX-yT2n3RwLbrsebChDd5HX-9nyqar2tyBIwdW4UJpMIy2JNCIKA_itaynqhaLGwc_PB1LQSdj6u5vyLR3VnDLCsjlpRVOTd7vuIcHrJJT664GIW3GdGWNzBgQmJrlgC8qlLATN-zpykBCzyCcCMazu7asgmM1KcvMAff9bHVpkWI4yVA95Rb-34MFqOWdiVqWb1WklnNjhomXSbOaz25BG49qH8QxzXRvjePk1dBKLxJiWKWATYQWQ5Up1wcEmn5iEDNrhVWTAGW2pivb4gWkKMmw95PexBgENpNSLZZa8D_7r6fzBN&sai=AMfl-YTQvA2Spcr2sp-sJdoez66bCSvCk3rle5i_V6troUGulR7cby-3ls5966nlHrYrUUgJCqDijrtBL7zJb04pqxZphKrQ855GkqJekDvkHje3aZW7po2na5aoSevAfiMui9f9PYmyKHXtg1q_EAv-YEcLNAMf6HO330mvTD9l3uXII7t9qP1w2W3Xfg&sig=Cg0ArKJSzBGa-6gyRUOwEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=222&vt=11&dtpt=221&dett=2&cstd=0&cisv=r20221110.62503&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame AE5C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJhsN9WpzO_acnqOaQt_OHQ&google_cver=1

43 B
114 B

61ms
41ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJhsN9WpzO_acnqOaQt_OHQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNWovmmkHvbjigBi_lrhKEZI8lSYlBFqsLMgOX1_zuokDYmkvQZWOvzo31g5aa0iVgfpkW6W3DEAl_Wl_wbB3VB_QKHOLiDoFreG5TOKIp8n1Q5-RYUgCsJbu09YojMZYoGKeyWgjbR1iJ3sj60uyHYab2RnhEDk9tWyFeenGJ-ZC63AgP8
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJhsN9WpzO_acnqOaQt_OHQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame AE5C 43 B
304 B 147ms
39ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNWovmmkHvbjigBi_lrhKEZI8lSYlBFqsLMgOX1_zuokDYmkvQZWOvzo31g5aa0iVgfpkW6W3DEAl_Wl_wbB3VB_QKHOLiDoFreG5TOKIp8n1Q5-RYUgCsJbu09YojMZYoGKeyWgjbR1iJ3sj60uyHYab2RnhEDk9tWyFeenGJ-ZC63AgP8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame AE5C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELaR4JizaPh2hRynyYzreqs&google_cver=1

23 B
172 B

163ms
73ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELaR4JizaPh2hRynyYzreqs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNWovmmkHvbjigBi_lrhKEZI8lSYlBFqsLMgOX1_zuokDYmkvQZWOvzo31g5aa0iVgfpkW6W3DEAl_Wl_wbB3VB_QKHOLiDoFreG5TOKIp8n1Q5-RYUgCsJbu09YojMZYoGKeyWgjbR1iJ3sj60uyHYab2RnhEDk9tWyFeenGJ-ZC63AgP8
Protocol: H2
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

expires: Sun, 27 Nov 2022 05:18:52 GMT
pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESELaR4JizaPh2hRynyYzreqs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame AE5C 23 B
172 B 249ms
72ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDR9gIQwtvy-QMYqOz40gEwAQ&v=APEucNWovmmkHvbjigBi_lrhKEZI8lSYlBFqsLMgOX1_zuokDYmkvQZWOvzo31g5aa0iVgfpkW6W3DEAl_Wl_wbB3VB_QKHOLiDoFreG5TOKIp8n1Q5-RYUgCsJbu09YojMZYoGKeyWgjbR1iJ3sj60uyHYab2RnhEDk9tWyFeenGJ-ZC63AgP8
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

expires: Sun, 27 Nov 2022 05:18:52 GMT
pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 043D 0
0 121ms
83ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstEnYn5vnjClwcH_QzYI8_3vimYW89ImzphLKHFsF3PEccQ1KG8tJ7ULGxp-QzkILLlDVn6SmLk3OERPR80EWOhCp_krh-0o_anWdFkZq-yrZc519CoXA78U6A0EPtsZ6Q26qZVIXe2v4d0fqC3ifjgXZDv5qctZ3DYEApFYwabZ0trkKrdAAvutGevldkVywvoAcHU1EBu7P-rCVc9DiF2IqGDi_JKQW4P_9ACc7-DJl8BbOo_Fjnj66Z6n7lYkC9aOsdqrHz6PMREicFFqIxJzzStqAmWN-R58CJPo4Yymlz3yKAk0jbrkB1uIP6mGkMS0cZsjPEtoOFhhmpIqUWm0HWyH1ZZY5diB0Dm_aGwo8SBl5z88o8iqoijulSrdCXFSdXV1gKv9EyNg8YdScgXFZuvfbY9V_rv5qNRB8bv3iFBZ_zxYNyrqJ5TL3p8NWP2v5zWmu8yjwiMC4faJ4u-rlXtnKL43k_41Ep5KlnfZ5f6X4hp8b-DUvH5FKxe77ri7XaYGZ3h-eoaJtVP88bJBPkJTKEQDFaXjt1APOK053jTxLMRlq7bESjcQjlHiLkhnHvoBHGPcu0Q0e9uudaGXwe-BzH8WIQIz5O-iAu1jiuZDg_ROMj9RWkVE2_0DUb-5-aD5w4pbHuyh3TZVUkAQxSI7PZ5Z8UjAbcc6eJNoHV9AzhbZYhxddwBWEshQqw_jfR5WVSd7wzZ6mcst_FhezdOGI4RxtdqPiL938VJrigAOnsB2HKyHvgtRutve_BeH5iz62P1Gh_wE_siK8aXPJTEucMhZit5qtLaFqFePv1O46IWCVfqmMRNgYIKiobTrG76nX3eBMvwb9gx1FBWTBDdL04Yno131ANC18URV9sOXp3UQfStAGYg-ovW6Ics9Chod6lhuVlaWzD3hUMuMw4cM-kqhY2ZfxPq3JEorl8pGnhqXyNHPLhq_M6zpBjrNBDo08te7oRIHHppZ-PFsy43BWUhIrOk6mKFP9tID5Lb0omy1Hn0p5-VBd-wrrrpCdae2tPbS4lXSpyPtH5_f5qVILrcPOlRKDFqiSkRaXhIREA6JS-ie9D7ZJGoCUfxq4sT1TZ21daUGHG0uy-4j8i-V10aQQnAsb9cp41_NVKev4qyhf9JTjID7eBxUagzCd3934IVnV1nJ0vVjBCFlhtN4kz0oU-XVaclBjzD-PKylunlzP8rnA&sai=AMfl-YTreIurbxwek4zuIN02QOE8zdmAU-IB_3thGFPBw_BrRlmIk4TLjBBc8PoO0tbJBdTXsGAB_EviMWcuR2wsoJiz1uJyIzsI_omEH8Lx2C-idFnV_GvVyQ5x--gdqq2rLGdkhMdMXvQyrFqdKYTAEMzgz2b_Ji0dg5cdZruyhvg3ylxidgaxD0OThA&sig=Cg0ArKJSzC65G64Qq5OZEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=192&vt=11&dtpt=191&dett=2&cstd=0&cisv=r20221110.75248&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame F4AE 36 KB
16 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 17:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 26 Nov 2023 17:59:56 GMT

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 6DAD 36 KB
16 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 17:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 26 Nov 2023 17:59:56 GMT

GET
H3 200 10770626425131159775
s0.2mdn.net/simgad/ Frame 14B2 46 KB
46 KB 145ms
45ms Image
image/gif 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10770626425131159775

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BFw6L0V5GhvORVgeDzvw3vvINwG9fXYse35tJ_U2U_4jnksNPb_dQ2rccdKJWE6skmyEjs4ZHsmTqwkMWrA4od1ABxAg&cry=1&dbm_d=AKAmf-Bif8B9nPdrm7KJ3Dqvzh3WZFDVgvM8sOaoteaF30ElvqyaxcJ86q5IdUlPlmrihh9YL0FvY1DGH5Crl7fLPEWNPxdtY7eRnuxZFs_vuuHQOSQ3RcSUG3QvmSNPK3Jnwt-KUBwS1FVs7RWU5WiuX5y--q3kPEQvk3aFgtt2CqX5EtGYPkpfZ2Ayq_6R-8E32k-csoXWATymwHnr9_hqdkgMUDFPCJmYsFpsIRKZvQLC3UEf8REsqOgU4Ds2YBAgccddWA4aw013A9lFLb_TWpAu277wJ0LIVmTgzaX4XwWW0gOCNSQKxztNHlerhLESmUXSpVnMIYHsPOdsWnbBRMgzX2sgyYX6cYfjwKoUWSS2SWWqM4LW9ULaVkwIxS130ybTDxpNiUqbpeRtBIvSR_HyjIkYVI7IVkM1d-hYvEgI9pNK-ycYofhy_-Zk9PyO9gQkO5EBwa-usnDhqLe9kB2S-qmF4rg_H1CRc2JZqHPHAkq8n2Uv_qUJVi-pZ8ZEmYbMlQoxB7WF0AU62vFdlN-a4uYDMfResYFfogLVpHovc9rBKpGYz0n05vUEEOwSlJh_ZbO6SjUo2ysV-OKoKMU2ESHZPfW0F416fx5PEoZPfpffKo7IDzmZmwMfPS1zl99zKcqlgbBNsMGs43_l9DH9hRA89OFSLknY6HQqJbK31nsqjghf20fuTQcbAg84KQjNkCDbNY3oTYRPc97ws-IJX9-SKvMW4BZfuruHxAwDx3_8QbbsyNhGU7n856N3-FmMGVz4KM6oo-Ne15R_Qsv6jiC3oY9RXh-kAuujkXQZvL96Zh1VBvNhz-kVfv6XP0MxIkHUfILAE037Hyx6uaQetzyuJBMSiWk9JXSphAr3_7LMkw9R2lw8kQS0IUZ3fZno08ursWknpbX9sLBernK2oWPMrYo-ziNWy6gXHZD9RI16NvQkdUkJhvdiEO7ST-fOdFn6t-GULJWuDovI3V7q7DdjTFCtATfVusv4uNYIehHc-dhCcQ7u3V82n61Hybc03NFrTggya1zM3KIRLHeUHxgHM0feX9z03Kl4D7NQCVau4NnASLgryN3rg_gSxoO7HoFPbAR8kaaLxjP_NZGmjSX591yC1AjlaY8kK-fPrAhfVLlgESAMJqKSu05jjLL1cUUr9sbO4ZW42GBXAnuw1pDwI59YbuCwGImEQVS66tM_FFSnXlgIwFa_N8QU8jhOLKvRfzOY_BJj_B1AMK3eMhypiWN6lX94H72NPz-XZ1N8-Ur4__XZHgC_eZI-9sjHXmQ64VOvkZp_Czuhr3xHY09zK1G4Yq79YzHIFoDCcUKc7jQhwxpUBEdQZu4AZnLly8D-HSU47uOyiNTkwNlI-2YQ_KNj8RtpKOAYzzxhC0QFenrkvEPJEK0qwUjy4vj690wpH8DoS6ayNyUJmrqVGUfOfshUDBBjGQC9nEzahG5knd59Y2IX9F5b6Ad6dWO3ouZdKPWwAr6d8k_rriWzXSugcQjyt7-yowAgBtVwISuON5E1Sd9v3IfQFxGPvPRF2_gsK3S7tBOwUoWTRucYS_huJ74i50nTf4OLLmpURB2mkRB88-q0cbbq6soFLoD3jGbnASfu85EYfcmpo9BfzUhFf3duy8wQM2nkVphXbrctR7pkX-ovZ0PsXEFxuW5wUXW06CtKf10PW5wc9ra56c_-H3vs1p--FpsORjpsjtHMJxLbV-D9hW3lmRG1A3aQXBkvSCvh13BLhuSJ4WfHTxztDfNkIIHHLaXshBbtXffLmn4Ilhgb3u2xqArmMogJg95Y7seem0i4U5rRtlRHqTEr-9eTOxRjhAsp6fRobsHgNJ0cn2E6xBhME7iFcNB8Xfh8PtD853OdL0z1lr-fzrbuQZ5OeWEWnJ8PK-otQRKkyAafmlPRKWLoaG2CeiVzbpD0nAKH7hrTiVPp3rPsiOsXozbeq4KuGGCJzy4nu1GLrWxvFKZ1TtEGLV1k35G1pjz-mANIDKbjFU14pKEYE_NAWV0IOqj1G03C7Oge_ixkUM1XNKAORtRcoI4MiR632_PaZEpPeOS66armq0GPuTtIQpPUn4Z5lembaIRuks37FCW9vLjvI4e-8iQt5OHy8yUZMKeYGLO1KBO9etxMfdgPyyXCV2V3Z9AiJdN4EywaXmykEPRqoj06B1XT6xl1b046GfZuF5PfL01Z2DYl_zM-8lw4vUnrLvRlaKgXgkoqt4178AngzXhVLMsXwf9ld40jr6l7LQ209PaL8_fOfxJC8JsezQPqihOY2-y-WDjvGaN_XohJhp0Sy922SaYqjRYmlQozt262r3TK6mMRQyIjXqaXMZSMofNCpQDsk9E2AND-16rC8ySw5Xh9MWYLDz2Rd0S4wS-tMWOl_Iajlu6eHb60Ryhkg5A6tF5jBTRo1QhFd1z_GXDuplNL0-vlqP-E2ouqPi0YYSShY3Sl7ItDQHak5vx3AFdQFyBANkYdz4xJcyFWUR2DfPFEgPs-KjfbMv4Ge1zcajTT81DxPKOcuM-Z8SPnpUgkuTaAwf2JQDIIbClihtTfYO9g3861wrn3_teApYTlY026DKzUjcudEUdKXqQO1RpBB09I_RXNJCGsffOhydyvngQjuoZChMJbeVOcDTdPMF0lj2e-CKlCqOVqgSdGOYCNPAulC3rnlQY5A8K9GVkFuHTYy4A8WkuerjMSQsJ8q-am_wfeY3L9DdFTaUCLXCC27HfqhOUJK_cGs-0DLPfIF3cNa2WJhRqMI4_MVa3VvBVA6pe04WU2J7W1_Y4UMGvu4qYjqqAn4hq7bUx0vrQlbIuZr-ooEjz-sggs27c2IcXaZ86cRpTei_LRQxfIqRYoCZ7uUhQF4EaDHxWs_3SqXtA5cyFlmN6V3CLwKu-hh9fLDyqPiKqz887ENL3fOfozLG2TGibNdbiDoDV2bidwb_1gobsCSRlm7I3P4KU2F-eESs4M8GARV0bc9Ht8n35CyDukMaD_n_NbdIS7VZbwpLWHY0fBPDv8iRpTkVs-JQ2Dh22e-Im5uUxA80XHQpBWQFXg82mHN4cSU1jgVdDrd4LKjuWoLfThd-cHhAN-6mK5KdT9QHkCVGzsqADady27JEWLJJL0qQjKpWX_iM8mDZ3gj0kk2CDIY4qZHPlPioXGzlsPFtHCc9ne9hVl4bozCdZ1Yh7acuA&cid=CAQSGwDq26N9_RvpnGlYBQs1c_hCpp-rO4IEs9quhBgBIBM&rfl=1%2Chttp%253A%252F%252Fwww.zarplata.co.ua%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a557c40ebf092ba76950ab7044ebbab32bbf485afc8c6507cae5b93945d00718

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 18:23:27 GMT
x-content-type-options: nosniff
age: 39325
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46656
x-xss-protection: 0
last-modified: Wed, 07 Sep 2022 13:13:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 18:23:27 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 14B2 29 KB
11 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 16:51:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 44861
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 16:51:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame 14B2 8 KB
3 KB 62ms
62ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 11:55:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 11:55:20 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 14B2 0
0 119ms
96ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst2hDHqdLFbsrlQoGhwAw4WOezRiJSrPjtfiZPSrd2MUOfX4RvlC0QYy57wZ2OwmhEdFk9d1odD2xoUaodoicYzM4kJVHZzmIwNY-DTUzpt4hWlkqVbg1ksQc2ioeprRM8RKs1oOnqrQnOnjHZ2v2j7ngth-uwA2_kzlgdLAAygi-tvqtzWtbNRfrWMkyhbg6ZnHhtK8S4NZrN2qUGCLTihQsVBAHGCsceamsgywoKoSF0-zOY7IUwHUALvjFix5XrhcD8ONPmtbxyjqp6UrgA6-kgp_vZ-7Zuv39viomNO41qUlhwh3xEx4p8uIG2XpK8PwMFKAmEGMAeUQmW2O2ngSlfn0sc7oT5RGabAHoSMWzbx7RLFmURggnkZJJHLpummS_zWcxjt3707GYpDsrBpZzgx8hBQKqPKx8tmLrlkREGqbbbylKp-tTc_xD9NiF9sM0q7hDWPazXgp5A6vAse77J_CBckRMQPPANYMSBna8oq2s3nC6bAF8nTBJsbfBzNyT-YQTukTgg8UdyvSrBOr0-dptx2P22YzqjLCS1eu4Lm43aQBKbpFzh3Xz6_37V14oTu082Pf5yLvQl15k2TqSh76CGoMhgaaB5llR_gdhIMSuYHPY5mRjtPe3cL52HwkI1ooIimyMRULVslVvj-rgzIVp-s9JQWSA_DMnzhiB49lPnqYXPIIHpG6HKED6sEpgFD-60rxdrQ5UQ7diAFvCUBAov7HuT940t7diX5iN9QR-4b8mkQPif9j4TkgALheNgXHntYmmIT_Dz-w2nT0tdcS2wJXfMQ3d5Bu8AtIiToo1n7erQFeUDxdJVwwFmwv6FAQ_o-wDBZ07z_Bi74lbW-qB4U4PFoxIQrR-pNbu7T18-7Ze-LIgHwCY-UGgBiyOnfOw-Yb6JjEUQZ6ZGY1zGNoWBaqa0C-S0DBAJduUJPiwGsmCHiNvwQ3mz9IrSRtPUmm3dgugpLqp4zNW2efp20RSA3kE6zWR_2STzMqrhUkI5gyMGVcTGpmqP27JfeSbE65kIl4s-NX3IKY-o74z4FlfPEfRYN_eQrtd-LQfh18I9t-e3pdCECQ7DLBf1-ig1UWDL57FTW_f86_UYK4pqx5JjxM9lD3HToEQmmaAtK9XssMjgHSquNjbuC5LKij96Pr5lsOuBf3E1XyE9ABmEz_x1VHurzkOQLfGIc&sai=AMfl-YRhQApDOy04bod5NrqVrOYAJsiGKSuFT3fpTj3pPCLv8CuP2BX83ZRuXBfWpNJLiA2CuCVgVsESJUrVBfdUSSa_mzNS88kXTasIbbltXT7ohQfXDJohpB4JB4PQckqfnDOF9wlriIIy0Kb1quIjuC_qoKKEpVB4h40USQ5GC_bLksU0x1rJcjXtPA&sig=Cg0ArKJSzAcEkL8xmJCuEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20221110.76828&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 14B2 41 KB
15 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 23:12:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108391
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 Nov 2023 23:12:21 GMT

GET
DATA 200
OK truncated
/ Frame 14B2 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ace4b2c9e31d93d658e30aae396491c0bb393514ee0d1426b6abe71a4e925c8e

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 43B0 22 KB
8 KB 44ms
43ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 147301
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 12:23:51 GMT
expires: Sat, 25 Nov 2023 12:23:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 14B2 0
0 82ms
82ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst2hDHqdLFbsrlQoGhwAw4WOezRiJSrPjtfiZPSrd2MUOfX4RvlC0QYy57wZ2OwmhEdFk9d1odD2xoUaodoicYzM4kJVHZzmIwNY-DTUzpt4hWlkqVbg1ksQc2ioeprRM8RKs1oOnqrQnOnjHZ2v2j7ngth-uwA2_kzlgdLAAygi-tvqtzWtbNRfrWMkyhbg6ZnHhtK8S4NZrN2qUGCLTihQsVBAHGCsceamsgywoKoSF0-zOY7IUwHUALvjFix5XrhcD8ONPmtbxyjqp6UrgA6-kgp_vZ-7Zuv39viomNO41qUlhwh3xEx4p8uIG2XpK8PwMFKAmEGMAeUQmW2O2ngSlfn0sc7oT5RGabAHoSMWzbx7RLFmURggnkZJJHLpummS_zWcxjt3707GYpDsrBpZzgx8hBQKqPKx8tmLrlkREGqbbbylKp-tTc_xD9NiF9sM0q7hDWPazXgp5A6vAse77J_CBckRMQPPANYMSBna8oq2s3nC6bAF8nTBJsbfBzNyT-YQTukTgg8UdyvSrBOr0-dptx2P22YzqjLCS1eu4Lm43aQBKbpFzh3Xz6_37V14oTu082Pf5yLvQl15k2TqSh76CGoMhgaaB5llR_gdhIMSuYHPY5mRjtPe3cL52HwkI1ooIimyMRULVslVvj-rgzIVp-s9JQWSA_DMnzhiB49lPnqYXPIIHpG6HKED6sEpgFD-60rxdrQ5UQ7diAFvCUBAov7HuT940t7diX5iN9QR-4b8mkQPif9j4TkgALheNgXHntYmmIT_Dz-w2nT0tdcS2wJXfMQ3d5Bu8AtIiToo1n7erQFeUDxdJVwwFmwv6FAQ_o-wDBZ07z_Bi74lbW-qB4U4PFoxIQrR-pNbu7T18-7Ze-LIgHwCY-UGgBiyOnfOw-Yb6JjEUQZ6ZGY1zGNoWBaqa0C-S0DBAJduUJPiwGsmCHiNvwQ3mz9IrSRtPUmm3dgugpLqp4zNW2efp20RSA3kE6zWR_2STzMqrhUkI5gyMGVcTGpmqP27JfeSbE65kIl4s-NX3IKY-o74z4FlfPEfRYN_eQrtd-LQfh18I9t-e3pdCECQ7DLBf1-ig1UWDL57FTW_f86_UYK4pqx5JjxM9lD3HToEQmmaAtK9XssMjgHSquNjbuC5LKij96Pr5lsOuBf3E1XyE9ABmEz_x1VHurzkOQLfGIc&sai=AMfl-YRhQApDOy04bod5NrqVrOYAJsiGKSuFT3fpTj3pPCLv8CuP2BX83ZRuXBfWpNJLiA2CuCVgVsESJUrVBfdUSSa_mzNS88kXTasIbbltXT7ohQfXDJohpB4JB4PQckqfnDOF9wlriIIy0Kb1quIjuC_qoKKEpVB4h40USQ5GC_bLksU0x1rJcjXtPA&sig=Cg0ArKJSzAcEkL8xmJCuEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=210&vt=11&dtpt=210&dett=2&cstd=0&cisv=r20221110.76828&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Nov 2022 05:18:52 GMT

GET
H3

200

/
www.facebook.com/login/ Frame 115A
Redirect Chain

https://www.facebook.com/v7.0/plugins/page.php?adapt_container_width=true&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dff2488b9f7249c%26do...
https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconn...

0
0

214ms
152ms

Document
text/html

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff2488b9f7249c%2526domain%253Dwww.zarplata.co.ua%2526is_canvas%253Dfalse%2526origin%253Dhttp%25253A%25252F%25252Fwww.zarplata.co.ua%25252Ff1d68e57205886%2526relation%253Dparent.parent%26container_width%3D300%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fzarobitna.plata%252F%26locale%3Dru_RU%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dtimeline%26width

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/ru_RU/sdk.js?hash=bb362f4954058b0a47b73b3ebe38ca7d

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 27 Nov 2022 05:18:53 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=3,i
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: uJyWHXUDa2Oj+AytqUUUpKfyHZnwezOF88QVWUob23o5DjxS6v5JyV8KYVqi3YCuIVR/kqyUOujk997cLr4jtA==
x-frame-options: DENY
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
date: Sun, 27 Nov 2022 05:18:53 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v9.0
location: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dff2488b9f7249c%2526domain%253Dwww.zarplata.co.ua%2526is_canvas%253Dfalse%2526origin%253Dhttp%25253A%25252F%25252Fwww.zarplata.co.ua%25252Ff1d68e57205886%2526relation%253Dparent.parent%26container_width%3D300%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252Fzarobitna.plata%252F%26locale%3Dru_RU%26sdk%3Djoey%26show_facepile%3Dtrue%26small_header%3Dfalse%26tabs%3Dtimeline%26width
pragma: no-cache
priority: u=3,i
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
x-fb-debug: 4LXI47SjqHskm9Dxn7RblfYstzfyezOy7tR9c59lxjYbUczoV5MMNriTkmOY3u1IksgVcxjx83f3zGtpfCIRIw==
x-fb-rlafr: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 150ms
61ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221110&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ac627ea510fd25d6cfbc6f48b39fa488e7bbd3da7224e354b3324e92fcd6b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11203
x-xss-protection: 0

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 43B0 36 KB
16 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 17:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 26 Nov 2023 17:59:56 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4AE 0
20 B 81ms
81ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BesZzPPOCY_OZFIrDx_APiYyTmAgAAAAAOAHgBAI&bg=!wMOlw4fNAAbvMpMzzzI7ACkAdvg8WvqPh2gjNHvS8uwk--FwMyQ7jqZcwrAyDo0wNnSaCG_l5VfLxgIAAAC9UgAAAANoAQeZAss4YJfZA7VygF4JYePlOs2R-IQ6hp5b_eTGmRtyjSVRixbZ9JJxgSZu2wB4T2mGmzAxcwYkeGOyg7EBAJVDztiquAuxbGY4HMQ0kYGKRXLY9XGcV_T4RjxLp1S7dpPAOdgFxelF6bY5KL7DDLntE3f2kFIPtfoNKfjR8JWHIqgUOnAFwqkff73KYhyZEwAotPlObRxnABLVLm_vFbkvS31SEdOTLAwKv7aQUbd66dDK6B5FAVMcYJzDjtuSHc9oTYQ8qy731bMKmJnuVp_n0R2N91wi8KUc8DRWoBVFqMBWhNTktATnbNGgoU1FuGXf7cRw1XihqY-XdvHHid9Opj7g73h_rsutSXYmXtTmjeAHPx3sFVQ3XX92covHygHCIj-CPbgIYVrbKaGaFNHCwhO2B6XFjKPUGe0Pt-TCciHr2YSpirH5Entu9iEBCCklwsC8Y4SZPYXEPXZ0tmaR0C5n7IJK74gdi8zCnyCaOp2dwEG88DwWzEL4_o6XJKXhUdKtn2_L_MJzoOa8OBIiD7gCRuC1c4SvK82xsqqlYm48CbdOXFU55YnUfXPGta-JVG7nHSVwF0R3CUkRzWASoq6p1LAYRnha-9ec7Kdi-lTLSuBUdn4PTDeb8zWvd8UtOF8BsXTohBa-LYvGNQG6ZBAr-8LMGz7-EbOjWAb0bpYaaN4FIlB8i_XBFr_IVSKvScjFKZZWMZt85VzJLS0RBHTzyHNSwiaQDvIuyOljLWvayWeNA2D8vXyiDARcRfSSMO6TVioE9gtHySxQMaf78wX7v7Ee9pRDoVDxyuyl38_3gn6WZoBFvHZCag900wipXmJRMUxqmWQ8hzsgvJG6WDQNMYiedA9lsM0GXl0RmxosdyfXL7aNortYlqonb9ga-AhO0h8KyXdfcq4RbJBA-tIF31uHG5VEAlMJcjRi8mF9G2fk7rqONxrKKRdj

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6DAD 0
20 B 82ms
82ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bj94gPPOCY-rGDtbWgAfs94ngBQAAAAA4AeAEAg&bg=!uLulu__NAAbvMpMzzzI7ACkAdvg8WtIkfdx_Za9ncZZU29GaigznybRrUfDzaIhO2h8cqWxfj4LPpgIAAACwUgAAAANoAQeZAsSx8ls1avkez7VsBtd0GKEcYB13DDsadb8uyDmQNvYI1aFCKR3TByV9tgftePNe7NKimNAHjau3yqp-2eZ3MmDAFdcXO8-psjzR3trLdJ5OyVmLD7L_IPiNs0iPBZ6rx2mfqBdFLCvv-fxV0q9PLQKk3sPksYSs0_NZrfjJAm3g_ioZk2S6eJKky685v0KvnkXZEp0_ZoUxe7K7iDM0tYyn0esCRKc35ITAnsdraQQvbEA2Y-5yh2sjT4afW2SWeiA6ce2x5H74A7Dys1rsZKgLIvEuhvKn4IywAOS4f7HJJMtBlpS0kpPuHgB_NEumOELCdfIEQJ_2ChuPj_wC4pjoBkTp2RP6-TWjOvXHCEszkyKELycAx8VOHzeuZGT38VmZra1z8ayGWImsgptx87W4dy1AxM1vuGSyQGsmQLFExkEZlWdzEI4OVxODdrapCfzjtQ2LReU_rWpCzUQPXGyZ-vz0uGU_5kk0WIYngqibSwuRe45-npC2maFOZkxhJYMy_g4XC5j6U89xE3Tzljoxubbp4Kj4ViaN-crxDIFF73Dgc303I2BL8MiQ40pfxv4aLDl5TtuK309FB7wxE2KwUGAibEQEYpssPZVsj7kWM4M0q7NyKRwHTx_A2932C4bBofxMzHJP2fKMnAhi8LmvIhLa6Yx1dnN8qRyf4FZZoZk94ZPxQYM0I2QO6vT9hrKSi4hCjNRevzDFwYVvEcnLs01V4OsxwJVkKwUXecDJOjb-1aeEW9XXBkZnNnW9CnmBPzRTGFzyF789CWQPDW2LBcQTMLQICMXs1ESETuaAAiemtlk-1lPfrWFLMh9rtNV9oJrd93xTmaU2A7SVph1vRP3S7r0AwixUapszaxl0-Y8DS-XliGI_4D3pITHR_O9C3BBxdJeMEOK9isz7d-ObXH_d5SwqYN3YZoDIHrTTKm5hRdY

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 43B0 0
20 B 81ms
81ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B5NoqPPOCY8T5IcPrx_AP_42E6AMAAAAAOAHgBAI&bg=!rq2lrenNAAbvMpMzzzI7ACkAdvg8WpcSmmWgs0GI9zvgjh13p8PBNlIf1nPCAEQYK2bctmgK_tyNQgIAAABJUgAAAAJoAQeZAsn0fBTVK7xG8d27jtpacT-wALGUH35ZBCEBEKZw5N3z2xvawmhb3euPaYNyytZs4XJlOlSx3RuxHjfbKXWUV4Yd37EM1OfyHsOF_POzQhEF9huvJYJKXMkNuUdm_PGH6yah5skW5SjDEjpF0xdPQ4xBVX8tSylsGmusJ-WE4UikJ-w8jwRD12S0buz3gOfKdhsyVBY40tKAiSSAeWXpvX-em7RVVAlnT8QrnXbTUUkSO-BVfvVX-aQChfKVdySDoSX4TCTIcsoRPk8swRd8wtGjU5igaV-pmBtpdpVPwiWRtUviFS4CJse-DQRt4XGm6KOmF6-aDjINj-9TUE6PguiwX6Udn0ujG8Ks_TUQ3kZwqurjmlMvc41rmPQHeQjJvs6tGeOA9w4axet5wLb05KayegBfH_-hpTs8HUQLze-eJANTntbFK2nU_AFUyj7Lu4Flw5Rb4S4UJGKuFOcd8GzLDdFCpXrox7BvzP3f8MAZyHmyHmDUxLaHc34l_Dvf0134npOzIKa9mKVXLSFL3Z0fxEVB5i4LVg2He3fMYFg7w2e5uxshrGP8XSSVYTBqNtZ4GlKi0Sil141ik-zPavR90cJh4Ywp_uV0LaMNjA4hWtPPK36Z-ueDFloWz1971VZSA8w3hnxtWhGDaQO9UndiR5MpwABT0WyljatZuLTzahv2iXy4puweXXEcnfyN94mrm9yeewuHo60lNrm_ciFYVy2Y3MH3JuWpOB7qjfB44NOmiObKv_2KnTFu-qVU-hvgiDZJAMrqzROXalOpbY9nPulE56VZ3qvAUp6wKATvkUSlAToLeVflgUM5-Lt7UvvN7fHS9vayysSYMpg8zSVxR4Z1R1na3ZKsH0bSOiWwYWCeRh5A1ERlKVWfBO2ViYzxLl6scBpTRKM83yb5jPsDJO6Vas2eNOFLLGAqu_LkXpyTNDODKyy7Ug

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 171ms
171ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 27 Nov 2022 05:18:53 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 55FA 13 KB
5 KB 49ms
44ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 28386
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 21:25:47 GMT
expires: Sun, 26 Nov 2023 21:25:47 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CE11 783 B
1 KB 152ms
53ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

84f3b533341eaa0cefaf601ba99a41f8c51b8127a30b681d11375a24113a7b27

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Vv10Rdc0ajXD5SOj1PRynw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.zarplata.co.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-Vv10Rdc0ajXD5SOj1PRynw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 27 Nov 2022 05:18:53 GMT
expires: Sun, 27 Nov 2022 05:18:53 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 55FA 36 KB
16 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 17:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40737
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 26 Nov 2023 17:59:56 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CE11 0
0 78ms
78ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221110&jk=4103470979128758&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 55FA 0
10 B 43ms
43ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?x8khKA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 05:18:53 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 043D 42 B
64 B 81ms
80ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsufyqGY8UabnIpEaofcrYbJ-rIjlfvFbrzMao490OzMIqcmNPUcBO_mi2VAn6t9XN5YJ8fAjfjZfIudyiORjCUnGQQXEkmNs4dIA_4AcK2hkEdRmYneZyDP6UOigcQ9uJmQ_yQi-g&sai=AMfl-YRJL4l4ZkDi6u3-GhYJZS1AOkA-hZ5j1IicKBGkvJZkmNE9tcOSopdGf4kEByWt7YpBIlUNno1IUKaq2QE&sig=Cg0ArKJSzI4YlQQStzi0EAE&cid=CAQSGwDq26N95cJQTT8XC-AMzvwxCwjWRP69HygPbxgBIBM&id=lidar2&mcvt=1000&p=0,0,600,300&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=0.66&if=1&vu=1&app=0&itpl=20&adk=2307036630&rs=2&la=0&cr=0&vs=4&r=v&rst=1669526331904&rpt=922&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2A78 42 B
64 B 82ms
82ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstDD27V9dcoWLrcCQ6FLcraWNNshglP3LjxPCC2E-_bOG_ZR6DVEFO_MNs8tBEuSjeiv5z-cxp3nSZUX1wwrF1xNkUkUtQPKqawaDY8XSKrMXyh_XqiropMaP7BhR8JQAWQgYX5rw&sai=AMfl-YQ4_RTOyWC-2jYS1kqqD7mbj_pKJ59bjWXHaP50EXTZK1DYhpAZO_2tjC2rJC3-uXLuYu38MuihKooZYgI&sig=Cg0ArKJSzNy0U7hgWyEkEAE&cid=CAQSGwDq26N9QleHYaN2PjzAwgSiwUG7Rp-9pudUSBgBIBM&id=lidar2&mcvt=1002&p=0,0,90,728&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=927460884&rs=2&la=0&cr=0&vs=4&r=v&rst=1669526331897&rpt=915&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 14B2 42 B
64 B 80ms
80ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvkAiPYXMTukrpPqh1QTU_TechnPS-uVhmax3OmAhrMS3OFva6PiyZJ9mQpg6Ez9ldpUr9umIu_eEN8j6ZcZ1Ab4rfchY4uutnzA8Rc3Cxlhf-lRdT-Y1xm6fuU4ycDV-dmwOiSEA&sai=AMfl-YSkGY0WZA3geP9Y8-1OGz_7OQ7aEQA5Q7PF2Q1LVvx76cM524dx0oDttQTrAQnRGXZ2cuiuaufu2wil6r8&sig=Cg0ArKJSzAmx3a3VvAmbEAE&cid=CAQSGwDq26N9_RvpnGlYBQs1c_hCpp-rO4IEs9quhBgBIBM&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=394,899,1000,1000,1000&tos=394,505,101,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&vs=4&r=v&rst=1669526332429&rpt=409&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Nov 2022 05:18:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 83ms
81ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221110&jk=4103470979128758&bg=!LyylLGjNAAbvMpMzzzI7ACkAdvg8WgGuvZ-ynczvmBrGol8rT_PsrzOoCUupxXbvQ7rLk-3BP9jzLQIAAABXUgAAAAloAQcKAGqjZmFWU-xmftraQfz2NKmOsSXFrV84b0Cjh1XOAagTSdhCa8dH8AqEBWdEokkjABTwzJqHipa__njfuwRIppUqsi8gqCSTjkG57R3YJ2O3ln-j0PsU6mEhReKsjl6hxMUctkftbWTJAw0dmQKVL9kCcWVIJd68fTF9-IG0mYkJnDM4RVy4hMD50Tionv31B7TAH9EYQoapHvSyC1w63t67sCfUjJ1XM26Hfi08p35CmWDhCdvBf1U5YFSgkdAISwNRWpU1TB0N9V8Hf2k_bTvhpZXNRkkdl-4Jt5nIpRCKIYHxhGtg3jPe4rvlmABzwQYPdCbthkL-feoj2r0tw8weM1iqJg2deBtYuOMMUvTvy4eXxG-SosUmKcGJ9kyA5P_Py1c5yx0uU5Y79cuklWUeENENtVNJ1RljbvR-tfLd4j2XkolpEPmYGlmXvlnjj_QbdEVXkyPGqRVf7IuH2k-R27cp4atnSLDmOraPzn60TcW9CjkWn9XrgyKpQskiHC8znnqol0lcvk7zQDKjh3HLzWRni7MkZxLx1ykZf18bJPfLjRYisdKLwzUx03FDcsn_v_lgWVjNzupOqZVH7XO0B_dVJpU2jELQxv9m0K9a8SSpV_BkSWGLYd2303vs8g224KlH5G-DW61BgocjOf7mGuOh2twAjScg9tQgQHqRu1KlYQt18-HxicmEQxa9GLo4C5lIEdy3RaN8qzUEBzs8ZOB7hZ-ywsJ1i_mRE8wy4L8KbDk84w5YD38GD9JhKUnC5tb0snjjnr79bX0k9jWBv6k9x_vJ39DEp3PjQaUewUpl2i9l0hV7fsOkHsmDrh5F0Q7WVUHSMV1W-l5NexDv2GhRbRld54tENdGswRJqevsJP0O_9D87bMq3KAp3fOmeElrYnkdE-9vOet3OZi5AGwnSqVyCKxOo9CridwqI923Gwl7mC195zx1Eb69GFIvp6tj64JTP8RzL2XE_x1HbHtVca1aflocNzkahZwMDq_v6VUA0xba3_pXuwiRmG6AKXQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://www.zarplata.co.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: d31j93rd8oukbv.cloudfront.net
URL: https://d31j93rd8oukbv.cloudfront.net/metrika/watch_ua.js

Verdicts & Comments Add Verdict or Comment

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.zarplata.co.ua/	1970-01-20 17:21:26	Name: _ga Value: GA1.3.1339064746.1669526332
.zarplata.co.ua/	1970-01-20 07:46:52	Name: _gid Value: GA1.3.26476491.1669526332
.zarplata.co.ua/	1970-01-20 07:45:26	Name: _gat Value: 1
.zarplata.co.ua/	1970-01-20 17:07:02	Name: __gads Value: ID=d5aff4564479c2fc-2229705c87d70028:T=1669526331:RT=1669526331:S=ALNI_MbH95V4P6djxqBLsyMNo_EK3XRoJw
.zarplata.co.ua/	1970-01-20 17:07:02	Name: __gpi Value: UID=00000b88e4973eff:T=1669526331:RT=1669526331:S=ALNI_MbP9GlubOsoa2bWsnEtwuwjLlTyqw
.doubleclick.net/	1970-01-20 17:07:02	Name: IDE Value: AHWqTUmyw1n0Nvb5RluYTNNSxMfbQ3Kees65GdZMHDn51Xxzbek3jsWN8InrdW30Zjs
.casalemedia.com/	1970-01-20 09:55:02	Name: CMPS Value: 3380
.casalemedia.com/	1970-01-20 09:55:02	Name: CMPRO Value: 3380
.adnxs.com/	1970-01-20 09:55:02	Name: uuid2 Value: 5210770844438577578
.casalemedia.com/	1970-01-20 16:31:02	Name: CMID Value: Y4LzPE.F3AR9y2JlJKlzBgAA
.adnxs.com/	1970-01-20 09:55:02	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In4gp+t@!]tbPl1M>e)ZlrFUfJ+tGXxo7SGRLNLK!4Z8NXBa_v69asDo>`dWNMm2m6tbpRzqF1`b`QJ*:/#%

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://d31j93rd8oukbv.cloudfront.net/metrika/watch_ua.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.co.uk
adservice.google.com
cm.g.doubleclick.net
connect.facebook.net
d31j93rd8oukbv.cloudfront.net
dsum-sec.casalemedia.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
pagead2.googlesyndication.com
partner.googleadservices.com
s0.2mdn.net
sync.teads.tv
tpc.googlesyndication.com
us-u.openx.net
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.zarplata.co.ua
zarplata.co.ua
d31j93rd8oukbv.cloudfront.net
104.111.242.245
142.250.181.226
142.250.186.98
185.80.39.216
2a00:1450:4001:800::200e
2a00:1450:4001:809::2002
2a00:1450:4001:80b::2002
2a00:1450:4001:80b::2006
2a00:1450:4001:813::2004
2a00:1450:4001:827::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2002
2a00:7a60:0:1055::1
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
34.98.64.218
37.252.171.85
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
07c45dc5395f6cd0d45f6bfa2674bad171ac1b1e5c9428dae975249b1ecf940d
091ad0461b3d8801ba0e737c168d00162c2ef8fa5181bc8705fcc366ea3123f1
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0de25efd930b02fd449159ebccd63c0bca2558b7812d8f66a7e24c7c79bb1d46
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87
1fd07881ff52c7fe5772035169fa9bd11f0db238c977b4be19ff36f964c45595
2453805ee1836744dceb53d68e7ba9c3f34badae017dd532cf18b81c3b85e087
2972577f55b5ffcea533c9732c1bd10accb12512870d74214b53469db8b84b0f
2c0d210973ef664ad56411aaa13fb0082d986564a70b0945fd6b9e376651c4a8
2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5
304ed07f9851d6485954ee24e5f98931a19cca21ed558f169712b8aa6fb13000
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3f1814518564a4817006cbbc23340939c4bde9104e8cd0c06c6914bdfc4bb7c8
44b3163f460f1c9f882ebfb6173b76a6a926d3d75a5f03d94e0fd534231dfc7c
4a1e5a63fae6dff3176fff767ab6a3617736fb3749ea97ec37dda6774490c98e
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d72dc6b2df6c67009634ddd8b536a85d8aa3062303090ce3c172f6c9094abf9
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5d68031ee75996d47232dbb267e2398813e26c7aea36a15931cb3ccfc281a6db
60c66f214f69fc809429b26102b2eab18214327382ea2508702b4e53a975507d
60d47122b1a34d8f911c2e82f992ac471881594d657e6b88ee81481ceb720705
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63ac627ea510fd25d6cfbc6f48b39fa488e7bbd3da7224e354b3324e92fcd6b2
67efe2b88f4bd39d89cb48ad50c00a1e703c78e48e7ac86ba8593a2173f61e99
750abf47367b9997bc860b7bc559dff05eebe900ebf78a8b33d3b43a782ffd71
7694092db9514c6643c47d692e5ac7bc1c924c3aa712c8ae4504a5cdd6cfb420
78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53
7fd23821665e155abd3b9a4fa293abc62715508d6e35e49fea5ac330b28df465
84f3b533341eaa0cefaf601ba99a41f8c51b8127a30b681d11375a24113a7b27
8506505979ebe8ca52756ac41824ff956e25f90e6af724d8fd038f7576d9c9cc
8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d
91af42200b22fcc1ab74bf28021efc28451536eba12e2856a3604c002ea4da9d
9b680dc294467de91ef84a91cf380e67e9fc69b8b2a5baa6991c9cdec466c53d
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a557c40ebf092ba76950ab7044ebbab32bbf485afc8c6507cae5b93945d00718
ace4b2c9e31d93d658e30aae396491c0bb393514ee0d1426b6abe71a4e925c8e
ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b32c78f8efa1f0a9f18f7f4925e8704d672b8b9c67e955367fe9f54650dfbf71
b3a9c079962ceaf1a02159487a57a5c6379df0567dc6742914ed489a1eaadaf6
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b43cfdf5ce34f3d6daea195e25442ad28f4e08b6512e731116d37d71c55f1377
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c3a4cab1452215e2b919b01a35053e875a544c17ec3e5b5de8035163daaf629c
c480ef9ac6113a8801e66caef02a0137e4e9e68e8c9fa3494e0bc1f4df22b8f2
c4cd126b21a4a71df6b2eb9210d37eca993c879b5fff2eb5808741c5b3069d03
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
ce64de193caea884bd4d4a7723933ab844506b7a62ec35c52911e72588c0e62f
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e0521ba97e5480555c2cd91084db75dcec219911b2c4d23a4c771d2eaf0ba0a4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec62de9c54033f0163588e9d274e822708dc8e6d11c0b62cdd6c6fb16331df6d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f960374da81d06bb0b99e0f360eb9441066894f867e3d7e9a11e4808e258bebf
fbba2bcc7c593e366ad34e8a5f752fd9077431c191e51dc23ed8784c38d8247d
fca88c737f86d0b13a80127030497129417e6b9f2290272cc88da2f450ceda86

www.zarplata.co.ua Open in urlscan Pro 2a00:7a60:0:1055::1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

113 Requests

68 %HTTPS

67 %IPv6

16 Domains

21 Subdomains

19 IPs

4 Countries

1305 kBTransfer

3536 kBSize

11 Cookies

1 Outgoing links

Page URL History

Redirected requests

113 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

www.zarplata.co.ua Open in urlscan Pro
2a00:7a60:0:1055::1 Public Scan

Screenshot
Live screenshot

Full Image

113
Requests

68 %
HTTPS

67 %
IPv6

16
Domains

21
Subdomains

19
IPs

4
Countries

1305 kB
Transfer

3536 kB
Size

11
Cookies

113 HTTP transactions
3 data transactions