sci-hub.mksa.top Open in urlscan Pro
2606:4700:3033::6815:35c2 Malicious Activity! Public Scan

URL: https://vk.com/sci_hub

URL: https://twitter.com/Sci_Hub

URL: https://www.facebook.com/sci.hub.org

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sci-hub.mksa.top/ HTTP 301
https://sci-hub.mksa.top/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

https://counter.yadro.ru/hit;PLUSO?r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1 HTTP 302
https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

Request Chain 44

https://p1.ntvk1.ru/nps HTTP 302
https://optinder.com/cro

Request Chain 53

https://dmg.digitaltarget.ru/1/7230/i/i?i=728143354566552.956525525174153&c=tg:adcm_pc HTTP 302
https://dmg.digitaltarget.ru/1/7230/i/i?i=728143354566552.956525525174153&c=tg:adcm_pc&q=scc

Request Chain 54

https://dmg.digitaltarget.ru/1/6534/i/i?i=728143354566552.110851088993452&c=tg:adcm_pc HTTP 307
https://dmg.digitaltarget.ru/awg/custom/6534/i/i?call_source=awg&i=728143354566552.110851088993452&c=tg:adcm_pc HTTP 307
https://fnc.rt.ru/1/6532/i/i?i=MbxLyyRXMpHidnb7ngyW&c=tg:rds_6534 HTTP 302
https://fnc.rt.ru/1/6532/i/i?i=MbxLyyRXMpHidnb7ngyW&c=tg:rds_6534&q=scc HTTP 302
https://dmg.digitaltarget.ru/1/6533/i/i?i=649641001586998172429000000018432466&a=774&e=5B7rn6moi5l15555KM3t

Request Chain 55

https://dmg.digitaltarget.ru/1/1086/i/i?i=728143354566552.341964512799070&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:duSozvyYdqrSPe5yekLKybmB.xps:xpspdRfPo2nxZULvGGJBeFx4U.xga:GA1_2_400089558_1623091074.xgid:GA1_2_1092137479_1623091074.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_init%20adcmjs_noorient HTTP 307
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=728143354566552.341964512799070&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:duSozvyYdqrSPe5yekLKybmB.xps:xpspdRfPo2nxZULvGGJBeFx4U.xga:GA1_2_400089558_1623091074.xgid:GA1_2_1092137479_1623091074.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_init%20adcmjs_noorient HTTP 307
https://sync.bumlam.com/?src=amb2&uid=.n-GteBXMrLtQIH7ckE0 HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABiDz_mFBlIF4-CkuQViFC5uLUd0ZUJYTXJMdFFJSDdja0Uw HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARiDz_mFBlIF4-CkuQViFC5uLUd0ZUJYTXJMdFFJSDdja0UwogEQeWSSose_EeuKUwzEem0v7w** HTTP 302
https://sync.bumlam.com/?src=amb2&s_data=CAIQABiDz_mFBmIULm4tR3RlQlhNckx0UUlIN2NrRTCiARB5ZJKix78R64pTDMR6bS_v HTTP 302
https://sync.bumlam.com/?src=amb2&s_data=CAIQARiDz_mFBmIULm4tR3RlQlhNckx0UUlIN2NrRTCiARB5ZJKix78R64pTDMR6bS_v HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=.n-GteBXMrLtQIH7ckE0&extra2=amber&extra3=ext HTTP 302
https://sync3.sniperlog.ru/?src=ggl&extra1=.n-GteBXMrLtQIH7ckE0&extra2=amber&extra3=ext&google_gid=CAESELfAObVLB-Ovd8UcSjucktA&google_cver=1 HTTP 301
https://sync.bumlam.com/?src=ggl&extra1=.n-GteBXMrLtQIH7ckE0&extra2=amber&extra3=ext&google_gid=CAESELfAObVLB-Ovd8UcSjucktA&google_cver=1 HTTP 302
https://an.yandex.ru/setud/adsniper/ED18EB90907E21B7?sign=1979826831 HTTP 302
https://an.yandex.ru/setud/adsniper/ED18EB90907E21B7?redir-setuniq=1&sign=1979826831

Request Chain 56

https://dmg.digitaltarget.ru/1/1086/i/i?i=728143354566552.270439723030078&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:duSozvyYdqrSPe5yekLKybmB.xps:xpspdRfPo2nxZULvGGJBeFx4U.xga:GA1_2_400089558_1623091074.xgid:GA1_2_1092137479_1623091074.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_noorient HTTP 307
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=728143354566552.270439723030078&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:duSozvyYdqrSPe5yekLKybmB.xps:xpspdRfPo2nxZULvGGJBeFx4U.xga:GA1_2_400089558_1623091074.xgid:GA1_2_1092137479_1623091074.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_noorient HTTP 307
https://vk.com/rtrg?p=VK-RTRG-956930-7bGhv

Request Chain 67

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF9CGw6ki-cUx4AZTU-1mPE&google_cver=1

Request Chain 68

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL5ng9F.50eXgjJQkv75QQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2

Request Chain 69

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEOjzo4UcSQLt2WoBDODAQAc&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEOjzo4UcSQLt2WoBDODAQAc%26google_cver%3D1

Request Chain 70

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg5MDY3OTk2MTkzNTE0MDk5

Request Chain 72

https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D HTTP 302
https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1

Request Chain 116

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1

Request Chain 117

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL5ng9F.50eXgjJQkv75QQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2

Request Chain 118

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEDosHQOxUpa-ENzKeNXjRDg&google_cver=1

Request Chain 119

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMzkyMzE5Nzg3ODI0MzY0MA%3D%3D

Request Chain 147

https://groupelaposte.solution.weborama.fr/fcgi-bin/dispatch.fcgi?a.A=im&a.si=322&a.te=221447&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ra=[RANDOM] HTTP 302
https://groupelaposte.solution.weborama.fr/fcgi-bin/dispatch.fcgi?g.bo=OK&g.rn=956061&a.A=im&a.si=322&a.te=221447&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ra=[RANDOM] HTTP 302
https://laboutique.commander1.com/v3/?tcs=1491&rand=846634&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_ALL-DEVICES_NativeAds_REEX-jour_TRAFIC_DV360&fmt=1x1&adgrp=&sem_kw=&aff_id=&aff_name=&url= HTTP 302
https://laboutique.commander1.com/v3/?firsttime=1&tcs=1491&rand=846634&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_ALL-DEVICES_NativeAds_REEX-jour_TRAFIC_DV360&fmt=1x1&adgrp=&sem_kw=&aff_id=&aff_name=&url=

Request Chain 154

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

157 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
sci-hub.mksa.top/
Redirect Chain

http://sci-hub.mksa.top/
https://sci-hub.mksa.top/

29 KB
6 KB

550ms
550ms

Document
text/html

2606:4700:3033::6815:35c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:35c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84b5229d1afc0962f11d27c8875317a0d92da419a5e6e2cf0ad02934e6f943ab

Request headers

:method: GET
:authority: sci-hub.mksa.top
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding
expires: Tue, 08 Jun 2021 06:37:54 GMT
cache-control: max-age=43200 no-cache
x-cache: MISS MISS
cf-cache-status: DYNAMIC
cf-request-id: 0a895d6a1b000005d43b2dd000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=buptgtW1C4oIOagZ6FKmMfFaK%2BlU4yfrr8YAf828ORypVK4cQLcxhiFzFfazQruTJtTT83HEYsaknqXsbfYv%2BHcH%2Bl9SUygUdDY8EkGuArFv8zj6sElpABTYBUMcrc2LfxwyoTFGG4PuRA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65bbfe89cec705d4-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

Date: Mon, 07 Jun 2021 18:37:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Mon, 07 Jun 2021 19:37:53 GMT
Location: https://sci-hub.mksa.top/
cf-request-id: 0a895d6a0c00000eafa02e1000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=caoEsUnrh0CujZjHtu9iHHr9jrjyOPB1SZbO4WDe8pmhf4GH9JWnq4wuoG95ja8kZb6IGnHblWpEtTfLM0KfYQ6opU4130TQhW%2FQ9FzzT5tycb%2F6H5dBMkPSvWkmHYTyRNmhh%2FcabFtlhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 65bbfe89ad8a0eaf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 jquery-3.1.1.min.js Show response
img.sci-hub.shop/scihub/ 85 KB
29 KB 43ms
43ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/jquery-3.1.1.min.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212638
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a895d6c4900002b59b3a75000000001
last-modified: Fri, 30 Nov 2018 04:24:28 GMT
server: cloudflare
etag: W/"5c00bb7c-152b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=z7Y6MF6qDUivMma8ubiHqh%2F82fLdK1yoNTLg7nypaA8CKoWrRpe4eq7kuXNbtwlMYa7%2Fg5bCC8dtZdOd6eYgHc8cn1vxXhrs5OmsNohQ%2BEc23CglwR0YTbkFolnyI4nK5SfC%2B37mhoMsWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65bbfe8d4d9f2b59-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-ui.min.js Show response
img.sci-hub.shop/scihub/ 248 KB
63 KB 33ms
32ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/jquery-ui.min.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212638
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a895d6c4900002b59da031000000001
last-modified: Fri, 14 Dec 2018 08:14:20 GMT
server: cloudflare
etag: W/"5c13665c-3dee4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=eWVDiTPR5Z%2BGipllUzPpLwOdF39%2FfZkYiP0AuR7vEv1LRS4AGCY0MUqaYNcBNQXD27qkSYmGxYZsTyDdCSKdrSRbP11w0aHEMSguIvnI6xHXBsnn7eDuQN0dkcB8WDD0oOyTjOd0cz4otA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65bbfe8d4da42b59-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 openapi.js Show response
img.sci-hub.shop/scihub/ 94 KB
22 KB 35ms
34ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/openapi.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e319892f7f2a6e0a6790ff3274eaec39df67d671429aef64ae798ef6792b6fe3

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212638
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a895d6c4900002b59ea81a000000001
last-modified: Fri, 30 Nov 2018 04:24:44 GMT
server: cloudflare
etag: W/"5c00bb8c-1798d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AELVHbRLShTB77K0xXVH31kWW4LBjbho56jJr9nRSn9I0ROW%2BxdaCZAycTZBNftGAw15%2F%2FfHedzrpRzb37d6fuVHXdh%2BR91jBk0YTyR054ngzl5MBsQZGkIt%2FB7Mxz0Fx91517babtcBHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65bbfe8d4da52b59-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 medal.png
img.sci-hub.shop/scihub/ 22 KB
22 KB 24ms
15ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/medal.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8dd6c570e8d8c98ebe983228777f11a9f0e195c2d2f8298c034766ccd2d3087c

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212638
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 22275
cf-request-id: 0a895d6c7b000005e46b1ba000000001
last-modified: Fri, 30 Nov 2018 06:13:38 GMT
server: cloudflare
etag: "5c00d512-5703"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iMgrAf5V%2B5kN2WTRy6LrVjlq%2Bbcc4Hp41uktLSiyTXtfKpFqzV9%2FAwMiQDg4gOvYCit5z4eXbs1UjU4O%2B5wBkQ%2BGMISDD6k6CzRSMCF%2BBkW%2B4thz37JYkS2l1nOJM0Nnr1p3f45AHR3nrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8d9b3205e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 key_1.png
img.sci-hub.shop/scihub/ 8 KB
9 KB 18ms
14ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/key_1.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b225ff2e35c8db5378d2ac271c993cbdf6c900aceec3a3eee1c31421e4dc44a

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212638
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 8428
cf-request-id: 0a895d6c7b000005e4408dd000000001
last-modified: Fri, 30 Nov 2018 06:13:40 GMT
server: cloudflare
etag: "5c00d514-20ec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gk2aGfyXQi4iuyFzUEUIgtoQNZI0gOLFWQJLjc1I0KpVrVCKO8enji6P4oPNsLCqU8da1kokUesKEBHfPMLknPBt7lUhsIo3fM8KGBSemxE0nRLUjbijgxCGpP%2FJIjBx2BPJ6VrsMua3tQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8d9b3005e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 62 KB
21 KB 32ms
32ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e9da4e1bd0dd3ef131d870b54c6b7dc124a95a70d33c58cfdff7c9cb702847b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "896 / 507 of 1000 / last-modified: 1623064336"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21367
x-xss-protection: 0
expires: Mon, 07 Jun 2021 18:37:54 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 89 KB
35 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-193456449-1

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

91ed5db8d64310a0d75583048d9f7b442505a43c5d7fb704ea956d82241377c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35965
x-xss-protection: 0
last-modified: Mon, 07 Jun 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 07 Jun 2021 18:37:54 GMT

GET
H3-29 200 top-back.jpg
img.sci-hub.shop/scihub/ 184 KB
185 KB 26ms
25ms Image
image/jpeg 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/top-back.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a50dba2bfbbfe01d25c025c5ee5acb8ce80af1707fb3b50ce82ff434be6b98f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 188646
cf-request-id: 0a895d6c8d000005e488973000000001
last-modified: Mon, 16 Sep 2019 12:17:02 GMT
server: cloudflare
etag: "5d7f7d3e-2e0e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=tYAVSizistBbzKICzGGKEae%2BLZ2F1tLDE492Wfc1nzwmoWnunpY30ctYjAlM9x6eydDllJa%2Bf2K63oKcnpiRcYSGlahI6R2wnB8aauKz91iCQIYfbYPsGmud1NnPVIwSTqhtMDmIMXIxYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dab8605e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 logo_en.png
img.sci-hub.shop/scihub/ 14 KB
15 KB 15ms
14ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/logo_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 454e4bc03b54bff4716e23ac8be68737dffd664ea64400effdc9ff4581e89586

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 14556
cf-request-id: 0a895d6c92000005e49235c000000001
last-modified: Fri, 30 Nov 2018 05:56:38 GMT
server: cloudflare
etag: "5c00d116-38dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jHC5bm3X%2F42iaFOb5%2Be9VVdO%2B%2Br5I6J4HR75nlpo3flvqZHvUQ22xk4grc7gkVjd2fRDB9kBOB1MbFZn89BVSfDwSSv1zl1vepTRPWZtOK66uBXjxbVyN1ufj0Cu%2BZhh77HHff%2B3aGU%2FpA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dbbae05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 raven_1.png
img.sci-hub.shop/scihub/ 59 KB
59 KB 40ms
39ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/raven_1.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c976023edd17ce89501bb6a4cd50277b50fc4ef4045d61b52854da88d36cb202

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 60144
cf-request-id: 0a895d6c96000005e447101000000001
last-modified: Fri, 30 Nov 2018 05:56:32 GMT
server: cloudflare
etag: "5c00d110-eaf0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0XVUe7CLFTEqcgC%2FdnZODcFBehBtqzfJeCoTQL%2FvShDih0YrLRYlbm3EWnzHSBX8dQ157vOGV13BfxFTNFhka5KwN%2FIPqjJ%2FzbL9UJSo9Ve96GdO8tPyxicSTrgKBN2kGMHR0nFZrTCNpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dbbb505e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 map.jpg
img.sci-hub.shop/scihub/ 54 KB
55 KB 15ms
14ms Image
image/jpeg 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/map.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14e6508482a47b942549d487294e164dbe8684e79a6a00410dfb966acffa9570

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 55605
cf-request-id: 0a895d6c93000005e47180d000000001
last-modified: Fri, 30 Nov 2018 05:56:52 GMT
server: cloudflare
etag: "5c00d124-d935"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HvHyowrUKSzNf2SdyxnTX0ceqSp5Pu49mfafpptNWVmcFTektxF8p%2FzlG2EzSCDGMH4t9rDuIEjlFFlDNLG48pWxivkjElpz0n4Ooy3mvPZnHakmi69QtljBdB4pAcb8ieJoG0kkSPoM2A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dbbb805e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 about-marker_en.png
img.sci-hub.shop/scihub/ 3 KB
4 KB 49ms
48ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/about-marker_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8e3e37a00f298198fe34abc7c237a0b3c21659f668e142dcf5bc467bae0de23

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3361
cf-request-id: 0a895d6c94000005e494842000000001
last-modified: Fri, 30 Nov 2018 05:57:02 GMT
server: cloudflare
etag: "5c00d12e-d21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VU4sN4S1IwHfMIMYZuqg6JHPGGUXA04QcS7gKkKr0S1lUVJVw02jmJ3nG%2B4sEkM%2FPxdQEw%2Bb32G%2F2S3uPAlNYQseIFR3yzfP%2B00nhWdJYeGjR4CXW6tVYYSP9cpcnJw80ns7FcTBMr2Kmg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dbbbd05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET AvenirLTW01-55Roman.woff2
img.sci-hub.shop/misc/fonts/ 0
0

GET
H3-29 200 quote.png
img.sci-hub.shop/scihub/ 1 KB
2 KB 22ms
20ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/quote.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f3abdf0859cf36c2821963a7266a955fd4bd5fe491f997d9d8dae3f3957cf75

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1068
cf-request-id: 0a895d6caf000005e461b8c000000001
last-modified: Fri, 30 Nov 2018 05:57:12 GMT
server: cloudflare
etag: "5c00d138-42c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zLcKqMAI7%2FzDMNFUgkPM6dMcONTg4CorMoiBZ14t5f1pND5YUeIu9U0I39K7Y23fqkAzXE%2BugtcuHTkxqocxS0O0BXq6y06TtMurVz%2BqQ%2FPHxpgqOhjzNY9H7VuB2RzLcHy8tnzh1apmAw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec1f05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 quotenext_en.png
img.sci-hub.shop/scihub/ 1 KB
2 KB 22ms
20ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/quotenext_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 460b964d7227b7963094c56a6449ed520818785ccb2eb6ecfe8be595fee74232

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1087
cf-request-id: 0a895d6caf000005e43e9c5000000001
last-modified: Fri, 30 Nov 2018 05:57:18 GMT
server: cloudflare
etag: "5c00d13e-43f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9GJZIapQ8ICEh0kAc2xOKGai%2BDb%2B9o%2F9EEhuuCgNv8%2BkrUiLS1KefxUsWKabVs7WKLKkcO7wZDJZ3Z3XPyoK3rfiwlT4YUUIm5lHk4vn1Oo%2BCSx3XWa5ucjd2bbBMPoFiwCy2mvjBNMItg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec2205e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pone.png
img.sci-hub.shop/scihub/ 2 KB
2 KB 22ms
20ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/pone.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44e857b78e5b61610566603bed79bceb9a60415b2795cfdf907346cb026d2450

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1637
cf-request-id: 0a895d6cb0000005e46504d000000001
last-modified: Fri, 30 Nov 2018 05:57:24 GMT
server: cloudflare
etag: "5c00d144-665"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=p8ypdxXmsFaNFCJkZgiSo44vdKcgiCaBzCYpaxxdCKzJaE6R99G83qs2Pd13FpZjUKIIpij6ETkEHmi%2F6Rz3EgibvtexFdDwQKk1%2BgLpyCFP%2BzU9lM8HKi47XJh7Kyy9ueMXJ9YiZ1v0og%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec2305e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 ptwo.png
img.sci-hub.shop/scihub/ 4 KB
4 KB 23ms
21ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/ptwo.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c930cfd1a633df3f92e6104e291b65534f21a32f3e1fe1d4bfb3b5eb7df17c74

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3907
cf-request-id: 0a895d6cb0000005e46e9c1000000001
last-modified: Fri, 30 Nov 2018 05:57:30 GMT
server: cloudflare
etag: "5c00d14a-f43"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dygpbGzJK6%2B0IKTUSrR5uhoQP2GQeglKOMLykUaqyewbPxtX%2F4pVZexItkdd2hbdCLWMkUAExHu8fdNqP77dsfPnXxIK39oZLtgC%2FvjI4dijknwUmeLtl9dopix%2FzZZE5xeMZA2poC5oiw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec2605e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pthree.png
img.sci-hub.shop/scihub/ 4 KB
5 KB 22ms
21ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/pthree.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff03fb35159e9cc4104b52e40b4153040df127e8cbeb3a7f351a4951b0008c28

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 4278
cf-request-id: 0a895d6cb0000005e496038000000001
last-modified: Fri, 30 Nov 2018 05:57:36 GMT
server: cloudflare
etag: "5c00d150-10b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=f9amtKT38ozSh3dryZPogI93b58orZo3iW8cdAXvXTHRur8Nl9%2F5jLh7nqnD576KydkLum96a03L5GnyE5%2BYKC6ImPKPnCo5bGmWaklflit6peNVhFeXtllax7xz0XevYwBEvXfa%2Blz0vA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec2805e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 people.jpg
img.sci-hub.shop/scihub/ 50 KB
51 KB 23ms
21ms Image
image/jpeg 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/people.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46dcb8cb7d4d80220baa300c65817e9a4a324c15ddb1e3955d222175eb6cf8c9

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 51212
cf-request-id: 0a895d6cb1000005e46b1c1000000001
last-modified: Fri, 30 Nov 2018 05:57:56 GMT
server: cloudflare
etag: "5c00d164-c80c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LSCV79c3Ii3wcEEVzhyI8mP09FaqGJ4qcogSTT8l9RBy4v%2FI2bvcblXIHvwZmdsilxQ%2BaiKz%2Be0CsMNEAmWeE%2FxLM2DkMmpA13h8LyBfxQj%2B2g4gaShVl3cwhwpYrB7ipVbdLhMdr113hA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec2d05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 join_en.png
img.sci-hub.shop/scihub/ 6 KB
7 KB 27ms
25ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/join_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3860c6aa1cdef6ed8bf7315bbfbdc1237d14f68ea2e7a55bcccb9e77662d1b7f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 6197
cf-request-id: 0a895d6cb1000005e4461a4000000001
last-modified: Fri, 30 Nov 2018 05:58:24 GMT
server: cloudflare
etag: "5c00d180-1835"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MmqxobpL4DeFPSoflY61Xk5XGlZLISYkfXP1g7GoTG2pgZVI6F8bQii7pxqUkSfBcBRsgBT2FwzX4aYAxCSR2bqtGywpIcQn8xkdgMZKS8vcXqqXHuZTt2vSGwtvqbg3rTVk5dWBkxINFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec2e05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 joinvk.png
img.sci-hub.shop/scihub/ 17 KB
18 KB 27ms
26ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/joinvk.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c065fb78b0e08dfcca754d46f64414bff72a17836b5da8f717e48423fd4e5952

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 17834
cf-request-id: 0a895d6cb1000005e47689c000000001
last-modified: Fri, 30 Nov 2018 05:58:30 GMT
server: cloudflare
etag: "5c00d186-45aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Odm19C0tr6OGfttPgQcPIlfKWIWs4fMeF6oxg534LYJ48nEyncFg%2BdjXeUt7jmVTLR1UkJuFqfjIkjQRx8O0O3Z6vnQLHAkxDAH1k9rE3L73wqV69eJtWEIq4MUdORynidmrZ7tGm98knw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec3005e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 jointwitter.png
img.sci-hub.shop/scihub/ 6 KB
6 KB 27ms
26ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/jointwitter.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f6720f9b1b728e80c6f618a5aac450c6f6df834dd8f0e8b4059ac78a90af7af

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 5751
cf-request-id: 0a895d6cb1000005e472b92000000001
last-modified: Fri, 30 Nov 2018 05:58:42 GMT
server: cloudflare
etag: "5c00d192-1677"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=m2Pad%2BgFocYUCnaTaLXxU1ElKKixON1fZhnKGxqkX2V1zBLYK3m%2BP4Z5JBumTkounqc%2F41rWnOSENx3h9efmwV9PFJnWiD04QP95SEmiNW7HD2%2FTpYY0VXuuxB2Rynvbs3zOPF1n5J%2Fl7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec3105e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 joinfacebook.png
img.sci-hub.shop/scihub/ 4 KB
5 KB 27ms
26ms Image
image/png 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/joinfacebook.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dabaf1eee4ae1c1db524c66d6950221386ef064a71d29b9f799d1905d64456b6

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 4152
cf-request-id: 0a895d6cb1000005e49235f000000001
last-modified: Fri, 30 Nov 2018 05:58:36 GMT
server: cloudflare
etag: "5c00d18c-1038"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qY9ieLmA09QMJshbkU5QEZMz9%2BJ9DQiaC6wedfJ03TBERFe4tn70k7%2F%2F0JTYXCAM0kYqDVnQ1BimKPu94JhXNuq7Ef5oVBz%2B2laalU3cVKXR1mywp8E5cecFKYrIwC1HGRkGPAqreb43tQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65bbfe8dec3405e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pluso-like.js Show response
img.sci-hub.shop/scihub/ 41 KB
12 KB 14ms
14ms Script
application/javascript 2606:4700:3033::ac43:a162
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/pluso-like.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:a162 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 125ef9e8cac071be547016f215e726b1f17be04068441bb35847bf565c89e4c3

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 212637
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a895d6cde000005e46a297000000001
last-modified: Fri, 30 Nov 2018 04:39:20 GMT
server: cloudflare
etag: W/"5c00bef8-a5cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=diortKeQ87%2BnQAWaN0SApNBLcnX6DdpCIEaBSZuOsXb%2B095FMqB%2F%2FSgRExTZmb0LQ2CFwQU7%2FPMHV4lkea3c8ITR7l%2FQUCxmSXEF%2BHTTzATeR6zfnv5BjRNXX44B6G%2B5soQvaYe3iTD1%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65bbfe8e3cdf05e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-193456449-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 5191
date: Mon, 07 Jun 2021 17:11:23 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Mon, 07 Jun 2021 19:11:23 GMT

GET
H3-29 200 pubads_impl_2021060701.js Show response
securepubads.g.doubleclick.net/gpt/ 318 KB
112 KB 41ms
39ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

094c1111eeb737673d376e2598c9abfad2c1dadeab91522940bbf5d2ff512a72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Jun 2021 08:45:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114129
x-xss-protection: 0
expires: Mon, 07 Jun 2021 18:37:54 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 27ms
13ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1621665388&t=pageview&_s=1&dl=https%3A%2F%2Fsci-hub.mksa.top%2F&ul=en-us&de=UTF-8&dt=Sci-Hub&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=321640573&gjid=1435103563&cid=400089558.1623091074&tid=UA-193456449-1&_gid=1092137479.1623091074&_r=1&gtm=2ou621&z=1491169815

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
67 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c07::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-193456449-1&cid=400089558.1623091074&jid=321640573&gjid=1435103563&_gid=1092137479.1623091074&_u=YEBAAUAAAAAAAC~&z=823597551

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 07 Jun 2021 18:37:54 GMT
content-type: text/plain
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=sci-hub.mksa.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=sci-hub.mksa.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 1637ms
1636ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2367052592099241&correlator=1472533303604574&output=ldjh&impl=fifs&eid=31060783%2C31061385%2C31061142&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210607&iu_parts=22149012983%2Cycykh-ndd%2C970X90-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x90&cookie_enabled=1&bc=31&abxe=1&lmt=1623091074&dt=1623091074415&dlt=1623091074115&idt=277&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=900&adks=1836978441&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x0&msz=970x-1&ga_vid=400089558.1623091074&ga_sid=1623091074&ga_hid=1621665388&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

156cdbab2fec7f80453428ed99d0e8f63403bf7d397a63a495079ae604f8b3e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:56 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7896
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 126ms
51ms Other
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 646ms
645ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2367052592099241&correlator=1472533303604574&output=ldjh&impl=fifs&eid=31060783%2C31061385%2C31061142&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210607&iu_parts=22149012983%2Cycykh-ndd%2C336X280-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=336x280&cookie_enabled=1&bc=31&abxe=1&lmt=1623091074&dt=1623091074420&dlt=1623091074115&idt=277&frm=20&biw=1600&bih=1200&oid=3&adxs=632&adys=1552&adks=2992418410&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=528x334&msz=336x-1&ga_vid=400089558.1623091074&ga_sid=1623091074&ga_hid=1621665388&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fabb5c862da76d443a8f03f201d7407c3d12c5aa29c31b39b58d087146689cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8886
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 472 B
283 B 351ms
350ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2367052592099241&correlator=1472533303604574&output=ldjh&impl=fifs&eid=31060783%2C31061385%2C31061142&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210607&iu_parts=22149012983%2Cycykh-ndd%2Czsy-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50&fluid=height&cookie_enabled=1&bc=31&abxe=1&lmt=1623091074&dt=1623091074421&dlt=1623091074115&idt=277&frm=20&biw=1600&bih=1200&oid=3&adxs=426&adys=2192&adks=1528813087&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=748x120&msz=0x0&ga_vid=400089558.1623091074&ga_sid=1623091074&ga_hid=1621665388&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4aff3200b944d24767703f82efe1c19800d30322a32ecbfc0bb1818f5da3830

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 64 KB
15 KB 1883ms
1882ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2367052592099241&correlator=1472533303604574&output=ldjh&impl=fifs&eid=31060783%2C31061385%2C31061142&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210607&iu_parts=22149012983%2Cycykh-ndd%2Czsy-youtu01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50&fluid=height&cookie_enabled=1&bc=31&abxe=1&lmt=1623091074&dt=1623091074423&dlt=1623091074115&idt=277&frm=20&biw=1600&bih=1200&oid=3&adxs=430&adys=2192&adks=3809152490&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=748x120&msz=0x0&ga_vid=400089558.1623091074&ga_sid=1623091074&ga_hid=1621665388&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

7c673a030b4e24a9e4a4b6de19aa9bb56f4f978b9cf380a728eff5c7e5962267

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:56 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15100
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK process Show response
share.pluso.ru/ 119 B
466 B 281ms
60ms Script
application/javascript 37.200.67.211
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://share.pluso.ru/process?act=counter&u=https%3A%2F%2Fsci-hub.mksa.top%2F&w=1600&h=1200&ref=&uid=5473046666911051876&k=Wt0ZL09FMbJvVvBI&first=1

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.211 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

bdd4003804f6ce8052531178f70d642ad8fdc912033665ecc0b38163acd16b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:39:40 GMT
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 119
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK process Show response
share.pluso.ru/ 119 B
466 B 279ms
58ms Script
application/javascript 37.200.67.211
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://share.pluso.ru/process?act=counter&u=https%3A%2F%2Fsci-hub.mksa.top%2F&w=1600&h=1200&ref=&uid=5473046666911051876&k=quRwpS9vfZFdqkuS

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.211 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

bdd4003804f6ce8052531178f70d642ad8fdc912033665ecc0b38163acd16b9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:39:40 GMT
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 119
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

hit;PLUSO
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;PLUSO?r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1
https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

43 B
496 B

69ms
68ms

Image
image/gif

88.212.201.210
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

88.212.201.210 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host210.rax.ru

Software

nginx/1.17.9 /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:54 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 06 Jun 2020 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:54 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sat, 06 Jun 2020 21:00:00 GMT

GET
H/1.1 200
OK 06.png
share.pluso.ru/img/pluso-like/square/medium/ 23 KB
23 KB 320ms
95ms Image
image/png 37.200.67.211
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://share.pluso.ru/img/pluso-like/square/medium/06.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.211 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

a88d699bbf9f25fa9a614e4af43982e1096bd9f918a3f5adcaace243ae5cfebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:39:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Apr 2015 11:02:40 GMT
Server: nginx
ETag: "552ba250-5b8f"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 23439
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK plus.png
share.pluso.ru/img/ 2 KB
3 KB 281ms
54ms Image
image/png 37.200.67.211
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://share.pluso.ru/img/plus.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.211 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

784eb14774a9a419af32c02c2d16cf197ef2701afc2ea65b58c3a574ed5458bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:39:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Apr 2015 11:02:40 GMT
Server: nginx
ETag: "552ba250-98a"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 2442
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK kb.js Show response
kitbit.net/ 1 KB
2 KB 61ms
60ms Script
application/javascript 31.131.252.94
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to

Full URL

https://kitbit.net/kb.js

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),

Reverse DNS

Software

nginx /

Resource Hash

c83e60da47e09d0d67648aafaf908dee840e20a285ac2ebc0f3d235e68f259a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:36:21 GMT
X-Content-Type-Options: nosniff
Server: nginx
ETag: H4P8XmC+ZyWGBwsvTtrlAg==
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Cache-Control: max-age=21600, private
Connection: keep-alive
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Expires: Tue, 08 Jun 2021 00:36:21 GMT

GET
H/1.1 200
OK adcm.js Show response
tag.digitaltarget.ru/ 3 KB
3 KB 185ms
63ms Script
application/javascript 185.15.175.159
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/adcm.js
Requested by: Host: kitbit.net
URL: https://kitbit.net/kb.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.159 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7c078e5032ba5da0fdf4e333ac30ad283aaa9de5d935e716c6fd7e1b5d4e9d2e

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:37:54 GMT
Last-Modified: Thu, 13 May 2021 10:40:41 GMT
Server: nginx
ETag: "609d0229-c11"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3089

GET
H/1.1 200
OK s.js Show response
kitbit.net/ 1 B
303 B 62ms
62ms Script
application/javascript 31.131.252.94
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to

Full URL

https://kitbit.net/s.js?u=https%3A%2F%2Fsci-hub.mksa.top%2F

Requested by

Host: kitbit.net
URL: https://kitbit.net/kb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),

Reverse DNS

Software

nginx /

Resource Hash

41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:36:21 GMT
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-XSS-Protection: 1; mode=block
Expires: Mon, 07 Jun 2021 18:36:20 GMT

GET
H/1.1 200
OK h.gif
kitbit.net/ 43 B
537 B 123ms
60ms Image
image/gif 31.131.252.94
SELECTEL-MSK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kitbit.net/h.gif?r=&s=1600*1200*24&u=https%3A//sci-hub.mksa.top/&h=Sci-Hub%26kbuid%3D5EFC831F2567BE602F0B078602E5DA4E

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:36:21 GMT
X-Content-Type-Options: nosniff
Server: nginx
ETag: H4P8XmC+ZyWGBwsvTtrmAg==
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Cache-Control: max-age=0, private, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: Mon, 07 Jun 2021 18:36:21 GMT

GET
H2

200

cro
optinder.com/
Redirect Chain

https://p1.ntvk1.ru/nps
https://optinder.com/cro

0
304 B

46ms
46ms

Image
application/octet-stream

2606:4700:3035::ac43:c8d3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optinder.com/cro
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c8d3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Jp7l%2BUVteObDtg6Kjt08efpjxTRYoz3BbaV%2FTDPntKaQbTdh3JvNHXwrWAYe4Ic3in7OnoHSz9INo%2B7SDwZaxuGdjhv%2B%2BDhxvcUQtFivzgCi1R4Tgv5tBKj3%2BAf1%2B4ukL%2B5wUxXW"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cf-ray: 65bbfe903c894e98-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a895d6e2300004e9881372000000001

Redirect headers

x-77-nzt: AcO1ry87NzSB
date: Mon, 07 Jun 2021 18:37:54 GMT
last-modified: Mon, 07 Jun 2021 18:37:53 GMT
server: CDN77-Turbo
x-77-nzt-ray: 91L4tnFcvoA=
x-77-cache: MISS
content-type: text/html; charset=UTF-8
location: //optinder.com/cro
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, post-check=0, pre-check=0
x-cache: MISS
x-77-pop: frankfurtDE
content-length: 0
x-request-id: 1231186557-1-1623091074.567
expires: Mon, 07 Jun 2021 18:37:53 GMT

GET
H/1.1 200
OK sud
ut9.rktch.com/ 88 B
88 B 190ms
65ms Image
image/png 89.108.97.2
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ut9.rktch.com/sud
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 89.108.97.2 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: d50603.reg.regrucolo.ru
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:37:54 GMT
Server: nginx/1.18.0
Connection: keep-alive
Content-Length: 88
Content-Type: image/png

GET
H/1.1 200
OK processor.js Show response
tag.digitaltarget.ru/ 15 KB
16 KB 108ms
108ms Script
application/javascript 185.15.175.159
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/processor.js?i=750106101987058
Requested by: Host: tag.digitaltarget.ru
URL: https://tag.digitaltarget.ru/adcm.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.159 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5a0da3f86d0505c67db1fb2287ce92548014d4ba7969eb76b7f716a5d5009e8f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:37:54 GMT
Last-Modified: Thu, 13 May 2021 10:40:42 GMT
Server: nginx
ETag: "609d022a-3da5"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15781

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 19ms
19ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021060701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3bdc69b51b77e67c116a44942fe69974733a401f8c3586f33640436c3dc66031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7654
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Mon, 07 Jun 2021 18:37:54 GMT

GET
H/1.1 200
OK extension_1086.js Show response
tag.digitaltarget.ru/extensions/ 732 B
976 B 61ms
61ms Script
application/javascript 185.15.175.159
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/extensions/extension_1086.js?i=893272434404277
Requested by: Host: tag.digitaltarget.ru
URL: https://tag.digitaltarget.ru/adcm.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.159 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: acde19dd39fd4b3b76819f21d622af86dcdf0cb00967a337a01005e8316ccb1f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:37:54 GMT
Last-Modified: Thu, 13 May 2021 10:40:42 GMT
Server: nginx
ETag: "609d022a-2dc"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 732

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 3483 12 KB
5 KB 14ms
13ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Mon, 07 Jun 2021 18:36:20 GMT
expires: Tue, 07 Jun 2022 18:36:20 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 94
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4EB8 783 B
760 B 17ms
16ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7c65beb9cf562fb97912e7fc041a2bd427ee648b5b172008de2e863026f4e48a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mYbV5wuvUbr40WBegmLnLw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

expires: Mon, 07 Jun 2021 18:37:54 GMT
date: Mon, 07 Jun 2021 18:37:54 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-mYbV5wuvUbr40WBegmLnLw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 3483 14 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1485
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 18:13:09 GMT

GET
H/1.1

204
No Content

i
dmg.digitaltarget.ru/1/7230/i/
Redirect Chain

https://dmg.digitaltarget.ru/1/7230/i/i?i=728143354566552.956525525174153&c=tg:adcm_pc
https://dmg.digitaltarget.ru/1/7230/i/i?i=728143354566552.956525525174153&c=tg:adcm_pc&q=scc

0
398 B

62ms
62ms

Image
text/plain

185.15.175.144
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmg.digitaltarget.ru/1/7230/i/i?i=728143354566552.956525525174153&c=tg:adcm_pc&q=scc
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.144 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:37:55 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://dmg.digitaltarget.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

Redirect headers

Location: /1/7230/i/i?i=728143354566552.956525525174153&c=tg:adcm_pc&q=scc
Date: Mon, 07 Jun 2021 18:37:55 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://dmg.digitaltarget.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

i
dmg.digitaltarget.ru/1/6533/i/
Redirect Chain

https://dmg.digitaltarget.ru/1/6534/i/i?i=728143354566552.110851088993452&c=tg:adcm_pc
https://dmg.digitaltarget.ru/awg/custom/6534/i/i?call_source=awg&i=728143354566552.110851088993452&c=tg:adcm_pc
https://fnc.rt.ru/1/6532/i/i?i=MbxLyyRXMpHidnb7ngyW&c=tg:rds_6534
https://fnc.rt.ru/1/6532/i/i?i=MbxLyyRXMpHidnb7ngyW&c=tg:rds_6534&q=scc
https://dmg.digitaltarget.ru/1/6533/i/i?i=649641001586998172429000000018432466&a=774&e=5B7rn6moi5l15555KM3t

49 B
602 B

72ms
72ms

Image
image/gif

185.15.175.144
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmg.digitaltarget.ru/1/6533/i/i?i=649641001586998172429000000018432466&a=774&e=5B7rn6moi5l15555KM3t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.15.175.144 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),

Reverse DNS

Software

nginx /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 07 Jun 2021 18:38:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: master-only
Request-Time: 8
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 64
X-XSS-Protection: 1; mode=block
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Credentials: true

Redirect headers

Location: https://dmg.digitaltarget.ru/1/6533/i/i?i=649641001586998172429000000018432466&a=774&e=5B7rn6moi5l15555KM3t
Date: Mon, 07 Jun 2021 18:38:03 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://fnc.rt.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

GET
H2

404

ED18EB90907E21B7
an.yandex.ru/setud/adsniper/
Redirect Chain

https://dmg.digitaltarget.ru/1/1086/i/i?i=728143354566552.341964512799070&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:duSozvyYdqrSPe5yekLKybmB.x...
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=728143354566552.341964512799070&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:d...
https://sync.bumlam.com/?src=amb2&uid=.n-GteBXMrLtQIH7ckE0
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABiDz_mFBlIF4-CkuQViFC5uLUd0ZUJYTXJMdFFJSDdja0Uw
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARiDz_mFBlIF4-CkuQViFC5uLUd0ZUJYTXJMdFFJSDdja0UwogEQeWSSose_EeuKUwzEem0v7w**
https://sync.bumlam.com/?src=amb2&s_data=CAIQABiDz_mFBmIULm4tR3RlQlhNckx0UUlIN2NrRTCiARB5ZJKix78R64pTDMR6bS_v
https://sync.bumlam.com/?src=amb2&s_data=CAIQARiDz_mFBmIULm4tR3RlQlhNckx0UUlIN2NrRTCiARB5ZJKix78R64pTDMR6bS_v
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=.n-GteBXMrLtQIH7ckE0&extra2=amber&extra3=ext
https://sync3.sniperlog.ru/?src=ggl&extra1=.n-GteBXMrLtQIH7ckE0&extra2=amber&extra3=ext&google_gid=CAESELfAObVLB-Ovd8UcSjucktA&google_cver=1
https://sync.bumlam.com/?src=ggl&extra1=.n-GteBXMrLtQIH7ckE0&extra2=amber&extra3=ext&google_gid=CAESELfAObVLB-Ovd8UcSjucktA&google_cver=1
https://an.yandex.ru/setud/adsniper/ED18EB90907E21B7?sign=1979826831
https://an.yandex.ru/setud/adsniper/ED18EB90907E21B7?redir-setuniq=1&sign=1979826831

43 B
113 B

60ms
60ms

Image
image/gif

2a02:6b8::90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/setud/adsniper/ED18EB90907E21B7?redir-setuniq=1&sign=1979826831

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

ccb150b1878d5aa777543222f9e47636d4258687e3dd57e625988f09a96bda64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: gzip
last-modified: Mon, 07 Jun 2021 18:37:55 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=windows-1251
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Mon, 07 Jun 2021 18:37:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: gzip
last-modified: Mon, 07 Jun 2021 18:37:55 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
location: https://an.yandex.ru/setud/adsniper/ED18EB90907E21B7?redir-setuniq=1&sign=1979826831
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Mon, 07 Jun 2021 18:37:55 GMT

GET
H2

200

rtrg
vk.com/
Redirect Chain

https://dmg.digitaltarget.ru/1/1086/i/i?i=728143354566552.270439723030078&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:duSozvyYdqrSPe5yekLKybmB.x...
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=728143354566552.270439723030078&a=86&e=5EFC831F2567BE602F0B078602E5DA4E&c=ss:86.up:5EFC831F2567BE602F0B078602E5DA4E.sync:up.xdua:d...
https://vk.com/rtrg?p=VK-RTRG-956930-7bGhv

49 B
446 B

181ms
66ms

Image
image/gif

87.240.190.67
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vk.com/rtrg?p=VK-RTRG-956930-7bGhv

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.240.190.67 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv67-190-240-87.vk.com

Software

kittenx / KPHP/7.4.107424

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: gzip
x-frontend: front224007
server: kittenx
x-powered-by: KPHP/7.4.107424
strict-transport-security: max-age=15768000
content-type: image/gif
access-control-expose-headers: X-Frontend
cache-control: no-store
content-length: 65

Redirect headers

Date: Mon, 07 Jun 2021 18:37:55 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET, POST, OPTIONS
Location: https://vk.com/rtrg?p=VK-RTRG-956930-7bGhv
X-XSS-Protection: 1; mode=block
X-Permitted-Cross-Domain-Policies: master-only
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Connection: keep-alive
Request-Time: 22
Content-Length: 0
X-Content-Type-Options: nosniff

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021060701&jk=2367052592099241&bg=!LC-lL2vNAAY6sG-_OrA7ACkAdvg8Wl4w3KS-HgMySaSNpxI-TTRrzKmB-rd0BJ0JrwyxWOPhXtCZAQIAAABjUgAAAAxoAQcKAKUKODeNiish1Wwnog1lvHHbbnpUejxTYmTNL5C8s6uIdNTty0f9Vnxo0d7bgiykMs1lp2JgOQLJ1DVvEfbirCYSuRTlwO7oTX4kit7V3oLJnC01z4VwQUNwYZYkZDOKXOKTEUn9rayaV9A7nQBYYC0wGJiu8qrOiwl1nlzeg1nNbJiN72ycIBZ_SpqUOw3oA-DbQRVaKv5Sqgixx3LvdfeJfqQprOqZAkZuvZJeeC1pKBPzbHo9W-LyHfw-PKOGKE4XNuYqzV5mFmkBli8vfo0XuNjncH1BDbjd0TBmDYK6nzVGrrA8sYbGKfpL7xgeGYGUHT1NG0uUfIqYaR9l3rcodYNGZ3SZnnloii6BMW5n1kVXQGCzg2mm-nfOBEJn5trZnfbwMEFiC8GV0faaU_dBKHdvjmKBsvjPLpdGgrs0ULAhiBwA1ZA9u7c1aN7xfJIhbE9Mf6ZFf6rTg22pi0hTRePnnt7fiomvkoHGyg_FJG2-pX3ZiG-SNM5-YFPt2TU31nktar524EsYT76wN3oonEoUNtNdg0MnSlSClMchXXM8XFcO0iC_8vnUeygN5wMORc01iuEMWQ6IGZNYkWrV4wnZ2npJP6lhn9bPsTAeMlS0XgQMCPJQgSD37-DeQx207xxgXmviIzLG_OLRjsqrqzdClWEEGa7cBL4Bok4U1SluayMNhmJUhwpnPMgCx-ouyFTSrBh7kChLD2MGU5Ha2kE8lkVz2N-GYB8Z428PvNZtdgAlu1HRit7gmsnJ153F6S9pXnBuzKQScmOyHqVMmbrttx32pGKIE6OkoeMGi1zO75s81ZIbkMoz1xNmXebCNVaOvXIDCuWTpdpLsFFN9mly0BV8X9LG4N8NQWovBpbYD40l1afZHAAWFLwooGtV494kTpXYHjSP9L37d7eAUHr8fQyaEsFO2dDuvJ5YsdIe12hWkuAxLMCf8Ty2i-u78rAQ3wikwsDakGV5_BekU_9fb_OaWKhuiAY0mrg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BCE5 6 KB
3 KB 61ms
20ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 07 Jun 2021 18:37:54 GMT
expires: Tue, 07 Jun 2022 18:37:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a06800ad719e1f1b46691ded5a5577666d2fc30f950b0ba544352ede4e25de7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622805992319560"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28149
x-xss-protection: 0
expires: Mon, 07 Jun 2021 18:37:55 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EB9B 624 B
582 B 17ms
16ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNVIWA3ZqkGITIt77WeE3JXConB-_Bxoh779n7Yg3Ln6VKMLwJpl3A40goM21dh3TayRGg_kXhnIgA1RQj-TAb4KE_rB0rftvWcK5N90HzadhOe1Vcu9Y9_kKDREnvWaF-CD7r47SenJTl0arpUUXcfv4HQYOVS5gkaK7wZuu0RMFqy1kK0

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNVIWA3ZqkGITIt77WeE3JXConB-_Bxoh779n7Yg3Ln6VKMLwJpl3A40goM21dh3TayRGg_kXhnIgA1RQj-TAb4KE_rB0rftvWcK5N90HzadhOe1Vcu9Y9_kKDREnvWaF-CD7r47SenJTl0arpUUXcfv4HQYOVS5gkaK7wZuu0RMFqy1kK0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 07 Jun 2021 18:37:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUkhqrvo_II3wWbWu3uB3mchK0Q4IUahlZx9r1hqMGs14jWsQy38HNAjTeL_; expires=Sat, 02-Jul-2022 18:37:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 07 Jun 2021 18:37:55 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DAEE 11 KB
8 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cb-JBD8yh-SWdiIDVRIpqibJUXBRpPdljj28lg2KkF1J9ZQDdKImD4VJDFj8miCO0rH8WBmJS-4RDgWQnkQLF2jFADkMqQxZQ-cSwBBPRD86enqYuynogTUJmSwR2-iQsMAii_qgUowvgZ-qCd1v_37gyeBA&dbm_d=AKAmf-C1VQ__znnR0USlj4BDFVIQxP4O4GwaVExPUfiCe9gChbfTF7RZ2zFUDmA-D5yDkeIiaXDhdjW_98J5iBmFYKk3_0uV_CCAOjh0e5q75o7Sdr8_4EcqBOZgNbRqmiDGDBV7PReJ4idiTFfSin0uNlMOrSPfZogjNcaVXVIlbEil24shWUrgWMtk_SkojymRldeMzYlYNIU_msoPn68GqaL699uBIv0OWTLx-2YGRDepZ7ZD6jOmkc-I8q_sKgUnzpP2iHbkxqJNuXCWDfpWwrLuVadfb8pa9NYeQMjeUBvEPUA8_nqsuYnI0EP3hJm2bK_8OU3raT1xRaosbQMcd6BCIBl80hSKzrox3DlYTTqP0XOhbPla4alWWZvCLOJc4e6DdLuwWvsURyDHFtQDmrsTDeYSxRx9u1jf7hIdgy26-bcKcUi-Kns5fNllyfga94JNAGHkaQ9DPUUxuD9KNKc9S5ryOr3e7KVeE_43dSEhqbecmAjlqShI7DcIErOIg4p9hp46PWb6zbqfm51kWhw_qiJ3lbZY6ylEVErBNulTYkHRG2N4kGNl1-LAadSh-Rvl6hEl4SNZNiHF22v_CLXBMbQWAEzzWi37xN5oTQzihJwpkuvVGSuWMwz4ozwSGnKstU7mhlRBNgfwJwE5bLM48ES-zseStd_fp2xoP7gfncI9JTQ_pI4tyqBRCemNTghXCR-eXwgoUsWO8fL4p_vnnS8ihEaD4dcW_UtqNMf2ItjHsY0naFEUy0QUGp_f2NxCmfy2vrylYJDw8CLxTi44P4UN-hCKs0IqPTpm3TSzRi3DDBhNykQbyG5OuyF3o4nm4VqpA3xTHcnNYSn9WLvQbNBMhlUU3uqOx1oYdN2DreSMwvFJC_umqslpAwEgfsJDetIG7za_Eav7XYKcosSLk7egipS0GNaTalZXx41mxMkh5SjZl5UDRPDf6aLcJd-iMGT2OGFR_VxSGZWrg3ZThNhxYN6QXb6yzr-LYrdeghxCRGRQQ8mezEqdSjtqQdwpa6M-CX3mK2Iy9ZF7el4BPcT77z5NNV4zhuwFGUb5SMwp_bRgL9S3kTcR_X22yAobEk54N2lBM3dv4zHv7uhi7TITW2VRlkAMHxJBLK_SFtvW8yTp3zaUSyX5Lqcw8Uw9cka1EcR5gSjlaL5QLwrItAENs2gGbXhXUMJ5yVe7elUU_3c5axGYS5-9Bc1I_QfAgjZ3AFJoJIs4i1jyUiENFJIy_ztTalJrCXjUa-bNH8GX1QkXknekyyd8ek2OwoER_HWDAOAg-JIUVLRcGhJiz4Mw_ECx3KEzGrmlxLnLO7vUgd2LnsxwDOJWn_ID2RZSTNuUkGI1VvQGjUl8ZdHDqc0gjHWWERs0lf-OszslzF0X43p27hT9eNF1Uf-4vMVidc5Mv64kvtCKOvhpayx8E67CZA8SYTHWN1ABPKG63EIGsAbNgz7lcOWvJzsNzCGOVryc85wOibTXuGGBmiz5DVX6v1sHqXT0DqMtbjAmNqfKf80jsCTvti64J16Hie3xLheUZHZwa7vn6kOaH9LrEcQMKM1Ri-yD6NicUGwRqZjBY15zHj_Aikr0KAd2__BucpPotZXbgJ7oV7EvujtdgmO2aeUBtTtkmdMgaw_z-Oaa_59cbDi70Lfm3o1YiVJ9p5xwOtip3Z7ogdSmzsMTE3Ul0gtQwYMYbLs09_tiDrFRg6-Kww6Arg_vxA1HcNV_m1EZ7Wc-cM0gNgJLmjDlpgDQmid_tOr3R3Tr1b6RZM-STIduZVi6UsHYFxeFB2QdNgsa6GXzcuroYTkV4O67ledjNxbqlwyu6vEsQpwvpe_kkOd18A0L7dJyP9IXQyZ6Ga6CNeQdJ_0xlAkxZV6U24Ej-lcYMXlQdylsRmvsIe13h1LlxocVX5lcRhRo-5YkrT8lZOhovtoLF8ih5vO7NQ3vh1UHDSKvueZ6-Y_cduJyHO_XhMXRVE5tmHwJuVSb5QzKyZ7VCdv4oY4wsyK58QOqP-oU8Qk6T0JqSmi0L6janixeR_B-MlIEymlsPlRX1ukhe5b4bphbK2L1pI6eGsACEOsjyKCcd4zgXQKT7aEcApT2aUuu_wT43PMQjq1sX8DYj6ux14kBsWv65YylGy3onAsC6pXKojNDyVVT8AcXqbUvvTBIOZiYd2jKWEddEV0peBtfYhji8muTWeJqEYLLV5tfcrFprDuVuyC53_V23WZqge4MZoErGwvRrfIffefpHzkoh-Q-wY6k0BbmPjhU45wgiYQO2nLmzhkmzSUnbp7MVTaTC9kwSkGaS46TrcEqRd6Uscyl33ENghmHIwQfYUELuyURaF-PAdh57dpMxFUPYAnYJ4ch0iWKuq83DTxBESl3NeUspsxWmHJgpO80vMUEsDBqhFAVt7q8QDYZGOjfcrg5OQ23olj0U70DEyNPG8aaFqk9ltwgVAL49oOep77IGzzyHtmMVOvLXdwUkUbkvVzYkMdYLZL2Oz3kzmHTSsSB6oM-dmSbrj_SUOynzcPpmJQ3tzLxqCctdOTIuyT4uAtCTFAbYTqEpHg1VgrgqVY0cYi4W4ulwFXhptpYupcBSBb_40YFhE_Ws3WmmBaw36IsLZYoWWEao_vuYowBbxiN6XrLt-bp0szYJ_ndN4od58515GqzlHFj3Qw5SZPwXftJZxCKR9nmwtekjlX8Jj7KK8JNWEv0kfOkrb9ZXSMGqOgdStYF8gw_hCM4BwdCtbQdfL4OvHeidgJxI8lRLBGhZMlwAq9twNjGVA8Of1y8v6KwCP-H9D3lAVx8xK-gQwQA8QR-GpKZWQlWYTYP4PAKxw-G1EmN8-j4AlObqn7LvmO1Y0RCPSI86Y_adJu4txy_CBeSVb6i6ok9guYtIZy15nILjoZN03ga-mJf3zR-PCh8JcM00birYAYy4gWW58dJqLo8usf_4PBYlwCkJXmTetLLby5OACHotjeeOAJJtns4VzimRJ5jeEwSJd76W5FeUzTenOAE7C6gaEO7fn_zzcFudDCfpfFZdk5q6PxCtHxenR0bjGpsErTQ1Uvxcy7ASghH-auphKKY2M6Var0yTmOERYOhL_rf8_pdlE9zOuEogi7lcJH2zQECcBY7ld7DEm6UYPb4KUNMjk2O&cid=CAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a85475ab586df395ab41baacc2012bad4de7aa360597e4267e10612dac4fe71d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8046
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame DAEE 2 KB
1 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/window_focus_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:32:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 335
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Jun 2021 18:32:20 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DAEE 122 KB
37 KB 22ms
20ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e312f277726cf12aa508a34dfc0c5217b72334652dc99f8df30559e3e8dc971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622806011323838"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Mon, 07 Jun 2021 18:37:55 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame DAEE 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27466895d3e9250f3d0ae0e726f72b8a5c23e2aa83f9caaaf99dcb9f18fcac4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1091097466425408374
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Jun 2021 18:33:40 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame DAEE 0
0 23ms
21ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSrzNFv_YJ1z8MRp1rYEpSIlTp12kROkXjZ7Evkm_hJb8AAqPY47gm0bxH6JVtXhzlUIK_b
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAEE 42 B
63 B 39ms
38ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BRpg_ED6pmYLJyQoGcks157tri0pMztu15rxmO8nTpEJ6AskBq_09K8faBzeqXhyDJmlayn223buf0jQjbMLv4yoE0iPWy22a3t8nIBxwyYPxrSiI

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EB9B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF9CGw6ki-cUx4AZTU-1mPE&google_cver=1

43 B
1014 B

41ms
41ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF9CGw6ki-cUx4AZTU-1mPE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNVIWA3ZqkGITIt77WeE3JXConB-_Bxoh779n7Yg3Ln6VKMLwJpl3A40goM21dh3TayRGg_kXhnIgA1RQj-TAb4KE_rB0rftvWcK5N90HzadhOe1Vcu9Y9_kKDREnvWaF-CD7r47SenJTl0arpUUXcfv4HQYOVS5gkaK7wZuu0RMFqy1kK0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Jun 2021 18:37:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF9CGw6ki-cUx4AZTU-1mPE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EB9B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL5ng9F.50eXgjJQkv75QQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2

43 B
894 B

35ms
34ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNVIWA3ZqkGITIt77WeE3JXConB-_Bxoh779n7Yg3Ln6VKMLwJpl3A40goM21dh3TayRGg_kXhnIgA1RQj-TAb4KE_rB0rftvWcK5N90HzadhOe1Vcu9Y9_kKDREnvWaF-CD7r47SenJTl0arpUUXcfv4HQYOVS5gkaK7wZuu0RMFqy1kK0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Jun 2021 18:37:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame EB9B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEOjzo4UcSQLt2WoBDODAQAc&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEOjzo4UcSQLt2WoBDODAQAc%26google_cver%3D1

43 B
1 KB

28ms
26ms

Image
image/gif

37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEOjzo4UcSQLt2WoBDODAQAc%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJnsxgIQrePsnQIY1-_clgEwAQ&v=APEucNVIWA3ZqkGITIt77WeE3JXConB-_Bxoh779n7Yg3Ln6VKMLwJpl3A40goM21dh3TayRGg_kXhnIgA1RQj-TAb4KE_rB0rftvWcK5N90HzadhOe1Vcu9Y9_kKDREnvWaF-CD7r47SenJTl0arpUUXcfv4HQYOVS5gkaK7wZuu0RMFqy1kK0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:55 GMT
X-Proxy-Origin: 84.17.43.131; 84.17.43.131; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.151:80
AN-X-Request-Uuid: ef50c0c5-df81-44ae-ae56-317c9de6dc0d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:55 GMT
X-Proxy-Origin: 84.17.43.131; 84.17.43.131; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.101:80
AN-X-Request-Uuid: 95045285-68b0-42d6-a19f-7c1c6c9ed1a2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEOjzo4UcSQLt2WoBDODAQAc%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame EB9B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg5MDY3OTk2MTkzNTE0MDk5

170 B
188 B

34ms
33ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg5MDY3OTk2MTkzNTE0MDk5

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:55 GMT
X-Proxy-Origin: 84.17.43.131; 84.17.43.131; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.59:80
AN-X-Request-Uuid: 38fb108a-496f-42b9-b165-58d558a4308a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njg5MDY3OTk2MTkzNTE0MDk5
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DAEE 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cb-JBD8yh-SWdiIDVRIpqibJUXBRpPdljj28lg2KkF1J9ZQDdKImD4VJDFj8miCO0rH8WBmJS-4RDgWQnkQLF2jFADkMqQxZQ-cSwBBPRD86enqYuynogTUJmSwR2-iQsMAii_qgUowvgZ-qCd1v_37gyeBA&dbm_d=AKAmf-C1VQ__znnR0USlj4BDFVIQxP4O4GwaVExPUfiCe9gChbfTF7RZ2zFUDmA-D5yDkeIiaXDhdjW_98J5iBmFYKk3_0uV_CCAOjh0e5q75o7Sdr8_4EcqBOZgNbRqmiDGDBV7PReJ4idiTFfSin0uNlMOrSPfZogjNcaVXVIlbEil24shWUrgWMtk_SkojymRldeMzYlYNIU_msoPn68GqaL699uBIv0OWTLx-2YGRDepZ7ZD6jOmkc-I8q_sKgUnzpP2iHbkxqJNuXCWDfpWwrLuVadfb8pa9NYeQMjeUBvEPUA8_nqsuYnI0EP3hJm2bK_8OU3raT1xRaosbQMcd6BCIBl80hSKzrox3DlYTTqP0XOhbPla4alWWZvCLOJc4e6DdLuwWvsURyDHFtQDmrsTDeYSxRx9u1jf7hIdgy26-bcKcUi-Kns5fNllyfga94JNAGHkaQ9DPUUxuD9KNKc9S5ryOr3e7KVeE_43dSEhqbecmAjlqShI7DcIErOIg4p9hp46PWb6zbqfm51kWhw_qiJ3lbZY6ylEVErBNulTYkHRG2N4kGNl1-LAadSh-Rvl6hEl4SNZNiHF22v_CLXBMbQWAEzzWi37xN5oTQzihJwpkuvVGSuWMwz4ozwSGnKstU7mhlRBNgfwJwE5bLM48ES-zseStd_fp2xoP7gfncI9JTQ_pI4tyqBRCemNTghXCR-eXwgoUsWO8fL4p_vnnS8ihEaD4dcW_UtqNMf2ItjHsY0naFEUy0QUGp_f2NxCmfy2vrylYJDw8CLxTi44P4UN-hCKs0IqPTpm3TSzRi3DDBhNykQbyG5OuyF3o4nm4VqpA3xTHcnNYSn9WLvQbNBMhlUU3uqOx1oYdN2DreSMwvFJC_umqslpAwEgfsJDetIG7za_Eav7XYKcosSLk7egipS0GNaTalZXx41mxMkh5SjZl5UDRPDf6aLcJd-iMGT2OGFR_VxSGZWrg3ZThNhxYN6QXb6yzr-LYrdeghxCRGRQQ8mezEqdSjtqQdwpa6M-CX3mK2Iy9ZF7el4BPcT77z5NNV4zhuwFGUb5SMwp_bRgL9S3kTcR_X22yAobEk54N2lBM3dv4zHv7uhi7TITW2VRlkAMHxJBLK_SFtvW8yTp3zaUSyX5Lqcw8Uw9cka1EcR5gSjlaL5QLwrItAENs2gGbXhXUMJ5yVe7elUU_3c5axGYS5-9Bc1I_QfAgjZ3AFJoJIs4i1jyUiENFJIy_ztTalJrCXjUa-bNH8GX1QkXknekyyd8ek2OwoER_HWDAOAg-JIUVLRcGhJiz4Mw_ECx3KEzGrmlxLnLO7vUgd2LnsxwDOJWn_ID2RZSTNuUkGI1VvQGjUl8ZdHDqc0gjHWWERs0lf-OszslzF0X43p27hT9eNF1Uf-4vMVidc5Mv64kvtCKOvhpayx8E67CZA8SYTHWN1ABPKG63EIGsAbNgz7lcOWvJzsNzCGOVryc85wOibTXuGGBmiz5DVX6v1sHqXT0DqMtbjAmNqfKf80jsCTvti64J16Hie3xLheUZHZwa7vn6kOaH9LrEcQMKM1Ri-yD6NicUGwRqZjBY15zHj_Aikr0KAd2__BucpPotZXbgJ7oV7EvujtdgmO2aeUBtTtkmdMgaw_z-Oaa_59cbDi70Lfm3o1YiVJ9p5xwOtip3Z7ogdSmzsMTE3Ul0gtQwYMYbLs09_tiDrFRg6-Kww6Arg_vxA1HcNV_m1EZ7Wc-cM0gNgJLmjDlpgDQmid_tOr3R3Tr1b6RZM-STIduZVi6UsHYFxeFB2QdNgsa6GXzcuroYTkV4O67ledjNxbqlwyu6vEsQpwvpe_kkOd18A0L7dJyP9IXQyZ6Ga6CNeQdJ_0xlAkxZV6U24Ej-lcYMXlQdylsRmvsIe13h1LlxocVX5lcRhRo-5YkrT8lZOhovtoLF8ih5vO7NQ3vh1UHDSKvueZ6-Y_cduJyHO_XhMXRVE5tmHwJuVSb5QzKyZ7VCdv4oY4wsyK58QOqP-oU8Qk6T0JqSmi0L6janixeR_B-MlIEymlsPlRX1ukhe5b4bphbK2L1pI6eGsACEOsjyKCcd4zgXQKT7aEcApT2aUuu_wT43PMQjq1sX8DYj6ux14kBsWv65YylGy3onAsC6pXKojNDyVVT8AcXqbUvvTBIOZiYd2jKWEddEV0peBtfYhji8muTWeJqEYLLV5tfcrFprDuVuyC53_V23WZqge4MZoErGwvRrfIffefpHzkoh-Q-wY6k0BbmPjhU45wgiYQO2nLmzhkmzSUnbp7MVTaTC9kwSkGaS46TrcEqRd6Uscyl33ENghmHIwQfYUELuyURaF-PAdh57dpMxFUPYAnYJ4ch0iWKuq83DTxBESl3NeUspsxWmHJgpO80vMUEsDBqhFAVt7q8QDYZGOjfcrg5OQ23olj0U70DEyNPG8aaFqk9ltwgVAL49oOep77IGzzyHtmMVOvLXdwUkUbkvVzYkMdYLZL2Oz3kzmHTSsSB6oM-dmSbrj_SUOynzcPpmJQ3tzLxqCctdOTIuyT4uAtCTFAbYTqEpHg1VgrgqVY0cYi4W4ulwFXhptpYupcBSBb_40YFhE_Ws3WmmBaw36IsLZYoWWEao_vuYowBbxiN6XrLt-bp0szYJ_ndN4od58515GqzlHFj3Qw5SZPwXftJZxCKR9nmwtekjlX8Jj7KK8JNWEv0kfOkrb9ZXSMGqOgdStYF8gw_hCM4BwdCtbQdfL4OvHeidgJxI8lRLBGhZMlwAq9twNjGVA8Of1y8v6KwCP-H9D3lAVx8xK-gQwQA8QR-GpKZWQlWYTYP4PAKxw-G1EmN8-j4AlObqn7LvmO1Y0RCPSI86Y_adJu4txy_CBeSVb6i6ok9guYtIZy15nILjoZN03ga-mJf3zR-PCh8JcM00birYAYy4gWW58dJqLo8usf_4PBYlwCkJXmTetLLby5OACHotjeeOAJJtns4VzimRJ5jeEwSJd76W5FeUzTenOAE7C6gaEO7fn_zzcFudDCfpfFZdk5q6PxCtHxenR0bjGpsErTQ1Uvxcy7ASghH-auphKKY2M6Var0yTmOERYOhL_rf8_pdlE9zOuEogi7lcJH2zQECcBY7ld7DEm6UYPb4KUNMjk2O&cid=CAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 15:08:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98939
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 06 Jun 2022 15:08:56 GMT

GET
H2

200

as.php Show response
nxtck.com/ Frame F443
Redirect Chain

https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABI...
https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABI...

3 KB
2 KB

36ms
36ms

Document
text/html

130.211.47.109
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1
Requested by: Host: 7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com
URL: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.47.109 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 109.47.211.130.bc.googleusercontent.com
Software: adserver-canary-57cdc5f69f-8m7cx /
Resource Hash: ef102cd5c4febb19c903c26fe67851cb23ae9e3ec4f1841b55f0833070932470

Request headers

:method: GET
:authority: nxtck.com
:scheme: https
:path: /as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tc=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/

Response headers

p3p: CP='ALL DSP LAW CUR DEV PSAo PSDo IVAo IVDo CONo HISo OUR STP UNI NAV'
server: adserver-canary-57cdc5f69f-8m7cx
x-robots-tag: noindex, nofollow
expires: Tue, 01 Jan 2001 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
set-cookie: uuid=1e75d78c-d8f2-4d61-8e8c-32a9e1ebb885; Path=/; Max-Age=31536000; Expires=Tue, 7 Jun 2022 18:37:55 GMT; Secure; SameSite=None
vary: accept-encoding
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Mon, 07 Jun 2021 18:37:54 GMT
via: 1.1 google
alt-svc: clear

Redirect headers

p3p: CP='ALL DSP LAW CUR DEV PSAo PSDo IVAo IVDo CONo HISo OUR STP UNI NAV'
server: adserver-ga-6966f9dbd7-9df9t
x-robots-tag: noindex, nofollow
expires: Tue, 01 Jan 2001 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
set-cookie: tc=1; Path=/; Max-Age=31536000; Expires=Tue, 7 Jun 2022 18:37:55 GMT; Secure; SameSite=None
location: /as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1
content-length: 0
date: Mon, 07 Jun 2021 18:37:54 GMT
via: 1.1 google
alt-svc: clear

GET
DATA 200
OK truncated
/ Frame DAEE 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a56758d488a7785e6268ad6307c1a60a9eb2a7aba9716eed0aaacc6839f4c1c7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 36BF 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sun, 06 Jun 2021 16:42:16 GMT
expires: Mon, 06 Jun 2022 16:42:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 93339
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame F443 8 KB
4 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46a7c53d9c799f561bc6866a6a5a9a5bd52343b12cce788bfe28d812ea49e5b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 17:39:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3480
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3800
x-xss-protection: 0
last-modified: Mon, 07 Jun 2021 14:20:48 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 07 Jun 2021 18:39:55 GMT

GET
H2 200 rm_iab.js Show response
cdn-ssl-as.nxtck.com/iab/js/ Frame F443 3 KB
3 KB 32ms
31ms Script
application/x-javascript 34.107.167.126
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ssl-as.nxtck.com/iab/js/rm_iab.js
Requested by: Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.167.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 126.167.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 77dd7a6ab6c5b70535f944b314aefb2139419836cfcac9d57f765fc7c123b82c

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
via: 1.1 google
last-modified: Wed, 14 Nov 2018 22:57:04 GMT
server: nginx
etag: "5beca840-a1b"
content-type: application/x-javascript
accept-ranges: bytes
alt-svc: clear
content-length: 2587

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 36BF 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1486
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 18:13:09 GMT

GET
H3-29 200 impl_v73.js Show response
www.googletagservices.com/dcm/ Frame F443 36 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v73.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b3e2cf988f8740842a124c2812f5b9dd9d1c6aa7b2aaeb4247ce73e313a22d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 05 Jun 2021 07:39:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 212279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15487
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 17:36:38 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 05 Jun 2022 07:39:56 GMT

GET
H2 200 B25214695.293915145;dc_ver=73.216;dc_eid=40004001;sz=300x250;u_sd=1;gdpr_consent=1;dc_adk=1701316499;ord=ht5tjw;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLSmYgme-... Show response
ad.doubleclick.net/ddm/adi/N1119185.152785NEXTPERFORMANCE/ Frame FCF6 39 KB
19 KB 57ms
56ms Document
text/html 142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adi/N1119185.152785NEXTPERFORMANCE/B25214695.293915145;dc_ver=73.216;dc_eid=40004001;sz=300x250;u_sd=1;gdpr_consent=1;dc_adk=1701316499;ord=ht5tjw;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3Dhttps%3A%2F%2Fnxtck.com%2Findex%3Fclk%3D1%26zid%3D56367%26aid%3D582821%26ev%3D75873%26rid%3DeDIvECZwJxQG_1J_%26sid%3D567755672%26uuid%3D2e87d22f-4911-4fa3-98b5-ae5d7546d74d%26ecr%3D%26referer%3Dhttps%253A%252F%252F7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com%252F%26c3braK3c%3D%26P0uWe7tE%3D%26rawloc%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=3,https%3A%2F%2Fsci-hub.mksa.top$2,,https%3A%2F%2F7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=sfYJj-tlh);gcsr=m;osda=2;sttr=34;prcl=n

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v73.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

03e158d3b24504d8a28ea2cd80f3b8ade435f7dd0b596cb2d2e48b84710008c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ad.doubleclick.net
:scheme: https
:path: /ddm/adi/N1119185.152785NEXTPERFORMANCE/B25214695.293915145;dc_ver=73.216;dc_eid=40004001;sz=300x250;u_sd=1;gdpr_consent=1;dc_adk=1701316499;ord=ht5tjw;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3Dhttps%3A%2F%2Fnxtck.com%2Findex%3Fclk%3D1%26zid%3D56367%26aid%3D582821%26ev%3D75873%26rid%3DeDIvECZwJxQG_1J_%26sid%3D567755672%26uuid%3D2e87d22f-4911-4fa3-98b5-ae5d7546d74d%26ecr%3D%26referer%3Dhttps%253A%252F%252F7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com%252F%26c3braK3c%3D%26P0uWe7tE%3D%26rawloc%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=3,https%3A%2F%2Fsci-hub.mksa.top$2,,https%3A%2F%2F7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=sfYJj-tlh);gcsr=m;osda=2;sttr=34;prcl=n
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nxtck.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlyzavzh_6xS6APAftcOYdkFK34yHfx2QJaV_wUZhxtHuTYmOWZNuFqpG4Vv3k
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nxtck.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 07 Jun 2021 18:37:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 19620
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 OBA_marker.png
cdn-ssl-as.nxtck.com/iab/img/ Frame F443 3 KB
3 KB 32ms
32ms Image
image/png 34.107.167.126
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-ssl-as.nxtck.com/iab/img/OBA_marker.png
Requested by: Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.167.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 126.167.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
via: 1.1 google
last-modified: Tue, 02 Oct 2012 09:47:13 GMT
server: nginx
etag: "506ab821-cbe"
content-type: image/png
accept-ranges: bytes
alt-svc: clear
content-length: 3262

GET
H2 200 OBA_en.png
cdn-ssl-as.nxtck.com/iab/img/ Frame F443 4 KB
4 KB 45ms
45ms Image
image/png 34.107.167.126
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-ssl-as.nxtck.com/iab/img/OBA_en.png
Requested by: Host: nxtck.com
URL: https://nxtck.com/as.php?if=1&zid=56367&cpid=23227&cb=1623091074760190&redirecturl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3D&tc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.167.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 126.167.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 835b8e7fce8c7030ab18fe28277589c21b062b5b6e6301939cb1e62b1af3f151

Request headers

Referer: https://nxtck.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
via: 1.1 google
last-modified: Tue, 02 Oct 2012 09:47:12 GMT
server: nginx
etag: "506ab820-108b"
content-type: image/png
accept-ranges: bytes
alt-svc: clear
content-length: 4235

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/ Frame FCF6 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N1119185.152785NEXTPERFORMANCE/B25214695.293915145;dc_ver=73.216;dc_eid=40004001;sz=300x250;u_sd=1;gdpr_consent=1;dc_adk=1701316499;ord=ht5tjw;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLSmYgme-YP6yLp3U7_UP3dWo4A3o2frIYsK1xLybDMqnpfroDhABILSj7n5g-_n8gogKoAGFt7jiAcgBCakC4Uqr8cpttD6oAwGqBOYBT9CxsdvaZ4DbBiWkkClRMX8splXYDKlSaNYcRTsUPs8u8SJ62XULWZfwEhGjnU4JjlC9o1PioDik73VU8XmxMrEBZHfiwx7Bsp2tC1HWH1HgTba-V7gL3FPaNzt4aTnaaA_UqMLc47jqZbOLH-ZLPMUDwCTFAHCWSKC3xDPdtibHGoGoGjekvf_S841b8eYxqbk20qa4aVkrrqpw_eicz4ilUsoAPgagRHlGVcpqr1Aq6E_vDySedeQ1rUUUsj48nHiQU95JrgDt2DCSlGHUZq9F5PYN0srQ53RR5QCMb5JIVkEhB-bABNalj7OkA-AEA5AGAaAGTYAH48jHnQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAUBABGB2ACgOYCwHICwGADAGwE_PK3AvQEwDYEw3YFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASPeRop9jw48Hqkk9h5s3ukVAqKwnagzoX7lS9EUX-Fymu9CiEQEN1UcrgRdrDPFWLqW70fIES8ZLKzIkmcxk%26sig%3DAOD64_28nNhdr46_ZNq-rgQxXUf7iHglAg%26client%3Dca-pub-7015235120915769%26dbm_c%3DAKAmf-BK1nOfPq_LyGpVFn2iGG2PWpdwY3QdIn3ga2weZVjhb3D6zBTGKRex7KyZqVT1Ht6wWT33n30jE_gbUknNwSYvqRacVB_d419KYZOqWVdqhW5JQqTTT9zHe_NM6pbV1NDLezCLND_KvwICocIfle8EY6xDgw%26dbm_d%3DAKAmf-DWGsR8UGlF9kJWTt8QAjveNT8B0Clvjqjr096J0jO3_EJr8I5AuEDAcWe-YjOQMigatRBbmKLopsxLNIImPNWmHzQmBNPnx-CMM_APAj97NrAaR-Iwj22TG2E5AN9cZS75-ByV8ZhFI6XjMIpBnKILYdbYfheWOwoZOuI56-10pJFlNy35wSlDxBC8pSt6EEOms6A43Ru_pDRUQmBpmuYfxdjsTcqepkbO5vEjwOIjX5l8dBre9n2cxHTGHew5AZl8Im4Pc-iLhj7PIblziRA_BWgrmNrfmLO0tcRMmAhdrGmpvraUFtB6MGqsfUkXoJHSSIGaNb_QBAijmw1hfbr1mKGEEvXNnEYRtOC8gdfVskXOB69s4_4c41y7LICOqiH999xdDHdjyktzzyuLsRhd1RHq5il79lz9doUBAxg-4oF4VCbZjWDVUc1z9pUXUlE0WJDO4dY3tcSXulYMhB9Nhx_-2A%26adurl%3Dhttps%3A%2F%2Fnxtck.com%2Findex%3Fclk%3D1%26zid%3D56367%26aid%3D582821%26ev%3D75873%26rid%3DeDIvECZwJxQG_1J_%26sid%3D567755672%26uuid%3D2e87d22f-4911-4fa3-98b5-ae5d7546d74d%26ecr%3D%26referer%3Dhttps%253A%252F%252F7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com%252F%26c3braK3c%3D%26P0uWe7tE%3D%26rawloc%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=3,https%3A%2F%2Fsci-hub.mksa.top$2,,https%3A%2F%2F7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com%2F$0;xdt=1;crlt=sfYJj-tlh);gcsr=m;osda=2;sttr=34;prcl=n

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Jun 2021 18:33:04 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame FCF6 111 KB
38 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ad.doubleclick.net
Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 19:05:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84770
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Jun 2021 19:05:05 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FCF6 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 15:08:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98939
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 06 Jun 2022 15:08:56 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 248E 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ad.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sun, 06 Jun 2021 16:42:16 GMT
expires: Mon, 06 Jun 2022 16:42:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 93339
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FCF6 122 KB
37 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e312f277726cf12aa508a34dfc0c5217b72334652dc99f8df30559e3e8dc971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622806011323838"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Mon, 07 Jun 2021 18:37:55 GMT

GET
H3-29 200 index.html Show response
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 12 KB
3 KB 14ms
13ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

582c119449f238b606455ba358a9907e5c7b5859c8ee507c24a2a6399555396a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ad.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2949
date: Mon, 07 Jun 2021 07:08:11 GMT
expires: Tue, 08 Jun 2021 07:08:11 GMT
last-modified: Fri, 16 Apr 2021 09:34:27 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 41384
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FCF6 0
51 B 60ms
60ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsswA6NZyJLuVxbMRPsCML75jPcE6tHjMQfIik040kUfjSpdzez3T5-4FH9u0TKA9QTdoCR_7oTY84QBUS0jY9ovNJ5I2KWJEmgzZ63g5T1BO5IFfwZ8jRPQ_kW5oVfbFN5FrU8w3G1kk9yd7HpXyyhzFyQlTuaoYZt0uKoNbOg&sig=Cg0ArKJSzOTLGyK6U9w3EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=37&cbvp=1&cstd=35&cisv=r20210601.61335&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 18:37:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 36BF 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BlRECg2e-YPKyCqaO7_UPnam9uAEAAAAAOAHgBAI&bg=!GBulG1_NAAY6sG-_OrA7ACkAdvg8WhptOXcDMczWXpjjYTDnLgADRN_KCh4BZ5Z9TrImJuNA3VNRkAIAAABqUgAAAA9oAQeZAtWM3vOD5jRV2LXz6dsc6tn9XNGnP80pjqRj-JW7cHs_Yysuw5zEAnMIISIHY4jxeDbmCeHJaTPAMPt7UBKmK_MCmCBrk7ypA-DaYooBSX_jBUu4GKPNGPW0A45bkHIkuVsHd28vCc42xdbsUh3lflkeF2RQoa1qW_hzRVqAXf0wrsd91YrLPC-HzTZbprl2z6oa1H7QwgS3_y7ESmbz4HLkPX3r4Qa3vPNe4IF_O0hJSRBcGYiTT0V9NRND2aQPkmswGtU3jN7mzJw4yz1pzTGihODRwfkfNQRQmEVh_-Q-fnFA0epmWJjNHr3x0mTrziHRzQFhaJZK_owSTKDy9ovFco89Qv0vXhC-4Op5ZGK12ZY1kNrKELFpSqVa0dFy9VmnwoejeE-Z9yhRZBAFX2BkiDgq7NS30IYheDje0SiFlOlCQhkZhLxncfpHVYIr7kmhH9vXoTEU_azVV33M1KF1fVyoV54i1nYC1LxSEP9b3Gd4dqNTTkmtUuuv6a_9lmxoHgPoHWSL6aQzMlJ0ZE2omFuePQmCcdfl5rqxaHOB9X6T1L46m8ZeFe9GeFSI25C99RsJ1iNxI8ieuZbsaZ34QTk2KaLDrD-sDgveQif4gPEdwtDXpH5odAy8_TS_5P55MP1qxMN01wb15YaI_imYDHmRex87kfQAGWdpd_7NEPY5oo5x7Ujh-C2HDNJJzi0YtVzOLjLwGYsnmAPpmuWahf2mGwXgiJlbcKrLl4yqnad9jI1WN-JjKbyBb-570aCehkvFQZJIYcb2c3PiudKvBtLTPwb1gwsDVpW3iXEJqNPlys4RxgbnIqKdBdLfvukv0DoWKp2oKP6L_lKg4R6BoLOFC1-9vzxW5dj9fa6_ltdHPO--R99OhBa541JAD4mo7nArNv1FPvZYFqbsXeSKEhvoDE76sO7D0pMbSBrw0Cu2tZBzx9cgS6jnkpt0NGkLTjUdqA

Requested by

Host: 7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com
URL: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js Show response
pagead2.googlesyndication.com/bg/ Frame 248E 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 17:40:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3448
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5768
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 17:40:27 GMT

GET
H3-29 200 bg.jpg
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 13 KB
13 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7937060f095cecce3adf5b27a149da1219863f71925ae8e9613a3fef96d9987a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13652
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 visual.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 27 KB
27 KB 13ms
13ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/visual.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ee3d9c771bc92023078b7619d7aac8178473643d161a72a58be57d5fdda8397

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28089
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 txt1.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 6 KB
7 KB 16ms
16ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af86e77d07da2194ea2f1254a9486459890ab000ed2995ec1620d9b126504625

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6654
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 txt2.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 10 KB
10 KB 19ms
18ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b80ecb27d4a297e4bab68fcbe1456c6089785f86bbd6e6ff8fa89f8d62d4b18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:05:04 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 1971
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10280
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:05:04 GMT

GET
H3-29 200 ml.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 7 KB
7 KB 18ms
17ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ml.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

509ee2d219a25c5f4db015090a9e58937cde3a7cfa6c7d0c3823ffc051db67ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:05:04 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 1971
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:05:04 GMT

GET
H3-29 200 cta.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 4 KB
4 KB 21ms
20ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df6dabeb63d901690292dca2496cb38a0df0297f50592c238262244e602b8243

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4450
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 logo.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 8 KB
8 KB 20ms
20ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4bb9dff273f05bc37f3118bf3cd3eb95d5c11d7b6630775082fee67d6d053b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8605
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 loading.gif
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 723 B
745 B 7ms
7ms Image
image/gif 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/loading.gif

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c65029d236dfac96135a8c265ebc02e1ea74cf86fb4cf1eb5ff89296a90f7e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 723
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7B1A 110 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62b1cff44a5e34b9587ad49f7ca951160f1559c5c545bcf99e13574ccaa5425a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37930
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Jun 2021 18:37:55 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame FCF6 0
23 B 98ms
57ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 18:37:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 visual.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 27 KB
27 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/visual.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ee3d9c771bc92023078b7619d7aac8178473643d161a72a58be57d5fdda8397

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28089
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 ml.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 7 KB
7 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ml.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

509ee2d219a25c5f4db015090a9e58937cde3a7cfa6c7d0c3823ffc051db67ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:05:04 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 1971
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:05:04 GMT

GET
H3-29 200 txt2.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 10 KB
10 KB 7ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b80ecb27d4a297e4bab68fcbe1456c6089785f86bbd6e6ff8fa89f8d62d4b18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:05:04 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 1971
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10280
x-xss-protection: 0
expires: Tue, 08 Jun 2021 18:05:04 GMT

GET
H3-29 200 txt1.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 6 KB
7 KB 8ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af86e77d07da2194ea2f1254a9486459890ab000ed2995ec1620d9b126504625

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6654
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 cta.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 4 KB
4 KB 8ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df6dabeb63d901690292dca2496cb38a0df0297f50592c238262244e602b8243

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4450
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 logo.png
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 8 KB
8 KB 8ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4bb9dff273f05bc37f3118bf3cd3eb95d5c11d7b6630775082fee67d6d053b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8605
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 200 bg.jpg
s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/ Frame 7B1A 13 KB
13 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7937060f095cecce3adf5b27a149da1219863f71925ae8e9613a3fef96d9987a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9693237/1618565667994/H_IAB_300x250ULTIMMETAIL/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:08:12 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 09:34:28 GMT
server: sffe
age: 41383
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13652
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:08:12 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 248E 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BfiMNg2e-YO-QF5PC7_UPx82X-A4AAAAAOAHgBAI&bg=!LC-lL2vNAAY6sG-_OrA7ACkAdvg8WuTn7-kQYNpLue7Fn8nJJEP8sNrwEuMzo52ElmHpHCDiTLSZyQIAAAB4UgAAAA1oAQeZAwcwI8Sp2kXin_Kez9nEk9H0AmjRFEz2TSRv6uWRRLOPlnyrWk6dRhw5GcG1dCv1PHBIp6rpNeO2nuA52VChHV2POcqtLE7ne0nD8x1Xd7gSAVda4yhsiOrMIfxdvL_q6YMz5pDZvfpcpsaUANjorSQs00223ZIswexseP-O1BUZ1Y-I82aMsT3UwuUfrW_IFkTKRo3kPWDwMfsRItLzlSZilXD7fKXuTJQxKaqHiPD1iHlI9MR1VYf-h5iz-VkHp0m2WstyFjVQ8yxWb8VK3kCv1TEjtXVYzXmgavi3FbF1kPvHKPsV24bPk_xIexBjCAOzq0QTDz97VKLtcLoEDYSNiEqhyeLkksxunhkqbMeuk_KhqiAzJq_oB7q8dNsVTisB2AZfZUZyO3Ht4tpvJkO1k5q8VjJ7b-vzmH2ZuXENmxG41iF1sdN9utbclsmhTQZZVsRd6XDbdMiJEUIVEQqK-S1JXzNcbcsXiy5EfBQBi3TiPQWdo4UMeowbVJmp1Onoi_bQB9J7Ksnl-GoLrb0Yl9yv7vJXOqql2kCIKTyuJjGjGlVA9ns2niw8kzwDOW_s3tMIdVt7Wn-iGx_nmu4xWXlrTfhp9iTlT46IztkFAN1ijzQtIULcEAWKTVBaxreKkUwS5DUJyRTdi4noFW_YwtTNIw8w_7ZBE_IZor-ruqr7HLXP0-gM851LvrPN8zlttGCeHu3g-8CYXuQTZamSPCIlrOVVc_0Z4Ja_NEGxZlyHopI4Jzx-oOcJ3wSGXK3ZcKrwCljMmHS1TLIoAloUD9Mdf5MbAHoJNudUxC0eOA4_ova5r07t8CDEF6MLLodWdkAxNrn54yX1BvAA4AG8pzCxOZYMajS13DVDT2pw0jwJkZTBfGLCFnVIkLTMAgYIoME-4DH4gs__tRihkRy60vb8S3qRsZz1s4j2wwdZwjmHk7jhPykzTjRLNxjsUjUFbt4cXXMB3GMfCjs20Ijys7hhUAfrboutprLgGHejWKbwprbWsF2FuRzQXPbtrnlYOCAjVION

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A6F9 6 KB
3 KB 20ms
20ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 07 Jun 2021 18:37:54 GMT
expires: Tue, 07 Jun 2022 18:37:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 260E 624 B
299 B 26ms
24ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCoi2UYwq2LqQEwAQ&v=APEucNXBNjOohz0VI5NbBLMJGjLTDzTZLdfMVDcxUjxot--nH59ISGrVTT7hEStGavDT6pKg9J53bTVdUtm7hibqRJxbl4EfxrcOQ3hZMfCegulEuBFe1-PIEYLvcDzYoZIw1f_MZJl3lGD6yEM9LUUbPOMQ_oreClZzYz_xcV-mgOsAOLQcTko

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CPDkLxCoi2UYwq2LqQEwAQ&v=APEucNXBNjOohz0VI5NbBLMJGjLTDzTZLdfMVDcxUjxot--nH59ISGrVTT7hEStGavDT6pKg9J53bTVdUtm7hibqRJxbl4EfxrcOQ3hZMfCegulEuBFe1-PIEYLvcDzYoZIw1f_MZJl3lGD6yEM9LUUbPOMQ_oreClZzYz_xcV-mgOsAOLQcTko
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlyzavzh_6xS6APAftcOYdkFK34yHfx2QJaV_wUZhxtHuTYmOWZNuFqpG4Vv3k; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 07 Jun 2021 18:37:56 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 07 Jun 2021 18:37:56 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C2BD 57 KB
23 KB 49ms
47ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVkdt2CtS3ISsqUvW5y4E2cJMmzKz4GZpVObE1MUhwpp7fY-pzcc9GhUzJeDw2vNB7s1hO9iy62Xw__A6WGvv3ma6il53bJchg74Fwgep4eVUp0l8lIHQ6gc_KqHqCEWkrY-3jKchA9XHEzdqJ8McP7rheKQ&dbm_d=AKAmf-C4ePNaNWSy4izX9AGGYd-EKjRzkh4S9iLxs1UxOQSPlyyfh1Tk70-wVObqJ5LyASsvaNMLxqWZLEToRgl-lNQM-_qTgMaVD7j7hSWxHlUquY0GQEPTGKYXRj2dcaCDx2kOVswp8ZaLzn3Yt-1tFazn8xF0G8TSzKfgLCRnO6bMgalk9LYFT8TTn09DK8rj3biPDWkPW3OpdGv19y8eVWWEdGsXDmqOktBMNpWKCn-DFBpoKQIdsflhYtFxC7leFcdktFRgkusCszS-6FvX4WaPcgG6WgVVlHZzeOcneFmKaRmgixYrdoQMI4rvNlgyJOt1zFAHfsnDGg20iof9YkcgqVkE1i82KaHfmnHt4RN52ZRtFnnoG2poyIQzoFia2kEo99MxsB_nZKVfPS5NfeyKHSBCxGb67gQJlhEv36O1aleX5shkQWC_8rHf5qtHNPNk9fjvGSzjawHF6dxMJ6_sIg_DgzFnVueRWrwJ7XToBD535pwCHliXFWDNHwzpyRZMDi2-xnDZXoeiuBJ3erLICoVinIFwO1P6_ryT31UFlZ5zQtwOLDElAR8Ih8QrJhwIQozQ3e-P52PfvxuqWRCOYzmuoxmKh5FKDAIx2Oweekg1erV9KnrGJ1SrTtlhGjxbWZ6qmgWow_4xTeXCPxFsF88VWPvV-3b9zE0iYzCr1vDuTHPEcXN5JhE_oyZ_VyCA4NZtBIXZ-dl1e6htoBilPG4OfPb5zMomqFAeDLlycOJuPNM2X-wWYf6Ea1M4i1r97BCTb0eZK46AiwpjpB285koP7i4uT1WJWLoKr5l7p_eFkq7yqBBa7d-5VfQBFiXALp86aemEcoen-4NqqQYhrUv5TWKQIND0m4OcugWEinUgQ2r-HHQnFs4TJAxofzJgLvmpKrxPv-L3xmTmJcgmDRWpwGSg6KyGuL-vQj7PK8WJr7EpvkjURNmmypRVn-eUmqE6RoV2z1ebb8SnCQTiHsoMI75Z8itMMw_9xR901ax2QZzkQ-kqTXVA0Au_iZiS38jbKtfFmcIP973H_e-mu5VlfeNBE0xaToW2QzU0EHZXxpOpbsK9rnhLWUZIUI3hYthB84LmqLjIbGzGg5tGw9fTiZuCLMAQY_Dkcc55zvU978PxPaakLDefl86hoIEEiDONQ098s_AkTGp80-kCRzAM3TLTDqC3vNOhVnB-ndB0KetVr-EohMTOkrob9AhV-phg4RhkZh2nmVg3EJ3BUE3jjCmfcmVhHMcksk79Mj1mFKK4DtvF5WLcqpNHS2iHojbmAO7Yi6fJQKYzWjjxN3ZnuYsZttRVusu2w85pPPQyDjOGZJRy0BDz3jXL7-pAMQtk55Erli7tu1r17jxerhsgbcAMeMx5FD32D25wJpwZBGMh2RmueRDbfywAGBOnfWDpzD0jlvKxQYGsAXy4EpIJnhlmaZrpjwyTZUYcNlbfifJyKjZyKdsyPoWPqBdcs0afSoS_qGvVsytw9pwOyGnt-_-ogprnSGNY0-FLD7WEs9TsBqk-TygqmUEFnWofM8ZCR9ksQQqoAIyc7DlpcTjmpb-Cadu54O-a0KaCM0TsmoPK3uAh25Xy4bhTrthSwC4eOLyjhYIKIi43vOvVJOHsqqsZidJ6s3hxfW8MwmTM98qtYSQTWKDS1JshYd3CZgozDylCZja4XslxROJu_qFVtVOUVLRTzqTJBH7Q8PiVzk_mr0wUcitwX196M5gVimrqlBObzk7dTQdVklb9L8DDXzqF3XyVWxDF2xA0u9Sd05MM7Xjvjkem_4LyspfEHDassxsOnTIjNk3HKVN2Mk1Frsd-Mykzz8aZAE7e2aaN2qijPIVLTJgECbYXjFBnBlzxXSa-wq2MoFIpGqTEADjHIbVjheYZwD_t8OIwdmmpKn_gJgzfXNltvdxRt1SbrVRkoIsCA2GqOgO6YWLfNLxlmWeGy2d7RZz9blOzW1jItiVgIM2-VGt52S5FhzYBzSPTwr04Bjbaappl0Zia4nk9hGzrav2CCFRHsrZ9xCWjKvR5O0pVYubhj5UJsIXqGiVIGXgdT_TPYIN6GYkJgp9FYpDinzi1pageEdSKWsFU8i5zXdKllcFlWad7pEKW9__P-UDUFHFGZoXBMLtuhHeobfualCcuvqntcYuDSOdKEULurCI6n4k3bBhLb8T4gOzaMIViJFtGMGeYTF9Y5k1cGRXSY_UnnVv8qt5rLLcoX-KEdaK9bafwXCTgcYrM9iIpWpS2eTfEGo4LROihlRf1k58YdCbPdTl3VRB6XfFdkOPTDdjUrmLmxudGGHVho4g23yZM4By747zsYPuC0tmV_OXZIXFx-gcm8m8m-zXpoxpOH_2TC6hGbHcf1XnL8wc6qZkapZ9BqTviM1SKwihy_Vsjna3zBrdhMz_c_rgyE8ljr1vIC2FZ41p5XnSYNfDbaCf4rQkvl1nPgE-GGXclHJIC0QSSBfwCVMa4tinuABBULSBpr7FUpzUfxZAACVFNnGOxEpkTDOpXc2zVjXgeLhiL5DppFK57gpU0ONxvt5avUU9451IC0ZdpsYfDfKncKIt7zCV2nMzJ3hG3O8onBnHcxRLkf_Xa9vrSQv2BnCkIWx8ktumQB9lRBLpMtWCylHwQw2q6dby8LfI2j4okA5tCz_ghfz5Nb9yfW-lpMHHNlPJlAtz_kIDwilO1Rny49UD-ezpzyJlEJrtlpEscpN8WTDpNdzCMH5zOz4eIVwGrCPd37UbDS0L-InhoBFZ4Il1KB0J38amOHb4i8UsVI9EqBD2yTq65N3deALW051yFXEzyj2aElQhtfToHDopKPI-qHq5-9Tds9c8hnRCfIYY2mGN5PvnY-LXp8vuNByyVi5ledYnr4-x0WOE3QPZBvYNcGSQaDDeucnEJ-FbeFs4L2dBpzEry8uaor4FNHGTDX8Pc2QMxaoMj5jMZaIhlmEPYCBMadidAj7xjVuOxqQ&cid=CAASPeRoeH9AWx_WZ_GMiYNaD_7-VV8yk3pnDS-TR7sAxtZkh20s9yXRPigWaU-5vJEOCFApHg6WYuv2Q1brddE&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b8d9a0796658aee9ea5efcbb84e9142bcfcca0ca4c10729862aac4799ac7353

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23897
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame C2BD 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/window_focus_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:32:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 336
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Jun 2021 18:32:20 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C2BD 122 KB
37 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e312f277726cf12aa508a34dfc0c5217b72334652dc99f8df30559e3e8dc971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:37:56 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622806011323838"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Mon, 07 Jun 2021 18:37:56 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame C2BD 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27466895d3e9250f3d0ae0e726f72b8a5c23e2aa83f9caaaf99dcb9f18fcac4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:33:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1091097466425408374
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Jun 2021 18:33:40 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C2BD 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DVpryQoHcUmTlu9fmibaIf9luLcguIyGWVCqLYY39w42OVMkbvp7GBGO8p7uiI7SmikvxIOnY9NOYQ_Ji14Wx-r_laU1TN27Ln73wzVSB78-2bQ6A

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 260E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1

43 B
894 B

57ms
57ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCoi2UYwq2LqQEwAQ&v=APEucNXBNjOohz0VI5NbBLMJGjLTDzTZLdfMVDcxUjxot--nH59ISGrVTT7hEStGavDT6pKg9J53bTVdUtm7hibqRJxbl4EfxrcOQ3hZMfCegulEuBFe1-PIEYLvcDzYoZIw1f_MZJl3lGD6yEM9LUUbPOMQ_oreClZzYz_xcV-mgOsAOLQcTko
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Jun 2021 18:37:56 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 260E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL5ng9F.50eXgjJQkv75QQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2

43 B
894 B

35ms
35ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCoi2UYwq2LqQEwAQ&v=APEucNXBNjOohz0VI5NbBLMJGjLTDzTZLdfMVDcxUjxot--nH59ISGrVTT7hEStGavDT6pKg9J53bTVdUtm7hibqRJxbl4EfxrcOQ3hZMfCegulEuBFe1-PIEYLvcDzYoZIw1f_MZJl3lGD6yEM9LUUbPOMQ_oreClZzYz_xcV-mgOsAOLQcTko
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Jun 2021 18:37:56 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGSUkaapUHTEesQj0p7bUrE&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 260E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDosHQOxUpa-ENzKeNXjRDg&google_cver=1

43 B
1020 B

25ms
24ms

Image
image/gif

37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDosHQOxUpa-ENzKeNXjRDg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCoi2UYwq2LqQEwAQ&v=APEucNXBNjOohz0VI5NbBLMJGjLTDzTZLdfMVDcxUjxot--nH59ISGrVTT7hEStGavDT6pKg9J53bTVdUtm7hibqRJxbl4EfxrcOQ3hZMfCegulEuBFe1-PIEYLvcDzYoZIw1f_MZJl3lGD6yEM9LUUbPOMQ_oreClZzYz_xcV-mgOsAOLQcTko

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:56 GMT
X-Proxy-Origin: 84.17.43.131; 84.17.43.131; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.173.49:80
AN-X-Request-Uuid: 50aea92c-b45e-4be2-b544-ba88499d51b2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDosHQOxUpa-ENzKeNXjRDg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 260E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMzkyMzE5Nzg3ODI0MzY0MA%3D%3D

170 B
188 B

34ms
34ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMzkyMzE5Nzg3ODI0MzY0MA%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Jun 2021 18:37:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 07 Jun 2021 18:37:56 GMT
X-Proxy-Origin: 84.17.43.131; 84.17.43.131; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com; 37.252.172.229:80
AN-X-Request-Uuid: 9f8f204e-07d0-4c30-a100-ba55f7017b8c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMzkyMzE5Nzg3ODI0MzY0MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame C2BD 111 KB
38 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com
Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 19:05:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84771
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Jun 2021 19:05:05 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/ Frame C2BD 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVkdt2CtS3ISsqUvW5y4E2cJMmzKz4GZpVObE1MUhwpp7fY-pzcc9GhUzJeDw2vNB7s1hO9iy62Xw__A6WGvv3ma6il53bJchg74Fwgep4eVUp0l8lIHQ6gc_KqHqCEWkrY-3jKchA9XHEzdqJ8McP7rheKQ&dbm_d=AKAmf-C4ePNaNWSy4izX9AGGYd-EKjRzkh4S9iLxs1UxOQSPlyyfh1Tk70-wVObqJ5LyASsvaNMLxqWZLEToRgl-lNQM-_qTgMaVD7j7hSWxHlUquY0GQEPTGKYXRj2dcaCDx2kOVswp8ZaLzn3Yt-1tFazn8xF0G8TSzKfgLCRnO6bMgalk9LYFT8TTn09DK8rj3biPDWkPW3OpdGv19y8eVWWEdGsXDmqOktBMNpWKCn-DFBpoKQIdsflhYtFxC7leFcdktFRgkusCszS-6FvX4WaPcgG6WgVVlHZzeOcneFmKaRmgixYrdoQMI4rvNlgyJOt1zFAHfsnDGg20iof9YkcgqVkE1i82KaHfmnHt4RN52ZRtFnnoG2poyIQzoFia2kEo99MxsB_nZKVfPS5NfeyKHSBCxGb67gQJlhEv36O1aleX5shkQWC_8rHf5qtHNPNk9fjvGSzjawHF6dxMJ6_sIg_DgzFnVueRWrwJ7XToBD535pwCHliXFWDNHwzpyRZMDi2-xnDZXoeiuBJ3erLICoVinIFwO1P6_ryT31UFlZ5zQtwOLDElAR8Ih8QrJhwIQozQ3e-P52PfvxuqWRCOYzmuoxmKh5FKDAIx2Oweekg1erV9KnrGJ1SrTtlhGjxbWZ6qmgWow_4xTeXCPxFsF88VWPvV-3b9zE0iYzCr1vDuTHPEcXN5JhE_oyZ_VyCA4NZtBIXZ-dl1e6htoBilPG4OfPb5zMomqFAeDLlycOJuPNM2X-wWYf6Ea1M4i1r97BCTb0eZK46AiwpjpB285koP7i4uT1WJWLoKr5l7p_eFkq7yqBBa7d-5VfQBFiXALp86aemEcoen-4NqqQYhrUv5TWKQIND0m4OcugWEinUgQ2r-HHQnFs4TJAxofzJgLvmpKrxPv-L3xmTmJcgmDRWpwGSg6KyGuL-vQj7PK8WJr7EpvkjURNmmypRVn-eUmqE6RoV2z1ebb8SnCQTiHsoMI75Z8itMMw_9xR901ax2QZzkQ-kqTXVA0Au_iZiS38jbKtfFmcIP973H_e-mu5VlfeNBE0xaToW2QzU0EHZXxpOpbsK9rnhLWUZIUI3hYthB84LmqLjIbGzGg5tGw9fTiZuCLMAQY_Dkcc55zvU978PxPaakLDefl86hoIEEiDONQ098s_AkTGp80-kCRzAM3TLTDqC3vNOhVnB-ndB0KetVr-EohMTOkrob9AhV-phg4RhkZh2nmVg3EJ3BUE3jjCmfcmVhHMcksk79Mj1mFKK4DtvF5WLcqpNHS2iHojbmAO7Yi6fJQKYzWjjxN3ZnuYsZttRVusu2w85pPPQyDjOGZJRy0BDz3jXL7-pAMQtk55Erli7tu1r17jxerhsgbcAMeMx5FD32D25wJpwZBGMh2RmueRDbfywAGBOnfWDpzD0jlvKxQYGsAXy4EpIJnhlmaZrpjwyTZUYcNlbfifJyKjZyKdsyPoWPqBdcs0afSoS_qGvVsytw9pwOyGnt-_-ogprnSGNY0-FLD7WEs9TsBqk-TygqmUEFnWofM8ZCR9ksQQqoAIyc7DlpcTjmpb-Cadu54O-a0KaCM0TsmoPK3uAh25Xy4bhTrthSwC4eOLyjhYIKIi43vOvVJOHsqqsZidJ6s3hxfW8MwmTM98qtYSQTWKDS1JshYd3CZgozDylCZja4XslxROJu_qFVtVOUVLRTzqTJBH7Q8PiVzk_mr0wUcitwX196M5gVimrqlBObzk7dTQdVklb9L8DDXzqF3XyVWxDF2xA0u9Sd05MM7Xjvjkem_4LyspfEHDassxsOnTIjNk3HKVN2Mk1Frsd-Mykzz8aZAE7e2aaN2qijPIVLTJgECbYXjFBnBlzxXSa-wq2MoFIpGqTEADjHIbVjheYZwD_t8OIwdmmpKn_gJgzfXNltvdxRt1SbrVRkoIsCA2GqOgO6YWLfNLxlmWeGy2d7RZz9blOzW1jItiVgIM2-VGt52S5FhzYBzSPTwr04Bjbaappl0Zia4nk9hGzrav2CCFRHsrZ9xCWjKvR5O0pVYubhj5UJsIXqGiVIGXgdT_TPYIN6GYkJgp9FYpDinzi1pageEdSKWsFU8i5zXdKllcFlWad7pEKW9__P-UDUFHFGZoXBMLtuhHeobfualCcuvqntcYuDSOdKEULurCI6n4k3bBhLb8T4gOzaMIViJFtGMGeYTF9Y5k1cGRXSY_UnnVv8qt5rLLcoX-KEdaK9bafwXCTgcYrM9iIpWpS2eTfEGo4LROihlRf1k58YdCbPdTl3VRB6XfFdkOPTDdjUrmLmxudGGHVho4g23yZM4By747zsYPuC0tmV_OXZIXFx-gcm8m8m-zXpoxpOH_2TC6hGbHcf1XnL8wc6qZkapZ9BqTviM1SKwihy_Vsjna3zBrdhMz_c_rgyE8ljr1vIC2FZ41p5XnSYNfDbaCf4rQkvl1nPgE-GGXclHJIC0QSSBfwCVMa4tinuABBULSBpr7FUpzUfxZAACVFNnGOxEpkTDOpXc2zVjXgeLhiL5DppFK57gpU0ONxvt5avUU9451IC0ZdpsYfDfKncKIt7zCV2nMzJ3hG3O8onBnHcxRLkf_Xa9vrSQv2BnCkIWx8ktumQB9lRBLpMtWCylHwQw2q6dby8LfI2j4okA5tCz_ghfz5Nb9yfW-lpMHHNlPJlAtz_kIDwilO1Rny49UD-ezpzyJlEJrtlpEscpN8WTDpNdzCMH5zOz4eIVwGrCPd37UbDS0L-InhoBFZ4Il1KB0J38amOHb4i8UsVI9EqBD2yTq65N3deALW051yFXEzyj2aElQhtfToHDopKPI-qHq5-9Tds9c8hnRCfIYY2mGN5PvnY-LXp8vuNByyVi5ledYnr4-x0WOE3QPZBvYNcGSQaDDeucnEJ-FbeFs4L2dBpzEry8uaor4FNHGTDX8Pc2QMxaoMj5jMZaIhlmEPYCBMadidAj7xjVuOxqQ&cid=CAASPeRoeH9AWx_WZ_GMiYNaD_7-VV8yk3pnDS-TR7sAxtZkh20s9yXRPigWaU-5vJEOCFApHg6WYuv2Q1brddE&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 292
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Jun 2021 18:33:04 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210601/r20110914/ Frame C2BD 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210601/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64fce9d17c5101524a6ee73191a1c97a2e47ddc83aed06b5bd22d5c898efd52b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:34:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 227
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8594
x-xss-protection: 0
server: cafe
etag: 7958287194716579593
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Jun 2021 18:34:09 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C2BD 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com
URL: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 15:08:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98940
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 06 Jun 2022 15:08:56 GMT

GET
DATA 200
OK truncated
/ Frame C2BD 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eba3b005dcab6ea9227e13688544f96dfe9beb48dd74a3bde5911c8dfbf61218

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6C32 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Sun, 06 Jun 2021 16:42:16 GMT
expires: Mon, 06 Jun 2022 16:42:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 93340
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
s0.2mdn.net/6772535/1621337138387/ Frame F036 86 KB
21 KB 7ms
7ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/6772535/1621337138387/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d5ec527dd900924fe70f46d875af0533fd13377acc2ac28f2d923932a3167dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /6772535/1621337138387/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 21386
date: Sun, 06 Jun 2021 23:36:22 GMT
expires: Mon, 07 Jun 2021 23:36:22 GMT
last-modified: Tue, 18 May 2021 11:25:38 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 68494
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame C2BD 0
24 B 65ms
65ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst07VA2wnzPdNqAIcQ0_hESlF_sBOz7ZG8yGWAPrTEZLM1pOIYwBuPcPppiVxuhCH9tD1vlg-l-ihV-gCImOUzMWe6ioW8z-iJ_xOb9PPNl7D8iBCBL3XmijFsn1Ug9B1Nasp_3ZAEQqqjfMj_XP0kqRqG9vADyi-Ro6fO8B7Z1mCydXaaFSr-y7OrxYuuF9obiMUYk3MV8ckb8R15ALHcmzUYTwc9kFnEeNZLSlbhOD0_Jackx3zV98oMZzO71I6jAsu76hzUzcbcOtlpF3dbYpGrhgXhvsbBzkEseb5G7lYglw4Bg-7va9E8rwpKYpYLAodWvApm2s6gbypOsSpZVZ-Jcj-8agUUsg9bSzhODdGwGoseRg3FOYLsOna1gwN4JC0URar7pTwG0UocpnhAPZ2PjwHRvPxp7MDMxS4wUwBMYHsPDtbyWOc-alrxaNL-Ls-6dS0Kncaq5g8yBoZm-XW9Fho8sB3Y39lEgFLDSnG6ZUDKoVMlUBr699uAOfdduyw_w0vs4_OCyTJhZuYuw3eZjsUcNBSxNnL1Bnvt-wx2c-de_dcK_0J6nJOfuL_cVq486REXVa9y9z4_xoAFFFuFgoE_N3ZGVw-_jAzxuKJErYAIXpkGCNpgXT0s-Z3dy48S1FKot1wt_edhe4Z5Jt1Hg80gYRJ5nnx8Zn9Bu_KXy--pgYz8uOLUKT_GuLVOtMKiUCXjIpDz9y4DcIv03JwfqVETDOwWEPa_ZvRKfPyHZ8hzKtmVQagPxujc8dUdbTSWmzFbz85zvuvFm77vWzVhbje8Yxb6XPLKedBhrTInluvs3NU2STpU3LBa-OLuGBK1HI5MUTi0MVga6OAD2K0gAY418hLn8_3sK9RaZxlMS0Zt_egbK6WpYnM2-ws9piBOMCA3pnOB2GddhPwRkR9M76Ztp48RmPZx1a0xS2UHWLCpQ8apn1tAt_2Jr6SN42UUf2hF5wsluWGYMag8P2xZb1XGDxDpo6YMLXHVMBNnYUaSr9REQ8WS9Rg2w38OGFG-ai8_LN_kuoWwUS281KF26u1DZyvt-nVTutAHnpYPR6tRqCkpImvaKCzEVD3P9PE5JlN9mmmbfbjv7a5-iIYA4rYhMKRndFRhuZb4U5nUQcTV2OO-QvhIwVI-1uFVBL7N0WyGixWsbjAVIiRIM8abcq0CdY1OH5GNzDNsmg5Q9dufK-H3npIn5nmm77xzy&sai=AMfl-YQ2EoO1hOuWBpUAC4QNkJRIVrn_nTLVt9v6XuwyQ4mV43eUtAykkDxFSOkWqlaMW1MnZGVC5mz-MQbzXYPp5mDFiB6noecMJ4VrpNE0rtL26LcWCrdqJM_KDhKAdaS7jqlWJuaMnEG628QSxCCalk-r-qUjAB4PCb_LMet79JG6VhgyQ-TqIp4pGIDKbO9-U7Pryj_JbmYYWrHRQe_v_-dWfvYQozT4XoMagd2kWJm2P9mYbykN_ixPs_Vg4Bed&sig=Cg0ArKJSzP4_E-ORLxxoEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=50&cbvp=1&cstd=49&cisv=r20210601.10882&adurl=

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7df1e3b0a1a563dddb10f2052e44dbdb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 07 Jun 2021 18:37:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6C32 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 18:13:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1487
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 18:13:09 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F036 2 KB
633 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/6772535/1621337138387/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ffe7c3d559780b916266217b3683f10a7edbc655d5e11149a36e6f74af8fc68f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 07 Jun 2021 17:23:51 GMT
server: ESF
date: Mon, 07 Jun 2021 18:37:56 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 07 Jun 2021 18:37:56 GMT

GET
H3-29 200 DcmEnabler_01_245.js Show response
s0.2mdn.net/879366/ Frame F036 28 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/6772535/1621337138387/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18c864956bf2492c5c86e79b0fec65f0ecbb4b02bfdcfe854b2c5501857fecdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/6772535/1621337138387/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 21:19:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76719
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10285
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 07 Jun 2021 21:19:17 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame F036 15 KB
16 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 22:49:47 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 503289
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Wed, 01 Jun 2022 22:49:47 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame C2BD 0
23 B 60ms
59ms Ping
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS