www.bulgarian-offers.com Open in urlscan Pro
5.9.5.183 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bulgarian-offers.com/
Submission: On October 05 via manual (October 5th 2023, 4:02:06 am UTC) from IN — Scanned from CH

Summary HTTP 252 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 40 IPs in 11 countries across 42 domains to perform 252 HTTP transactions. The main IP is 5.9.5.183, located in Germany and belongs to HETZNER-AS, DE. The main domain is www.bulgarian-offers.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 4th 2022. Valid for: a year.

This is the only time www.bulgarian-offers.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	5.9.5.183 5.9.5.183	24940 (HETZNER-AS) (HETZNER-AS)
3	216.58.212.168 216.58.212.168	15169 (GOOGLE) (GOOGLE)
36	157.240.251.9 157.240.251.9	32934 (FACEBOOK) (FACEBOOK)
27	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2	5.9.5.184 5.9.5.184	24940 (HETZNER-AS) (HETZNER-AS)
1 16	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
2	216.239.32.178 216.239.32.178	15169 (GOOGLE) (GOOGLE)
6	157.240.251.35 157.240.251.35	32934 (FACEBOOK) (FACEBOOK)
1 9	142.250.186.100 142.250.186.100	15169 (GOOGLE) (GOOGLE)
3	142.250.186.99 142.250.186.99	15169 (GOOGLE) (GOOGLE)
1	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
3	66.102.1.155 66.102.1.155	15169 (GOOGLE) (GOOGLE)
1	216.239.34.36 216.239.34.36	15169 (GOOGLE) (GOOGLE)
3	142.250.186.170 142.250.186.170	15169 (GOOGLE) (GOOGLE)
23	172.217.16.193 172.217.16.193	15169 (GOOGLE) (GOOGLE)
1	142.250.186.174 142.250.186.174	15169 (GOOGLE) (GOOGLE)
6	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
4	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
7	142.250.185.193 142.250.185.193	15169 (GOOGLE) (GOOGLE)
3 3	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
3 32	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2 2	54.229.4.219 54.229.4.219	16509 (AMAZON-02) (AMAZON-02)
3 3	213.155.156.166 213.155.156.166	1299 (TWELVE99 ...) (TWELVE99 Arelion)
5 5	70.42.32.95 70.42.32.95	13789 (INTERNAP-...) (INTERNAP-BLK3)
2 2	54.146.162.150 54.146.162.150	14618 (AMAZON-AES) (AMAZON-AES)
1 1	52.45.175.185 52.45.175.185	14618 (AMAZON-AES) (AMAZON-AES)
1 1	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
1	178.250.7.4 178.250.7.4	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	52.51.159.118 52.51.159.118	16509 (AMAZON-02) (AMAZON-02)
1	46.228.164.13 46.228.164.13	56396 (AMOBEE) (AMOBEE)
2 2	89.207.16.140 89.207.16.140	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
2 2	184.73.203.57 184.73.203.57	14618 (AMAZON-AES) (AMAZON-AES)
2 2	52.28.245.130 52.28.245.130	16509 (AMAZON-02) (AMAZON-02)
2 2	51.89.9.251 51.89.9.251	16276 (OVH) (OVH)
1	172.217.16.195 172.217.16.195	15169 (GOOGLE) (GOOGLE)
1 1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2 2	37.157.2.228 37.157.2.228	198622 (ADFORM) (ADFORM)
1	13.225.78.4 13.225.78.4	16509 (AMAZON-02) (AMAZON-02)
7	178.250.7.2 178.250.7.2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.7.9 178.250.7.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
7	23.20.73.218 23.20.73.218	14618 (AMAZON-AES) (AMAZON-AES)
2	178.250.1.25 178.250.1.25	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
3	44.216.83.210 44.216.83.210	14618 (AMAZON-AES) (AMAZON-AES)
1	178.250.1.10 178.250.1.10	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
11	23.32.185.206 23.32.185.206	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	46.228.164.11 46.228.164.11	56396 (AMOBEE) (AMOBEE)
2 2	35.157.117.145 35.157.117.145	16509 (AMAZON-02) (AMAZON-02)
2 3	87.250.250.90 87.250.250.90	13238 (YANDEX) (YANDEX)
1	104.16.88.20 104.16.88.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	204.79.197.204 204.79.197.204	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
15	193.135.136.212 193.135.136.212	3303 (SWISSCOM ...) (SWISSCOM Swisscom Switzerland Ltd)
252	40

12 5.9.5.183 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.183.5.9.5.clients.your-server.de

www.bulgarian-offers.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.212.168 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f168.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

36 157.240.251.9 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
scontent.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 5.9.5.184 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.5-9-5-184.clients.your-server.de

ads.dotcomadvert.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 142.250.186.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.239.32.178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 157.240.251.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.186.100 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f3.1e100.net

www.google.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 66.102.1.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wb-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.34.36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 172.217.16.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.174 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f14.1e100.net

mts0.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.185.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f1.1e100.net

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.0.66 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 142.250.186.130 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.229.4.219 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-4-219.eu-west-1.compute.amazonaws.com

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.155.156.166 (Sweden) 3 redirects

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 70.42.32.95 (United States) 5 redirects

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.146.162.150 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-162-150.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.45.175.185 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-175-185.compute-1.amazonaws.com

im.bluevoox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.130 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.7.4 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.51.159.118 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-159-118.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.228.164.13 (United Kingdom)

ASN56396 (AMOBEE, GB)

d.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 89.207.16.140 (Amsterdam, Netherlands) 2 redirects

ASN41041 (VCLK-EU-SE, US)
PTR: ams03-nessy-float2.dotomi.com

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.73.203.57 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-184-73-203-57.compute-1.amazonaws.com

fksnk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.28.245.130 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-245-130.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.89.9.251 (London, United Kingdom) 2 redirects

ASN16276 (OVH, FR)
PTR: ip251.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.2.228 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-4.fra2.r.cloudfront.net

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 178.250.7.2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.7.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.fr3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.20.73.218 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-20-73-218.compute-1.amazonaws.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.25 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 44.216.83.210 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-216-83-210.compute-1.amazonaws.com

ads.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.10 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 23.32.185.206 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-32-185-206.deploy.static.akamaitechnologies.com

dco-assets.everestads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.228.164.11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.117.145 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-117-145.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 87.250.250.90 (Russian Federation) 2 redirects

ASN13238 (YANDEX, RU)
PTR: bs.yandex.ru

an.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.88.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.79.197.204 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
PTR: a-0005.a-msedge.net

analyticspixel.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 193.135.136.212 (Dietikon, Switzerland)

ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH)

scontent.fqls2-1.fna.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
external.fqls2-1.fna.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
53	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 66 stats.g.doubleclick.net — Cisco Umbrella Rank: 175 cm.g.doubleclick.net — Cisco Umbrella Rank: 329 bid.g.doubleclick.net — Cisco Umbrella Rank: 1063 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 433	261 KB
50	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 122 tpc.googlesyndication.com — Cisco Umbrella Rank: 169	464 KB
47	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 822 scontent.xx.fbcdn.net — Cisco Umbrella Rank: 268 scontent.fqls2-1.fna.fbcdn.net — Cisco Umbrella Rank: 957764 external.fqls2-1.fna.fbcdn.net	679 KB
12	bulgarian-offers.com www.bulgarian-offers.com	190 KB
11	everestads.net dco-assets.everestads.net — Cisco Umbrella Rank: 8803	114 KB
11	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 11 region1.analytics.google.com — Cisco Umbrella Rank: 2225 mts0.google.com — Cisco Umbrella Rank: 6671	2 KB
10	adsafeprotected.com 1 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 1083 static.adsafeprotected.com — Cisco Umbrella Rank: 851 dt.adsafeprotected.com — Cisco Umbrella Rank: 765	106 KB
9	criteo.net static.criteo.net — Cisco Umbrella Rank: 897 csm.eu.criteo.net — Cisco Umbrella Rank: 7577	75 KB
7	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 331	134 KB
6	facebook.com www.facebook.com — Cisco Umbrella Rank: 109	54 KB
5	zemanta.com 5 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 906	3 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	66 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 254	235 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 229	175 KB
3	yandex.ru 2 redirects an.yandex.ru — Cisco Umbrella Rank: 4716	956 B
3	everesttech.net ads.everesttech.net — Cisco Umbrella Rank: 8702	24 KB
3	turn.com 1 redirects d.turn.com — Cisco Umbrella Rank: 2206 ad.turn.com — Cisco Umbrella Rank: 1432 r.turn.com — Cisco Umbrella Rank: 6191	1 KB
3	criteo.com ads.eu.criteo.com — Cisco Umbrella Rank: 7499 cat.fr3.eu.criteo.com — Cisco Umbrella Rank: 8966 rtb.nl3.eu.criteo.com — Cisco Umbrella Rank: 13805	20 KB
3	de17a.com 3 redirects d5p.de17a.com — Cisco Umbrella Rank: 7132	927 B
3	travelaudience.com 3 redirects ads.travelaudience.com — Cisco Umbrella Rank: 11243	895 B
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 113	4 KB
3	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1368 www.googleadservices.com — Cisco Umbrella Rank: 178	612 B
3	google.ch www.google.ch — Cisco Umbrella Rank: 18208	669 B
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 111	212 KB
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 1562	2 KB
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 954	1 KB
2	onetag-sys.com 2 redirects onetag-sys.com — Cisco Umbrella Rank: 1153	1 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 614	1 KB
2	fksnk.com 2 redirects fksnk.com — Cisco Umbrella Rank: 8734	1 KB
2	dotomi.com 2 redirects dclk-match.dotomi.com — Cisco Umbrella Rank: 5383	891 B
2	stackadapt.com 2 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 1241	2 KB
2	yahoo.com 2 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 783	1 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96	21 KB
2	dotcomadvert.com ads.dotcomadvert.com	5 KB
1	microsoft.com analyticspixel.microsoft.com — Cisco Umbrella Rank: 10211	590 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 558	23 KB
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 637	149 B
1	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 830	993 B
1	ctnsnet.com 1 redirects gcm.ctnsnet.com — Cisco Umbrella Rank: 51511	609 B
1	rfihub.com 1 redirects a.rfihub.com — Cisco Umbrella Rank: 4633	1 KB
1	bluevoox.com 1 redirects im.bluevoox.com — Cisco Umbrella Rank: 16820	523 B
0	aura-dsp.com Failed sync-dmp.aura-dsp.com Failed
252	42

	Domain	Requested by
32	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net www.bulgarian-offers.com
30	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
27	pagead2.googlesyndication.com	www.bulgarian-offers.com pagead2.googlesyndication.com googleads.g.doubleclick.net fw.adsafeprotected.com tpc.googlesyndication.com www.googletagservices.com
23	tpc.googlesyndication.com	googleads.g.doubleclick.net www.bulgarian-offers.com cdn.ampproject.org tpc.googlesyndication.com pagead2.googlesyndication.com
16	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com www.googletagmanager.com www.bulgarian-offers.com googleads.g.doubleclick.net
12	www.bulgarian-offers.com	www.bulgarian-offers.com
11	dco-assets.everestads.net	ads.everesttech.net dco-assets.everestads.net
9	external.fqls2-1.fna.fbcdn.net
9	www.google.com	1 redirects www.bulgarian-offers.com googleads.g.doubleclick.net tpc.googlesyndication.com
7	dt.adsafeprotected.com	googleads.g.doubleclick.net
7	static.criteo.net	ads.eu.criteo.com
7	cdn.ampproject.org	googleads.g.doubleclick.net pagead2.googlesyndication.com
6	scontent.fqls2-1.fna.fbcdn.net
6	www.facebook.com	www.bulgarian-offers.com connect.facebook.net static.xx.fbcdn.net
5	b1sync.zemanta.com	5 redirects
4	www.gstatic.com	googleads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net www.bulgarian-offers.com
4	connect.facebook.net	www.bulgarian-offers.com connect.facebook.net
3	an.yandex.ru	2 redirects
3	ads.everesttech.net	fw.adsafeprotected.com ads.everesttech.net dco-assets.everestads.net
3	d5p.de17a.com	3 redirects
3	ads.travelaudience.com	3 redirects
3	fonts.googleapis.com	googleads.g.doubleclick.net
3	www.google.ch	www.bulgarian-offers.com
3	www.googletagmanager.com	www.bulgarian-offers.com www.google-analytics.com
2	scontent.xx.fbcdn.net	www.facebook.com
2	pm.w55c.net	2 redirects
2	googleads4.g.doubleclick.net	fw.adsafeprotected.com
2	www.googleadservices.com	www.bulgarian-offers.com
2	csm.eu.criteo.net	ads.eu.criteo.com
2	c1.adform.net	2 redirects
2	onetag-sys.com	2 redirects
2	x.bidswitch.net	2 redirects
2	fksnk.com	2 redirects
2	dclk-match.dotomi.com	2 redirects
2	fw.adsafeprotected.com	1 redirects www.bulgarian-offers.com
2	sync.srv.stackadapt.com	2 redirects
2	pr-bh.ybp.yahoo.com	2 redirects
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	ads.dotcomadvert.com	www.bulgarian-offers.com ads.dotcomadvert.com
1	analyticspixel.microsoft.com
1	cdn.jsdelivr.net	dco-assets.everestads.net
1	r.turn.com
1	ad.turn.com	1 redirects
1	rtb.nl3.eu.criteo.com	www.bulgarian-offers.com
1	cat.fr3.eu.criteo.com	ads.eu.criteo.com
1	static.adsafeprotected.com	googleads.g.doubleclick.net
1	bid.g.doubleclick.net	googleads.g.doubleclick.net
1	match.adsrvr.org	googleads.g.doubleclick.net
1	px.ads.linkedin.com	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
1	gcm.ctnsnet.com	1 redirects
1	d.turn.com	googleads.g.doubleclick.net
1	ads.eu.criteo.com	www.bulgarian-offers.com
1	a.rfihub.com	1 redirects
1	im.bluevoox.com	1 redirects
1	mts0.google.com	googleads.g.doubleclick.net
1	region1.analytics.google.com	www.googletagmanager.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
0	sync-dmp.aura-dsp.com Failed	googleads.g.doubleclick.net
252	61

This site contains links to these domains. Also see Links.

Domain
feeds.sofiaecho.com

Subject Issuer	Validity	Valid
bulgarian-offers.com Sectigo RSA Domain Validation Secure Server CA	`2022-10-04` - `2023-11-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-07-14` - `2023-10-12`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
ads.dotcomadvert.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-28` - `2024-02-28`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.ch GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2023-12-23`	3 months	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M02	`2023-03-29` - `2024-04-27`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2023-07-07` - `2024-08-04`	a year	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-05` - `2023-10-31`	3 months	crt.sh
*.fr3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-05` - `2023-10-29`	3 months	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M02	`2023-05-09` - `2024-06-07`	a year	crt.sh
*.eu.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-08` - `2023-11-08`	3 months	crt.sh
*.everesttech.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-03-08`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.nl3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-30` - `2023-12-25`	3 months	crt.sh
www.adobetag.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-24` - `2024-08-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
analyticspixel.microsoft.com Microsoft Azure TLS Issuing CA 02	`2023-08-03` - `2024-01-30`	6 months	crt.sh
*.fqls2-1.fna.fbcdn.net DigiCert SHA2 High Assurance Server CA	`2023-09-09` - `2023-12-08`	3 months	crt.sh

This page contains 29 frames:

Primary Page: https://www.bulgarian-offers.com/
Frame ID: C4CF9D6868B1938FAEACEBAF8DA27AC2
Requests: 42 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20190131/zrt_lookup.html
Frame ID: 611B2B2C25B7629AD09E7C60BA445AAA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&adk=1812271804&adf=3025194257&lmt=1696471317&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=128x1080_l%7C140x1080_r&format=0x0&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517300&bpp=8&bdt=679&idt=564&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2542847512249&frm=20&pv=2&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=592
Frame ID: C31805BB83031A7A78EE831F6CFA540A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=7498261197&adk=994406813&adf=1477197835&pi=t.ma~as.7498261197&w=1200&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517309&bpp=2&bdt=688&idt=590&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=45&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=p5mHVPmlwG&p=https%3A//www.bulgarian-offers.com&dtd=595
Frame ID: 8709EF179214314FA4E0A134B2B5D6D7
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=3193551653&adk=1978459429&adf=788956508&pi=t.ma~as.3193551653&w=403&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=403x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517311&bpp=1&bdt=690&idt=602&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=598&ady=963&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=OEtW05aYrV&p=https%3A//www.bulgarian-offers.com&dtd=607
Frame ID: 9060DDD9F2530EFA34662DFAFE9F60B3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=3532418840&adk=2519321542&adf=2344358796&pi=t.ma~as.3532418840&w=1200&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517312&bpp=1&bdt=692&idt=609&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C403x280&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=192&ady=3272&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=wZ43kBM3uL&p=https%3A//www.bulgarian-offers.com&dtd=613
Frame ID: DD4B091606ED23020A976FD030F703EF
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: BD4F51284E3AA5A4F28A4B0A929AB021
Requests: 9 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012309181453000/amp4ads-v0.mjs
Frame ID: 4F9D9C45A4A70E5F434E44729A6FD7FB
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Frame ID: 085D54256480899393B142BCDB022019
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Frame ID: 8752C91EBD3879D05008D8CA904AE74F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Frame ID: 50D067509DD2DD17FAD077E1DBD960DD
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZR41NQAObK0CO8cKAAn-Im70e1srW3gRrqbswQ&u=%7CE26oTIDD3s1A89%2Bi5P2xTq4IZz41DqiRnjAHTGye8EY%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oVqw7Cvg7ORav6XsKrfZypXol0x0js6wX_heo-ey2iI3mrfMJZp16BwxC42jh3zDaNs5xDjhXMlFmo-psryGrpQHthYXIaBY86XTRPnjcv6huaxpMEpiZBKGp6nw1ecDvFFnLe6WCeyu0VG1EVH_LtvSGChkOYIhCmUJuEIogSacmtPL5yLcBp-v4y5Td5Mx1dYAKXHok4RLKyXMlDGqb79HIuobkdvJLzoT6m6kUjykp13JALXKl-XLmYAMF5IWU_KcqR7prBGaaIartqTD8k9fSnQ9Uzi1aXeoZE5wbqr4ED_fBXNh6QHDDZ-hBav3RW6JT37ux5RG1ZMuqlw0DpUbvboYikjJVYP5UnGpxtxTZKTRNlvlLTvRZVTPXSw_8IC_KyoBa46EeKvObSbD7QpuGEiX4U6vZNyIN3N4OXQoIXkZMDwfnDxQOwl7BcR3iowGa9lRuRjxrej9cTqk1v4L23U4v6jjGU_M9uMpbexFeQ_ce7Z1oHMTR8eLzwDrAGoe22JGbmB06kI7G11TOF-BEM6lR4hN2I3gM9P2WH5yAmV29qUh_b0Al7y84D7Ahk7AEyZQva1RDH4KkT571tjI0yLQZBk_uv6pG9Dgcvpo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIAkENTUeZa3ZOYqO78EPovynyALJntKxXNWdkfdwwI23ARABIABg9dXGgcwEggEXY2EtcHViLTI0OTg3NzExNzM5OTg1NDfIAQmpAhPU3jE7oLE-qAMByAMCqgTtAU_QYfTweckmXvaNdKrt79ZBI9gUFp0WHLpkH6l7BLX4F8exO0JWpCo9tf4nQZkw4OM4qAo2hVJFH-qWu1P1IOBRVgUmezPhOxZAxSc-KdgHATXh1f1zPrEYp5ossNCdx0QFXYrY_4WVrzZg4skiVdlLBaJNwrdAVj7c7yX36adZH5X1Pjsb5kA2zlhcRhmzW0dGn-pcw8slpjNjGJRZ1l9erH0Fp7w7CQf4EDx1EHcM7hK7mqb7qqmQ4XWztugvBDEdh97PdagtWRgtb35hyjMJ0UIVNkWdWwrUsVso5clrO4kBTy3ujza7wdnjcoAGy9-_-5fMovUXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEgiAYRABMgKKAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2DOswumL5oPAzOHuZm25FCoynQHw%26client%3Dca-pub-2498771173998547%26adurl%3D
Frame ID: FAA471AFA5E7C446D16B04B767693F3A
Requests: 11 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/window_focus_fy2021.js
Frame ID: 2BC671945D46A1021CDDB765AC1B604A
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0944ED1B4C10DC1273352C75F1D4F7C4
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIuDmgEY0P6q7gEwAQ&v=APEucNXWMpAhvdS5nyI8PZuav4aj-8WVwo2bBrsvnARCktjNHMVJzcnYCNRMijO3oXR2KTJ4HGsuOkj0wLHqEwZUZT_VKzRGdA
Frame ID: 611D145A46AFA32FBA9569A68898CD92
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 26EDFC3C83647DB4B941633E4A394E31
Requests: 29 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 76CC31443D7CC3CDB3FE32F218B6FFB4
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 73AF9E34DBE9001DB8B6F8BD40C648AA
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5ACFBB9E6F753112FA80204D5C458E19
Requests: 9 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: ADC552D72D6C60515083441EC7E525D1
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js
Frame ID: D3E903C7BE31621A0B7421935B4818A2
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 073AC61857D66FA47EDE4A23CD4A0D28
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js
Frame ID: E0B26B72CAE933C1340EA76EB28A378F
Requests: 1 HTTP requests in this frame

Frame: https://dco-assets.everestads.net/ics-campaign/static/dco/html5-ad-script_v4.html?data=ZR41OAAAHMp37Qe6
Frame ID: F38163C780F17BE6B5DB4353B210D581
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 52FBCA953CADC3A3B7B7F8889C6CCA96
Requests: 9 HTTP requests in this frame

Frame: https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420
Frame ID: 62E92BAA07570A55B394AAF0166AD873
Requests: 53 HTTP requests in this frame

Frame: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
Frame ID: 1A36C0B4F01B902483F05BFBA94D8F1D
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: BD5B11FF6F55E5CACD8FD5BB133EB150
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 361227269F68ADF6CACAC594E0AA48B9
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Property in Bulgaria, Bulgarian properties portal

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Yandex.Direct (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://an\.yandex\.ru/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

252
Requests

88 %
HTTPS

0 %
IPv6

42
Domains

61
Subdomains

40
IPs

11
Countries

2863 kB
Transfer

7842 kB
Size

53
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://feeds.sofiaecho.com/~r/rss2/all-news/~3/e9P1fVLjdE8/1821644_sovereign-order-of-malta-assists-hospital-in-bulgarias-iskrets

Search URL Search Domain Scan URL

URL: http://feeds.sofiaecho.com/~r/rss2/all-news/~3/3Nz3eZfM7Mc/1822044_tourism-bulgaria-to-spend-300m-leva-on-restoring-castles-ancient-sites

Search URL Search Domain Scan URL

URL: http://feeds.sofiaecho.com/~r/rss2/all-news/~3/-ItuxP4EtXQ/1820280_france-prepares-for-final-round-of-presidential-election

Search URL Search Domain Scan URL

URL: http://feeds.sofiaecho.com/~r/rss2/all-news/~3/U6rHH1eT7A8/1820775_report-only-145-per-cent-of-people-have-access-to-free-press

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

https://ads.travelaudience.com/google_pixel?google_gid=CAESEOpDLMAGp_6uvZL1vxM3-BQ&google_cver=1&google_push=AXcoOmTlZRlrkSojvDmMHWcGJPn3-ubL8ynCQcqPVxGj_Vu2i7TrI5zZkNZca-bFgmqZu2GvEIrbE7nX0hkW6YqkwFyj3Wvp4hPR-kPH HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmTlZRlrkSojvDmMHWcGJPn3-ubL8ynCQcqPVxGj_Vu2i7TrI5zZkNZca-bFgmqZu2GvEIrbE7nX0hkW6YqkwFyj3Wvp4hPR-kPH

Request Chain 70

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIo95QFruDgcXzckZwoR7ME&google_cver=1&google_push=AXcoOmSEt_NJq0oSXHFWeTZshLYpjv4QysGIv1eJMNV4Va9yXvCP3GgSitSfQdaWMEIA0ISrjnVF68SfKUGVRleiFkfCuEn9bXmO6mkj HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSEt_NJq0oSXHFWeTZshLYpjv4QysGIv1eJMNV4Va9yXvCP3GgSitSfQdaWMEIA0ISrjnVF68SfKUGVRleiFkfCuEn9bXmO6mkj&google_hm=eS1EcEpBdy5aRTJwR1plSmhiUDBfZjBFdW5aeWhuaUFQNH5B

Request Chain 71

https://d5p.de17a.com/cookies/google?google_gid=CAESENaEgaaAafxZ2Rpaq5VAwxk&google_cver=1&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdEgLG7rRQyiwx HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESENaEgaaAafxZ2Rpaq5VAwxk&google_cver=1&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdEgLG7rRQyiwx HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdEgLG7rRQyiwx

Request Chain 72

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEOIBa6FD7lKtYekhw2Ic9Zk&google_cver=1&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAovc6FN5xz0Fjs4m29_IY HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEOIBa6FD7lKtYekhw2Ic9Zk&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAovc6FN5xz0Fjs4m29_IY&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAovc6FN5xz0Fjs4m29_IY&google_hm=ZnlYUXpFUngwcVpicnRuUmgteGw=

Request Chain 73

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEIljMpIb1-AKG2zHVybCF9w&google_cver=1&google_push=AXcoOmT5tEvV9tOhKo55uGagbLCTQ68E2Lgh3x-i_rROzJ9zsC1uzpO6a3niXNKXaJ4dz5I7E-DNBnY2nSRQNVxqpHp9uS_k-UitHoPC HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmT5tEvV9tOhKo55uGagbLCTQ68E2Lgh3x-i_rROzJ9zsC1uzpO6a3niXNKXaJ4dz5I7E-DNBnY2nSRQNVxqpHp9uS_k-UitHoPC

Request Chain 74

https://im.bluevoox.com/pixel?s1=2&s2=203601&s3=m52eksbsgbowze8o&cm=1&rd=1&google_gid=CAESECv8cmGfOs5difaoGMl4rQ8&google_cver=1&google_push=AXcoOmRl_gcKGuVvq1UdhJwI82foDTuSCzj4Rzk7_94B_RaXbgYXu0KOHMj49lDgwZTan5sjolqWCkTLEvz3LOycaygZtC1ihB3fJfL-lw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AXcoOmRl_gcKGuVvq1UdhJwI82foDTuSCzj4Rzk7_94B_RaXbgYXu0KOHMj49lDgwZTan5sjolqWCkTLEvz3LOycaygZtC1ihB3fJfL-lw&google_hm=QlMuN2EyNi0yYjIwLTRjZGItOWY3ZA==

Request Chain 75

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEDoNYEfq4RJpLV5oesUFSu4&google_cver=1&google_push=AXcoOmT6U2dVm4OjLPf8wJPrL1su5MbwDY71ZygCNzHrhJ8j20r1yN3k8rfmZqenrCeXLhn8lrF3Eeyo-GSZaTmdWTyVMJI3n7OVJWv9cQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmT6U2dVm4OjLPf8wJPrL1su5MbwDY71ZygCNzHrhJ8j20r1yN3k8rfmZqenrCeXLhn8lrF3Eeyo-GSZaTmdWTyVMJI3n7OVJWv9cQ&google_hm=ODM0NjcxOTM0MjU5ODI4ODgzNA==

Request Chain 111

https://cm.g.doubleclick.net/pixel?google_nid=turn_dmp&google_cm HTTP 302
https://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/?mpuid=CAESEB-FQNYgxfAxHj3zi1iRX3U&google_cver=1

Request Chain 116

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFsthhP4wwhbaycp8SoKMLw&google_cver=1&google_push=AXcoOmRFTn6oujJpzGC7-xo7IW_J0tE4BwIZDQ0xg294PTvJzpYUJC-czsaIwkZC-0U2b1mBG7Z1S_qjJ8UjnyOmy5IPr5UGR4oCpHo HTTP 302
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=7627bc1676621693&is_secure=true&networkId=14000&version=1&google_gid=CAESEFsthhP4wwhbaycp8SoKMLw&google_cver=1&google_push=AXcoOmRFTn6oujJpzGC7-xo7IW_J0tE4BwIZDQ0xg294PTvJzpYUJC-czsaIwkZC-0U2b1mBG7Z1S_qjJ8UjnyOmy5IPr5UGR4oCpHo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAIL8WE07ugFAMx5rh0AAAAAAA&expiration=1696564919&google_cver=1&is_secure=true&google_gid=CAESEFsthhP4wwhbaycp8SoKMLw&google_push=AXcoOmRFTn6oujJpzGC7-xo7IW_J0tE4BwIZDQ0xg294PTvJzpYUJC-czsaIwkZC-0U2b1mBG7Z1S_qjJ8UjnyOmy5IPr5UGR4oCpHo

Request Chain 117

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEG76JlmHunWuiUN3dXpf_0s&google_cver=1&google_push=AXcoOmQ41V2WSKs2Jnk1gz2xMRosYWA5NHYYlh6yA8akZXlxVC0nREgwdYTGeeWnXMkBXe3_FJ6c_db91InH3RnaOUP61MDbSRuHsw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQ41V2WSKs2Jnk1gz2xMRosYWA5NHYYlh6yA8akZXlxVC0nREgwdYTGeeWnXMkBXe3_FJ6c_db91InH3RnaOUP61MDbSRuHsw&google_hm=WGbz_KdNTNed7tNM59i5xPs

Request Chain 118

https://fksnk.com/cs/google?google_gid=CAESEIcehUgcXt8vjaNga79aQig&google_cver=1&google_push=AXcoOmRorOoBON_EZX-jg7BqzuJTQ1Nl61T5f1vrAFwUfA2lvf2_vTL3CZE2gn22rKfhgXbQxX4RJPOluk6qVwgRBjxLz827tJoNXg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QjM1OTJBOEQ1MjQ3REZGOA==

Request Chain 119

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEuVFeuNzLkrgSuqYR28c_Y&google_cver=1&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr6xoK1nMdyUw HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEEuVFeuNzLkrgSuqYR28c_Y&google_cver=1&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr6xoK1nMdyUw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr6xoK1nMdyUw&google_hm=V8BADwexT5CU6QZ68bAqxA==

Request Chain 120

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEKHixlrUnZHZOwx8jADz54E&google_cver=1&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjokz-U3sinJtV-jKweQ HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEKHixlrUnZHZOwx8jADz54E&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjokz-U3sinJtV-jKweQ&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjokz-U3sinJtV-jKweQ&google_hm=aGRrMkJldHJRU09yNlJRbFI0ZXU=

Request Chain 121

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEH1CPTq1j7MgDLpj3yCoTfA&google_cver=1&google_push=AXcoOmRvW1XJ-y-VGmtWFOlgCMBOkbSOetCFPfDuXCw1ejk6ivD5cPVCwbSFn9hYaROeNd9KOKhwV0vDUKPQxaiu9gCb-cr_bDXZxAQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_4DGVKitcs-2L_wFrtLSOmo2zgsPfLw&google_push=AXcoOmRvW1XJ-y-VGmtWFOlgCMBOkbSOetCFPfDuXCw1ejk6ivD5cPVCwbSFn9hYaROeNd9KOKhwV0vDUKPQxaiu9gCb-cr_bDXZxAQ

Request Chain 125

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEGXaeTIumCXn89J33GINB3c&google_cver=1&google_push=AXcoOmS_K0Z8TRUdESxXLbEKld5IIM8FpbBzcy3psXQuDpjMTmbTFZXbJ75yhjINmWITSfIZ7U0mT8K08bjFMcdjTMU1efa4uJuv2g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmS_K0Z8TRUdESxXLbEKld5IIM8FpbBzcy3psXQuDpjMTmbTFZXbJ75yhjINmWITSfIZ7U0mT8K08bjFMcdjTMU1efa4uJuv2g

Request Chain 127

https://fksnk.com/cs/google?google_gid=CAESEIcehUgcXt8vjaNga79aQig&google_cver=1&google_push=AXcoOmT6H-MJ4ocuk2iUioegyxQxwKOX6uBCz_56eJ226mobtTo1LL_JGConqUEap30CP-lblDKHw96RZeZDMP5sR1agxwaaKPDH0g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MUMwMDYzMDVFMEZFMjQ1MQ==

Request Chain 128

https://ads.travelaudience.com/google_pixel?google_gid=CAESEEBfh-WPPnfypaYqvA_5-A8&google_cver=1&google_push=AXcoOmT5MXDTGm4JjhOIwXAOGQz_eAlPRmfbnB8fxCL_BTumDlxmtamWeGlkyHeOXnXHeHa1RoGm6sBWHOQblO-c-nU8BB2ENExRcw HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmT5MXDTGm4JjhOIwXAOGQz_eAlPRmfbnB8fxCL_BTumDlxmtamWeGlkyHeOXnXHeHa1RoGm6sBWHOQblO-c-nU8BB2ENExRcw

Request Chain 129

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENLxj5m0VT51cay69a6cWO8&google_cver=1&google_push=AXcoOmQgJO2ss6Uiu_4dqEZFUQpQyapdFLEQd6bl_aGwGkty8lAvcRs6YEwKGzXvijFGF22GOQrc0a0Lgm6XQzd20Td8g7MJrZW7Vg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQgJO2ss6Uiu_4dqEZFUQpQyapdFLEQd6bl_aGwGkty8lAvcRs6YEwKGzXvijFGF22GOQrc0a0Lgm6XQzd20Td8g7MJrZW7Vg&google_hm=eS1EcEpBdy5aRTJwR1plSmhiUDBfZjBFdW5aeWhuaUFQNH5B

Request Chain 130

https://d5p.de17a.com/cookies/google?google_gid=CAESEGG_iOuDq6a7N91YahjQSJg&google_cver=1&google_push=AXcoOmR-Dlxb29kzW7yNnOd5hmX7p5sjJFyvL9a2wvp31w103V_TNKbA5iARnstA2HfcetFEdbavfdyHB62_1igG-QgUr5niO-PgYA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmR-Dlxb29kzW7yNnOd5hmX7p5sjJFyvL9a2wvp31w103V_TNKbA5iARnstA2HfcetFEdbavfdyHB62_1igG-QgUr5niO-PgYA

Request Chain 131

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEG1l80jjXHc6qsk8BU6mJs0&google_cver=1&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8AwamNzcc4oY63rhzzEEO_x4MWSpsZg HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEG1l80jjXHc6qsk8BU6mJs0&google_cver=1&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8AwamNzcc4oY63rhzzEEO_x4MWSpsZg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODM5MTYxMTAwODk5NjEzMjY4Mg&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8AwamNzcc4oY63rhzzEEO_x4MWSpsZg

Request Chain 134

https://fw.adsafeprotected.com/rfw/bgd/1525570/72171777/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9NomzpKb8-pxV3KVd33bj7UUOIZXjDnqW7C_H46z1om_ezoyuGUei9UtPnQUyirsrS9p50mo3lwYwCaX48Nz1T4wLt1oycIGcOPvbkSuRUAoCZ_4ISz9SW-B26Af2386KgTqTD9wOxj3H52U9gYhecNn9HTeKnqgoAk6HlLP3eu958-2oOfnqwpUACIjaYq9JMfS_NQhpYOlfgJKwvRFU9Qghp0arwuof-Wj0tWPscFBM6MEHz74RyiYYlVqPH2FNyPcXYq_YWqc48CP1mt23YZWuV6V93ZwpOytd2LI559AD735GIky0PQonS4fo5eEVyQstCMtHgMfifB8k55w1xTMe1XXN3YwBOHcqQNs6ii1S_j1MIBIL7BFy3lpPjg_sQbxEBfqxB7sBsBJsl23JU2Lua9-BQsxLo9oyi0AIZaWA4LGOH-P8f3-zmU-XJVTZckb9FN2DJhX0GVEHUrgiey2y_FhKBakDM0fIZfXJSkO2NCB8UhGlNDFsaZrupzNzJxeRDLAaAYJ-T4sAA_oqxQ9ERwkLCpG9mt762byaLdRPhcYL24BkXQqb1yzIti_P4mc58MoLB379Bo9pnIiaI0peaALTee5jDSjeq9NqzFrgVx8aOSnuIsb--5ftqfLjvEjOczbDq70lKr0izmdBcSARiySbNHyBaas_MZ_SDDIFOn7mJnGIp-HXikMBBICUcX-qWamcRIylqYreu4ttWDy5wwMU9y_QLeRLmCNn3J1uaBACEmo4dE5ufFcOkbLPfGN66WTTEEbzR70PtoR9-Nv8Vml7aPfkt0T3yuxhDY6Aj0-z_enWckYgZuvlHgiO6KAPcg5qnWs1eIepl-PcZG486qLTBAhroH4QIz9vE2fiq3EQ5wmfoSsRk2h6KqdwYM399W4T1iRfFZ3ndMHlZVEOyE9KyvrqOdRIdS7yV7d8Bl1tMW49jDpIP0B3Evb31Dw9b3SzgcezHXLYTQ4_gV-BqzyIXXAZ0kTUb2nz66nKo7_3tUI--xKNhAhk9W3OzfONpauI9vmTVpAPYFrYfyC6P4Db2CmUTeqh03HPYFHzQgPBgJJSpqBrbBjoPq0J4hlmNTFjTzwUuPMi0xgZxxcOCL1-DBcHkGk7Phi3pORI6CNLHhijNsAlHgkkOzHCxei53HSW1S2PWztm7uyDDyZC6PZvLw-D_Wmk49gjCcukkSwgJHQL42ygaMfQLOMjy_WRkbpsOYojd62OaBSAiZbd9OBF4clQqRxzpDtpRovqU_5gA3gH72V3Ns23JAodiQoDnw1vQiZU0GMrMy4Vyz4rEiUogw9B8S78dkjvSwviha3lq8pmk5TtSzhtFq-0sXta8vzVs0JX83Lv_KXIrkGoGViJ6xN9cxmDsJuknIrw4bq4QxVGjfFGMJk6WuQ2JjI9a8pXW_TVzLwEEjA7q0kVx4lBV2kMSVg9OgMnW6vwKw8THbMUS6G61g-CpkG1xe5mlecrv-9TTW9dJQupGM179KzhEMa5SUDhHL5kpgx_c3eQQGHJ9rJQzg6TOauwAAkKwCanLJdQL-LejMNU2pqNc_rf6ucOMlnhH-tw3fE7lQsHo52J49oOiRjUAogc4qqcgTrJGNaGvdhJjoVKKjIkjyY-YEfdHlHo9OYQCQXvqkoHVcavP8cn-rqpsgFqumZys_c_1s9i8Kci7X39kG011gmO-3WKPIti3atphOckoIov3Y_R2p5zUE4utHvu_Q32WDlRWl4XG31Ep5rjzQsiMKFNbluMWMy_qZnh33exNDYtrYbitVR8SasB6-loUzr_f7UIhKr3LGrKb7tiCXJHmXcPcVfuHqy6GLS0FFjxCEd_C9fwfJqRyXgW6t3nn0BOkd010Vwq67st-jADUxOoF_J_w_5vcxaHmhqyVueMP6QhCTiZi7SMW-l-XS8ZgzsfCnd_j41GwSVtp7vOQz8G3ajE7LGWD11pG-y9G-tafeXP7YLjRabgoaMb_WWcrrjG4UBcog4elSNbGKnBMe2h07dAe3RsLR2srR1BAr5ixw0UUz73_1JNoUBEqmJWj9B9RPYhVQX-0v7V0tPLmVQPNIx-7VX7BVp4Q4KciYs8wqsqeCFc2gQxZWiPbMn8t5bPzcCXOfBvr1t8LFqGxEY1EHAYAXuBGDAsnPeHfPE1vjUqRaG8a6stikxSKeiK1d8_sIAOcMb42b2ykHOEBfpuxFFQQH7aevdmAsJ2l-DTdxyAluede9rKpivYzP_kWk9-79pL6bxC-xxtkxF9oBZDca6QpBN7xqrVSvTBZAelxv1BXDV5o4_597ZQPIIvQWkLeZQOxWB2xIAg23YqldEhRfR55aimuo8ElEeZE8xXaxMvmE9kJlKwnG13HmxJG9f9gsmQxsGV9GJ80G-zmDYOtoKEH3VJXPI5jqod2TP_jC6Im-GpfAWRpCcL7JQStjKqFlB59HOzKfxAQOhOjTloy9BzsGJMqm1mBIwlvO3TRXl8vcVRiapmjnX-O2yNc4ZR5DdgJP51yl1-lTPgj3vBtLIwBbFaPXFop4-3yOvsKouNiO19-YJOsPpmTGzCqAXuY3q2P8NXtzFo6UEDSpGVsJIEw0Zhq_Zxe9TtefeDqdI7wf15lX5facTk7opIQkbDdpxwlmXfpWZq3ak-EuD4nvbcMUQAqKg2HhAqOw_E_Z-NeZXPr1sv3sdgnITFcZBZvBwzMkepTZHcMHvVhDlMo9jPWobqIPPSxdtXOXNNDLIs82FxsdwkUXl04Mz68Ge8XioVOSPHfWYgiQANXVD-d2K4gTgrrZt-Rno1UYvz0osOiN7Difr4yXkUDjcdnH8PP-_-gsTmgqzfNmqGcgNgdVrgwt9oLJZk8aF9uTMbJ527IZw_PP0sGLuoLv9sNI2B4zoTH-ST7xWzLrQXZOiP4FDW7RHac6gIhrgFMNrX9x7EnLAArFjuDk7vxgktfkjs86KrapwUjfGjg2FT4In4Lgh69QWGgPu_lcaNrtVcz5OaOK3tSx4pUo5pn92ioU-9f-SFmuVqxZWvSxmGPX2Oyj5y0wtShY5POEwk22cBDSgPZ5Ej2quGvhbrf3HXPJ5jv6tKR587S10PktTNp5gnONyaiceNh-_KW6TZNwI7MIKv1C7Mvhmf8_EZn7frAabikk4BCg95T50uvlkFrA5OJGzWQu90syWkNAkBbgnNo5fcUiNgjYk6nHFHkTFxC2rZs1L6E7bEAgM5G7CJCHpzNMOqRTAhON4GKOQCSFYTHIrLLG2LLxuk9oKNfZOI9uSWMt9sQCXoJsRpZBPoW1I2LboryhrV4_pHWrt9l6zxoYniSbmlYUW7w47i9p59DpCPaiEBo0h9YbDyTyAFyRTdiGRWeULi_jCeobPdwl48KI8UcyYxtYkt3CT6100Y35h1gdD_jdJoDM2lebJDc_J49dCoyk8WXTHELkofg0pqkd18PoHv_YC2HzoHEP-_HM3tjBVfrrphuaBxYbS8XeYra-ND3UggBHd_ThcnkPsNdhdZBzW6J2N_tipqWXT2IDqESuTvMjBbBfavUNW9dp3gpa8J2mVg4dMI5zi9gV9KwwG6R16Zg2DrXK4bqDDUeGuQSzZTyQIGBs4DKjdzawDz2bHb2EB_mCJrVeTnii_JBpwqnUDj10fMngPYsgkNSsKpPwVpaX2MoaI9e6gixzSXkGxYDy4AcVpQbu2Cn9OnVIvWsMh5wog18UxCYeOOUqlqQRqCZXU7sc0Oz0DWKni13QKENSEy_K9RJNWaxTpbjDCUhguk0aQggEEjwAyAmmjRn7Hpps7ChxsCzDt6MzAjTUm4Yu4uRdK-6gaJ85kbd6Vr_XBZGalqPdkB9U5XYhQupFRXmuDlsYAWAB&cry=1&bundleId=&ias_dspID=3&ias_campId=1013062319&ias_pubId=pub-2498771173998547&ias_chanId=1&ias_placementId=20276414284&bidurl=https://www.bulgarian-offers.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hrFeEK2UQ1SNPRRnLxgmmH&adsafe_url=https%3A%2F%2Fwww.bulgarian-offers.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231003%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231003%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-3-%26adk%3D1812271801%26client%3Dca-pub-2498771173998547%26fa%3D1%26ifi%3D7%26uci%3Da!7%26btvi%3D3%26xpc%3Dr8K0a4O9jd%26p%3Dhttps%253A%2F%2Fwww.bulgarian-offers.com&adsafe_type=be&adsafe_jsinfo=,id:69b6d4fb-7909-f599-d9a2-7f1e732bb80a,c:q8TCfK,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-797d947f74-xbspw,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:5,mot:0,app:0,maw:0,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:36,oid:ee8c06bc-6333-11ee-9b36-16747d9df865,v:19.8.439,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9NomzpKb8-pxV3KVd33bj7UUOIZXjDnqW7C_H46z1om_ezoyuGUei9UtPnQUyirsrS9p50mo3lwYwCaX48Nz1T4wLt1oycIGcOPvbkSuRUAoCZ_4ISz9SW-B26Af2386KgTqTD9wOxj3H52U9gYhecNn9HTeKnqgoAk6HlLP3eu958-2oOfnqwpUACIjaYq9JMfS_NQhpYOlfgJKwvRFU9Qghp0arwuof-Wj0tWPscFBM6MEHz74RyiYYlVqPH2FNyPcXYq_YWqc48CP1mt23YZWuV6V93ZwpOytd2LI559AD735GIky0PQonS4fo5eEVyQstCMtHgMfifB8k55w1xTMe1XXN3YwBOHcqQNs6ii1S_j1MIBIL7BFy3lpPjg_sQbxEBfqxB7sBsBJsl23JU2Lua9-BQsxLo9oyi0AIZaWA4LGOH-P8f3-zmU-XJVTZckb9FN2DJhX0GVEHUrgiey2y_FhKBakDM0fIZfXJSkO2NCB8UhGlNDFsaZrupzNzJxeRDLAaAYJ-T4sAA_oqxQ9ERwkLCpG9mt762byaLdRPhcYL24BkXQqb1yzIti_P4mc58MoLB379Bo9pnIiaI0peaALTee5jDSjeq9NqzFrgVx8aOSnuIsb--5ftqfLjvEjOczbDq70lKr0izmdBcSARiySbNHyBaas_MZ_SDDIFOn7mJnGIp-HXikMBBICUcX-qWamcRIylqYreu4ttWDy5wwMU9y_QLeRLmCNn3J1uaBACEmo4dE5ufFcOkbLPfGN66WTTEEbzR70PtoR9-Nv8Vml7aPfkt0T3yuxhDY6Aj0-z_enWckYgZuvlHgiO6KAPcg5qnWs1eIepl-PcZG486qLTBAhroH4QIz9vE2fiq3EQ5wmfoSsRk2h6KqdwYM399W4T1iRfFZ3ndMHlZVEOyE9KyvrqOdRIdS7yV7d8Bl1tMW49jDpIP0B3Evb31Dw9b3SzgcezHXLYTQ4_gV-BqzyIXXAZ0kTUb2nz66nKo7_3tUI--xKNhAhk9W3OzfONpauI9vmTVpAPYFrYfyC6P4Db2CmUTeqh03HPYFHzQgPBgJJSpqBrbBjoPq0J4hlmNTFjTzwUuPMi0xgZxxcOCL1-DBcHkGk7Phi3pORI6CNLHhijNsAlHgkkOzHCxei53HSW1S2PWztm7uyDDyZC6PZvLw-D_Wmk49gjCcukkSwgJHQL42ygaMfQLOMjy_WRkbpsOYojd62OaBSAiZbd9OBF4clQqRxzpDtpRovqU_5gA3gH72V3Ns23JAodiQoDnw1vQiZU0GMrMy4Vyz4rEiUogw9B8S78dkjvSwviha3lq8pmk5TtSzhtFq-0sXta8vzVs0JX83Lv_KXIrkGoGViJ6xN9cxmDsJuknIrw4bq4QxVGjfFGMJk6WuQ2JjI9a8pXW_TVzLwEEjA7q0kVx4lBV2kMSVg9OgMnW6vwKw8THbMUS6G61g-CpkG1xe5mlecrv-9TTW9dJQupGM179KzhEMa5SUDhHL5kpgx_c3eQQGHJ9rJQzg6TOauwAAkKwCanLJdQL-LejMNU2pqNc_rf6ucOMlnhH-tw3fE7lQsHo52J49oOiRjUAogc4qqcgTrJGNaGvdhJjoVKKjIkjyY-YEfdHlHo9OYQCQXvqkoHVcavP8cn-rqpsgFqumZys_c_1s9i8Kci7X39kG011gmO-3WKPIti3atphOckoIov3Y_R2p5zUE4utHvu_Q32WDlRWl4XG31Ep5rjzQsiMKFNbluMWMy_qZnh33exNDYtrYbitVR8SasB6-loUzr_f7UIhKr3LGrKb7tiCXJHmXcPcVfuHqy6GLS0FFjxCEd_C9fwfJqRyXgW6t3nn0BOkd010Vwq67st-jADUxOoF_J_w_5vcxaHmhqyVueMP6QhCTiZi7SMW-l-XS8ZgzsfCnd_j41GwSVtp7vOQz8G3ajE7LGWD11pG-y9G-tafeXP7YLjRabgoaMb_WWcrrjG4UBcog4elSNbGKnBMe2h07dAe3RsLR2srR1BAr5ixw0UUz73_1JNoUBEqmJWj9B9RPYhVQX-0v7V0tPLmVQPNIx-7VX7BVp4Q4KciYs8wqsqeCFc2gQxZWiPbMn8t5bPzcCXOfBvr1t8LFqGxEY1EHAYAXuBGDAsnPeHfPE1vjUqRaG8a6stikxSKeiK1d8_sIAOcMb42b2ykHOEBfpuxFFQQH7aevdmAsJ2l-DTdxyAluede9rKpivYzP_kWk9-79pL6bxC-xxtkxF9oBZDca6QpBN7xqrVSvTBZAelxv1BXDV5o4_597ZQPIIvQWkLeZQOxWB2xIAg23YqldEhRfR55aimuo8ElEeZE8xXaxMvmE9kJlKwnG13HmxJG9f9gsmQxsGV9GJ80G-zmDYOtoKEH3VJXPI5jqod2TP_jC6Im-GpfAWRpCcL7JQStjKqFlB59HOzKfxAQOhOjTloy9BzsGJMqm1mBIwlvO3TRXl8vcVRiapmjnX-O2yNc4ZR5DdgJP51yl1-lTPgj3vBtLIwBbFaPXFop4-3yOvsKouNiO19-YJOsPpmTGzCqAXuY3q2P8NXtzFo6UEDSpGVsJIEw0Zhq_Zxe9TtefeDqdI7wf15lX5facTk7opIQkbDdpxwlmXfpWZq3ak-EuD4nvbcMUQAqKg2HhAqOw_E_Z-NeZXPr1sv3sdgnITFcZBZvBwzMkepTZHcMHvVhDlMo9jPWobqIPPSxdtXOXNNDLIs82FxsdwkUXl04Mz68Ge8XioVOSPHfWYgiQANXVD-d2K4gTgrrZt-Rno1UYvz0osOiN7Difr4yXkUDjcdnH8PP-_-gsTmgqzfNmqGcgNgdVrgwt9oLJZk8aF9uTMbJ527IZw_PP0sGLuoLv9sNI2B4zoTH-ST7xWzLrQXZOiP4FDW7RHac6gIhrgFMNrX9x7EnLAArFjuDk7vxgktfkjs86KrapwUjfGjg2FT4In4Lgh69QWGgPu_lcaNrtVcz5OaOK3tSx4pUo5pn92ioU-9f-SFmuVqxZWvSxmGPX2Oyj5y0wtShY5POEwk22cBDSgPZ5Ej2quGvhbrf3HXPJ5jv6tKR587S10PktTNp5gnONyaiceNh-_KW6TZNwI7MIKv1C7Mvhmf8_EZn7frAabikk4BCg95T50uvlkFrA5OJGzWQu90syWkNAkBbgnNo5fcUiNgjYk6nHFHkTFxC2rZs1L6E7bEAgM5G7CJCHpzNMOqRTAhON4GKOQCSFYTHIrLLG2LLxuk9oKNfZOI9uSWMt9sQCXoJsRpZBPoW1I2LboryhrV4_pHWrt9l6zxoYniSbmlYUW7w47i9p59DpCPaiEBo0h9YbDyTyAFyRTdiGRWeULi_jCeobPdwl48KI8UcyYxtYkt3CT6100Y35h1gdD_jdJoDM2lebJDc_J49dCoyk8WXTHELkofg0pqkd18PoHv_YC2HzoHEP-_HM3tjBVfrrphuaBxYbS8XeYra-ND3UggBHd_ThcnkPsNdhdZBzW6J2N_tipqWXT2IDqESuTvMjBbBfavUNW9dp3gpa8J2mVg4dMI5zi9gV9KwwG6R16Zg2DrXK4bqDDUeGuQSzZTyQIGBs4DKjdzawDz2bHb2EB_mCJrVeTnii_JBpwqnUDj10fMngPYsgkNSsKpPwVpaX2MoaI9e6gixzSXkGxYDy4AcVpQbu2Cn9OnVIvWsMh5wog18UxCYeOOUqlqQRqCZXU7sc0Oz0DWKni13QKENSEy_K9RJNWaxTpbjDCUhguk0aQggEEjwAyAmmjRn7Hpps7ChxsCzDt6MzAjTUm4Yu4uRdK-6gaJ85kbd6Vr_XBZGalqPdkB9U5XYhQupFRXmuDlsYAWAB&cry=1&bundleId=

Request Chain 142

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 155

https://googleads.g.doubleclick.net/pagead/adview?ai=C6OEtNTUeZcfxOdTVgAfT07CoDuHj7OVw4P6orqURh7-kzfcKEAEg8LXJHGD11caBzASgAc7ul4UpyAEJqQIggDP9OUyyPqgDAcgDywSqBIoCT9Co2A4yeFwWwGBtL9UH9n6fjtgCNwyyhtQ12WrfFYlY5jkKKFaqJRnzFqshCTFHaBwRXDtb_1xQc6UUaq7-DdWdUyuVq2z0LVTufcZpfVEz9XWaALjNHmwQbkHKvzD-zXwtuFNnZKf4Efr0LADWoqS24KuO0D65Tm7JyeneHyCeaKFbuEwZZqHEx9VmB0cdqbVfHWNZP69ayYL04057RBXFVBPcAKWdzPUhov5IxMfbLDhTtFbDaqC_jVgiOQWWihdbUDVbLgedFSgh0dkQn34Z64D1eOsFMLNItaVSJBQop6cJSiQLUgJz-9ofg1e-U1RmNMWYYGlK1u2G9JOstqDPp4l6176SidrABJTouKetBIgFzt_1nEuSBQQIBBgBkgUECAUYBKAGLoAHzqbo5AOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBC-_g_SCBQIgGEQARgfMgKKAjoCgEBIvf3BOpoJM2h0dHBzOi8vd3d3LmFjcXVhbGlmZS5jaC9jb3N0cnV6aW9uZS1waXNjaW5lLXRpY2lub4AKAcgLAdoMEQoLEJCEgYz03fvrwQESAgEDuBOIBNgTCtAVAYAXAbIXHAoaCAASFHB1Yi0yNDk4NzcxMTczOTk4NTQ3GAA&sigh=X8a7d67I-kU&uach_m=[UACH]&ase=2&nis=4&cid=CAQSOwDICaaNPMd800iwL_jWHdxregMuf-FBFgPUoTkb5hOBd10ZCdHRUlOWe11uspzjvoILcPUzVX6wbVKdGAE&template_id=520&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xdd2c167d0beb30640000000000000000%22,%222%22:%220x3ec9cd4baa17bad80000000000000000%22,%223%22:%220xe1493cb1ced8fb8e0000000000000000%22,%224%22:%220x35a36013a2f990e40000000000000000%22,%225%22:%220x87c74ada44781dbc0000000000000000%22},%22debug_key%22:%2216071645526841637753%22,%22debug_reporting%22:true,%22destination%22:%22https://acqualife.ch%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211016730446%22],%224%22:[%2210-05%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%223159016382139767873%22}&andc=true

Request Chain 173

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEJNvky_Bsx8gWNp1bine8m8&google_cver=1&google_push=AXcoOmSLe5Yln6pWahXdrauk4lr0CvUsjVToD1r9kVSNXqF1loUcB2aDfpnOj8afBCDh4TvcqeCTpkn0gvzBh-4vY4yrIDXVWpHt-A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjcyNTgwMDY5MTUzNDkzNjQ0OQ==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEG_ovByclwRaeeR54w1XdEg&google_cver=1

Request Chain 174

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELIniKk_HT01JP-R2bqB37A&google_cver=1&google_push=AXcoOmTQdK0uSDDcp7G5i0RntrE8uEz8r_2QV4NGTfVK24x7SmiP1sVz7T55oN2gQMVlIakGrTjtxeYb2hBHWhLP5JEx_gJIT6Dqtg HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELIniKk_HT01JP-R2bqB37A&google_cver=1&google_push=AXcoOmTQdK0uSDDcp7G5i0RntrE8uEz8r_2QV4NGTfVK24x7SmiP1sVz7T55oN2gQMVlIakGrTjtxeYb2hBHWhLP5JEx_gJIT6Dqtg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OE1udXp0SHMxUU9meU41&google_gid=CAESELIniKk_HT01JP-R2bqB37A&google_cver=1&google_push=AXcoOmTQdK0uSDDcp7G5i0RntrE8uEz8r_2QV4NGTfVK24x7SmiP1sVz7T55oN2gQMVlIakGrTjtxeYb2hBHWhLP5JEx_gJIT6Dqtg

Request Chain 175

https://ads.travelaudience.com/google_pixel?google_gid=CAESEEBfh-WPPnfypaYqvA_5-A8&google_cver=1&google_push=AXcoOmQn4kejYF_BcDgwUrX3az_xheRZquB79TeeurUJiaBaWQ_ZZK_obxJre_8ou-xvCbxoNrbOlAcPS0ygU45kfJXGXibfrWc HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmQn4kejYF_BcDgwUrX3az_xheRZquB79TeeurUJiaBaWQ_ZZK_obxJre_8ou-xvCbxoNrbOlAcPS0ygU45kfJXGXibfrWc

Request Chain 176

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEKHixlrUnZHZOwx8jADz54E&google_cver=1&google_push=AXcoOmSDzK1CDRJFuhslENn98X3JSpJ_UCGDF2cWLUa3r2SNmPLy8KZsF6KWsyWPyIUbPbNYIypho_CCwB11GU_bzEKrPHRRYmtsQQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSDzK1CDRJFuhslENn98X3JSpJ_UCGDF2cWLUa3r2SNmPLy8KZsF6KWsyWPyIUbPbNYIypho_CCwB11GU_bzEKrPHRRYmtsQQ&google_hm=aGRrMkJldHJRU09yNlJRbFI0ZXU=

Request Chain 177

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEItJ-up3Ou_SW5t0J9iVce0&google_cver=1&google_push=AXcoOmTSeaxFEOGGIVb6ik4esfosoXR0pf4NBRuRY2CoKN4Kslq8WFDLrnQe3PzokKkTgXTuxqNs6LYtVs9iOgQ6d3a-WCgiFa1yTQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmTSeaxFEOGGIVb6ik4esfosoXR0pf4NBRuRY2CoKN4Kslq8WFDLrnQe3PzokKkTgXTuxqNs6LYtVs9iOgQ6d3a-WCgiFa1yTQ

Request Chain 178

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEH1CPTq1j7MgDLpj3yCoTfA&google_cver=1&google_push=AXcoOmQ15bkORKS46DZLz4rQMD83fK7Ni0ocsYNTvNvv_vtwMEXNI52q9nW_KpWuV6ZCbI4o5lsopv11WKGzXv1xO8asPNb6_BA9Gg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_5rgZfbu0ISkxgRa_LrQ-kGyNLMVJsQ&google_push=AXcoOmQ15bkORKS46DZLz4rQMD83fK7Ni0ocsYNTvNvv_vtwMEXNI52q9nW_KpWuV6ZCbI4o5lsopv11WKGzXv1xO8asPNb6_BA9Gg

Request Chain 179

https://an.yandex.ru/mapuid/google/CAESEDAX6GcoERUtZ-rw7BCUB9k?ext-param=AXcoOmT4vvgllJV8eROMXJI7kLIvrGOa2viUvpGSpaYACm-5czLLJ44_snw7dwRHfBJaVCu0oJOfUPP1B9FNs1tjrogJ-oCd62xt0Cs&partner-tag=yandex_ag&google_cver=1 HTTP 302
https://an.yandex.ru/mapuid/google/CAESEDAX6GcoERUtZ-rw7BCUB9k?redir-setuniq=1&ext-param=AXcoOmT4vvgllJV8eROMXJI7kLIvrGOa2viUvpGSpaYACm-5czLLJ44_snw7dwRHfBJaVCu0oJOfUPP1B9FNs1tjrogJ-oCd62xt0Cs&partner-tag=yandex_ag&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEDAX6GcoERUtZ-rw7BCUB9k&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif HTTP 302
https://an.yandex.ru/resource/spacer.gif

252 HTTP transactions
14 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.bulgarian-offers.com/ 38 KB
7 KB 531ms
139ms Document
text/html 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) / PHP/5.4.45
Resource Hash: c14d4b51b09deecd26292474b3adab4a891f9d6f14ed199d80f2780ab5845ed8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 7219
Content-Type: text/html; charset=UTF-8
Date: Thu, 05 Oct 2023 04:01:55 GMT
Keep-Alive: timeout=15, max=100
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.45

GET
H/1.1 200
OK jquery-1.4.2.min.js Show response
www.bulgarian-offers.com/jquery-1.4.2/ 70 KB
24 KB 53ms
53ms Script
text/javascript 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bulgarian-offers.com/jquery-1.4.2/jquery-1.4.2.min.js?language=en
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e23a2a4e2d7c2b41ebcdd8ffc0679df7140eb7f52e1eebabf827a88182643c59

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Content-Encoding: gzip
Last-Modified: Sat, 05 Jun 2010 18:13:40 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "44009b-119ee-4884c662d9d00"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 24606

GET
H/1.1 200
OK jquery.autocomplete.js Show response
www.bulgarian-offers.com/jquery-1.4.2/ 19 KB
7 KB 149ms
47ms Script
text/javascript 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bulgarian-offers.com/jquery-1.4.2/jquery.autocomplete.js?language=en
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 855dc9a6f383513c905390a076f72690c7b7227ae3d65e89629fc9f9a1075db6

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Content-Encoding: gzip
Last-Modified: Sat, 05 Jun 2010 20:01:53 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "44009c-4dd8-4884de930ee40"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 6459

GET
H/1.1 200
OK common.js Show response
www.bulgarian-offers.com/property/real_estate/en/ 6 KB
2 KB 149ms
47ms Script
text/javascript 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bulgarian-offers.com/property/real_estate/en/common.js?language=en
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 9e0880eca3596976121c505b04932ab904d7cb49177ac0f56e7ee4f61ae9bb47

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 Feb 2019 08:22:10 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "420efa-18c9-5827749893080"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 1878

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 192 KB
70 KB 474ms
72ms Script
application/javascript 216.58.212.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-751386628

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f168.1e100.net

Software

Google Tag Manager /

Resource Hash

0287f649ffcf892b10603ca40ec4506842fe2feafb4f2fc5173ee222d013b4e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71987
x-xss-protection: 0
last-modified: Thu, 05 Oct 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 05 Oct 2023 04:01:57 GMT

GET
H/1.1 200
OK bootstrap.min.css
www.bulgarian-offers.com/ 190 KB
27 KB 126ms
51ms Stylesheet
text/css 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bulgarian-offers.com/bootstrap.min.css
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 80185d950137849dce381e6632912d72f2209f3c1bf299e6db404b5d5b8bb585

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Content-Encoding: gzip
Last-Modified: Thu, 02 Feb 2023 21:30:26 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "420efe-2f980-5f3be45f9dce0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Content-Length: 27526

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 439ms
42ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

2cd95361220184bc836ad910263d86e4269c84bba071145f02628962109ba93f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 04:01:57 GMT
content-md5: DrMA1eUwFDxoQdVDSNGuZA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1686
x-fb-debug: Ary02dIhlo6EDkuT8tjPFEs3hAmrqr730KmDAgg/+aSBlGPRp0Z3DgNvrsmnzKkh2MZZZrxjWkLwhh/CxYfYSg==
x-fb-content-md5: cfe1f24486b233b326e447e0b74c9a59
cross-origin-opener-policy: same-origin-allow-popups
etag: "1831c2c3e822ea4d4f6da3df85a2a973"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:16:24 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
50 KB 475ms
66ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2498771173998547

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

9fd696c91aaee1b430fc4988b16f07e418021b26c35cc1ec6502db41ef1b1731

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Origin: https://www.bulgarian-offers.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50730
x-xss-protection: 0
server: cafe
etag: 17978358575380083036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:57 GMT

GET
H/1.1 200
OK 101691_t.jpg
www.bulgarian-offers.com/property_images/202337/ 12 KB
12 KB 49ms
47ms Image
image/jpeg 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bulgarian-offers.com/property_images/202337/101691_t.jpg
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 484192ede3741e6bd6df2a1401c504b8bfd21f9c99d3b5126ab3f0b3920fecbc

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Last-Modified: Wed, 13 Sep 2023 23:10:29 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "d80035-2fee-60545aa659fce"
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 12270

GET
H/1.1 200
OK 101592_t.jpg
www.bulgarian-offers.com/property_images/202334/ 22 KB
23 KB 53ms
51ms Image
image/jpeg 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bulgarian-offers.com/property_images/202334/101592_t.jpg
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 89868ea5d1b5c17d58ab5bfff72da64db4bd63a308ccba15b93cafbc0e0b4e5c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Last-Modified: Thu, 24 Aug 2023 16:26:12 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c80033-59a8-603adafbd0596"
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Content-Length: 22952

GET
H/1.1 200
OK 101580_t.jpg
www.bulgarian-offers.com/property_images/202334/ 22 KB
23 KB 54ms
52ms Image
image/jpeg 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bulgarian-offers.com/property_images/202334/101580_t.jpg
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 89868ea5d1b5c17d58ab5bfff72da64db4bd63a308ccba15b93cafbc0e0b4e5c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Last-Modified: Thu, 24 Aug 2023 16:20:48 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c80027-59a8-603ad9c6a8cb6"
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 22952

GET
H/1.1 200
OK 101348_t.peg
www.bulgarian-offers.com/property_images/202319/ 32 KB
32 KB 92ms
49ms Image
image/jpeg 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bulgarian-offers.com/property_images/202319/101348_t.peg
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 0390b513ae1b116f504f8944871a901101d2988a035eeb1b244bff0544db6893

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:56 GMT
Last-Modified: Sun, 14 May 2023 16:55:34 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "820565-7f36-5fbaa34f3141c"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Content-Length: 32566

GET
H/1.1 200
OK 97482_t.jpg
www.bulgarian-offers.com/property_images/201930/ 22 KB
23 KB 96ms
47ms Image
image/jpeg 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bulgarian-offers.com/property_images/201930/97482_t.jpg
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 616d55248222dd9e041e90f2c186b25c5413485ebf9d5201adec671f6c350659

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:56 GMT
Last-Modified: Wed, 24 Jul 2019 17:45:29 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "44345d-5912-58e70e00854cd"
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Content-Length: 22802

GET
H/1.1 200
OK news_75_61.jpg
www.bulgarian-offers.com/images/ 8 KB
8 KB 59ms
48ms Image
image/jpeg 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bulgarian-offers.com/images/news_75_61.jpg
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: a6c3938a1c6275906298598d0205639f15bb6671ce183a3a9c7f1714fc0ce819

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:56 GMT
Last-Modified: Thu, 24 Jun 2010 11:59:31 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "4400ad-1f97-489c563192ec0"
Content-Type: image/jpeg
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Content-Length: 8087

GET
H/1.1 200
OK astrack.js Show response
www.bulgarian-offers.com/ 3 KB
2 KB 47ms
47ms Script
text/javascript 5.9.5.183
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bulgarian-offers.com/astrack.js
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 5.9.5.183 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.183.5.9.5.clients.your-server.de
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 4862f3918d605d204bac5bf610bb6469d987925f7fb096079b8e9c2d62e0e230

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:01:55 GMT
Content-Encoding: gzip
Last-Modified: Sun, 25 May 2008 16:42:59 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "420766-b70-44e10c175aac0"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=31536000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 1224

GET
H2 200 asyncjs.php Show response
ads.dotcomadvert.com/ads/www/delivery/ 4 KB
5 KB 1400ms
68ms Script
text/javascript 5.9.5.184
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.dotcomadvert.com/ads/www/delivery/asyncjs.php

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.5.184 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.5-9-5-184.clients.your-server.de

Software

nginx/1.20.1 / PHP/8.1.16

Resource Hash

9312305221a918fcc3b8eeeeb56336a844c0de1a65681138f8a8cff0d50e12fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:56 GMT
x-content-type-options: nosniff
server: nginx/1.20.1
x-powered-by: PHP/8.1.16
etag: 8589d537268241d308a251b467e96fd5
x-frame-options: SAMEORIGIN
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: text/javascript;charset=UTF-8
cache-control: private, max-age=3600
expire: Thu, 05 Oct 2023 05:01:56 GMT
x-xss-protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 133 KB
51 KB 417ms
63ms Script
application/javascript 216.58.212.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P5DHBCV

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f168.1e100.net

Software

Google Tag Manager /

Resource Hash

bf99ef8296121dd59293171d103c5d8ad879e51aff395370af7a417c157f374d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52126
x-xss-protection: 0
last-modified: Thu, 05 Oct 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 05 Oct 2023 04:01:57 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 198 KB
53 KB 397ms
43ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

805270b078cde87b61bb57c8bd44f8b58b0d128f5a8efdd4395470b45b291d65

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 05 Oct 2023 04:01:57 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 53356
x-xss-protection: 0
pragma: public
x-fb-debug: EWR0Dx/cK2/zUKDZOTC3VanXch1If0KQ2yegUdpoVtyZAVNcR1OYU8u2c1me/+s0HHR9cz1TWRW/d6fqgE9cUg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
DATA 200
OK truncated
/ 93 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 859790d507acd06e12295953099b5025fc6d49d41683e0af085c5f8513f3c3c7

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 299 KB
85 KB 442ms
51ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=973a4220a2e08ffe5d4f8371a6486ddd

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

4a1d4330774e3191a013f24b15bc8c3c61ed2026b99de211c95ad55ce580eff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.bulgarian-offers.com/
Origin: https://www.bulgarian-offers.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 04:01:57 GMT
content-md5: oIbrQvl8Nbk1CTe1SV8rgA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86665
x-fb-debug: o9cDUGVf++W4UaytOhUkSnc6/5CTHscd+4HIlEmOHGqVCrJm4LArtYucpRt5fUd+sYs5dv67y2pCcuHEgW6D9g==
x-fb-content-md5: d2083eb89f5ca5693b994e46bbf174c2
cross-origin-opener-policy: same-origin-allow-popups
etag: "89e0f056064803e496b57fd4dcca2aed"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 04 Oct 2024 01:12:16 GMT

GET
H2 200 320254528622374 Show response
connect.facebook.net/signals/config/ 131 KB
34 KB 100ms
99ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/320254528622374?v=2.9.132&r=stable&domain=www.bulgarian-offers.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

77ddde2c4f22f96ee03e794b2e8d4703f8e434ac4da9f1e35b14931fd0829ed7

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 05 Oct 2023 04:01:57 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: 91ZEfJRABPyZmnC85DVLgI0b7lVOd48NI2km0E2EcztwbgXkfyv3UTArZwIgn1lv6W1YWBDhkXJVWf84WqTJpw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/ 380 KB
129 KB 507ms
89ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2498771173998547

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

98e38fa4a13948af67ac60918d5175b99fb29132e020a81f1a1b895baa5e95db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131766
x-xss-protection: 0
server: cafe
etag: 13880572237179852710
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:57 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231003/r20190131/ Frame 611B 10 KB
5 KB 454ms
46ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231003/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2498771173998547

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 47949
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 14:42:48 GMT
etag: 2603938475786422795
expires: Wed, 18 Oct 2023 14:42:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 440ms
39ms Script
text/javascript 216.239.32.178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P5DHBCV

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.239.32.178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 03:38:52 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 1385
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 05 Oct 2023 05:38:52 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/751386628/ 3 KB
2 KB 418ms
66ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/751386628/?random=1696478517375&cv=11&fst=1696478517375&bg=ffffff&guid=ON&async=1&gtm=45be3a20&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&hn=www.googleadservices.com&frm=0&tiba=Property%20in%20Bulgaria%2C%20Bulgarian%20properties%20portal&auid=375258186.1696478517&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-751386628

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

1f89f672d6c2271799c67931eedb4b480edaa1d3d94d2a025f67dc9d51889eb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 442ms
47ms Image
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=320254528622374&ev=PageView&dl=https%3A%2F%2Fwww.bulgarian-offers.com%2F&rl=&if=false&ts=1696478517403&sw=1600&sh=1200&v=2.9.132&r=stable&ec=0&o=30&fbp=fb.1.1696478517401.470946452&ler=empty&it=1696478517274&coo=false&exp=a0&rqm=GET

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 05 Oct 2023 04:01:57 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/751386628/ 42 B
455 B 508ms
95ms Image
image/gif 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/751386628/?random=1696478517375&cv=11&fst=1696478400000&bg=ffffff&guid=ON&async=1&gtm=45be3a20&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&frm=0&tiba=Property%20in%20Bulgaria%2C%20Bulgarian%20properties%20portal&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3078648215&rmt_tld=0&ipr=y

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ch/pagead/1p-user-list/751386628/ 42 B
455 B 507ms
92ms Image
image/gif 142.250.186.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ch/pagead/1p-user-list/751386628/?random=1696478517375&cv=11&fst=1696478400000&bg=ffffff&guid=ON&async=1&gtm=45be3a20&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&frm=0&tiba=Property%20in%20Bulgaria%2C%20Bulgarian%20properties%20portal&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3078648215&rmt_tld=1&ipr=y

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
229 B 51ms
50ms XHR
text/plain 216.239.32.178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=548341587&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bulgarian-offers.com%2F&ul=en-us&de=UTF-8&dt=Property%20in%20Bulgaria%2C%20Bulgarian%20properties%20portal&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=1697952063&gjid=124181126&cid=1651249133.1696478518&tid=UA-22211580-34&_gid=1803120288.1696478518&_r=1&_slc=1&gtm=45He3a20n81P5DHBCV&z=346919752

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.239.32.178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

ae6a4ef12251514bfd296baf74abf0824546dd49e026cb6e6e25f3b69ca18ae3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bulgarian-offers.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bulgarian-offers.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 407 B
612 B 534ms
111ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bulgarian-offers.com&callback=_gfp_s_&client=ca-pub-2498771173998547

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

6f41a768f0715fb44bebd372843d7f4b0810318a355fe89893ed7928d074387c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 261
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C318 304 KB
67 KB 388ms
387ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&adk=1812271804&adf=3025194257&lmt=1696471317&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=128x1080_l%7C140x1080_r&format=0x0&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517300&bpp=8&bdt=679&idt=564&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2542847512249&frm=20&pv=2&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=592

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

d513ae94bd4ce124e423f621db4b710ed1e76a240f7d2974808b345441f59f82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 68321
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:58 GMT
expires: Thu, 05 Oct 2023 04:01:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8709 158 KB
48 KB 358ms
358ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=7498261197&adk=994406813&adf=1477197835&pi=t.ma~as.7498261197&w=1200&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517309&bpp=2&bdt=688&idt=590&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=45&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=p5mHVPmlwG&p=https%3A//www.bulgarian-offers.com&dtd=595

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

a8c285f5066b49dd14f436eb5a4f10a02cee37525965a2c6e028ed59c292f9b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 48396
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:58 GMT
expires: Thu, 05 Oct 2023 04:01:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
356 B 547ms
87ms XHR
text/plain 66.102.1.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-22211580-34&cid=1651249133.1696478518&jid=1697952063&gjid=124181126&_gid=1803120288.1696478518&_u=YEBAAEAAAAAAACAAI~&z=822886310

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wb-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

3d89d2a833e0c8b73ddaac6d6ec14c4ab06c648ee6574f1b29e9ab8435e2f41e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bulgarian-offers.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 05 Oct 2023 04:01:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bulgarian-offers.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 266 KB
90 KB 59ms
58ms Script
application/javascript 216.58.212.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8Y4LZ48VEC&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f168.1e100.net

Software

Google Tag Manager /

Resource Hash

c9971a761b2cbeb47238a427c270cf48276ce0dacefd2608fd8428761680566b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92303
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 05 Oct 2023 04:01:57 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9060 328 KB
86 KB 405ms
404ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=3193551653&adk=1978459429&adf=788956508&pi=t.ma~as.3193551653&w=403&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=403x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517311&bpp=1&bdt=690&idt=602&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=598&ady=963&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=OEtW05aYrV&p=https%3A//www.bulgarian-offers.com&dtd=607

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

af597350d8645702d4d08a2bca962e699ac619a84aaecacc0244faee614d64c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

access-control-expose-headers: x-google-amp-ad-validated-version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 87990
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:58 GMT
expires: Thu, 05 Oct 2023 04:01:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DD4B 736 B
687 B 235ms
234ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=3532418840&adk=2519321542&adf=2344358796&pi=t.ma~as.3532418840&w=1200&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517312&bpp=1&bdt=692&idt=609&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C403x280&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=192&ady=3272&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=wZ43kBM3uL&p=https%3A//www.bulgarian-offers.com&dtd=613

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

3b33a70fbf2782be625dd46af56d0247b9fca68c823c5010a6226f2231b3108c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 361
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:58 GMT
expires: Thu, 05 Oct 2023 04:01:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
261 B 626ms
87ms Ping
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-8Y4LZ48VEC&gtm=45je3a20&_p=548341587&_gaz=1&ul=en-us&sr=1600x1200&cid=1651249133.1696478518&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.bulgarian-offers.com%2F&dt=Property%20in%20Bulgaria%2C%20Bulgarian%20properties%20portal&sid=1696478518&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8Y4LZ48VEC&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bulgarian-offers.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 415ms
88ms Ping
text/plain 66.102.1.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-8Y4LZ48VEC&cid=1651249133.1696478518&gtm=45je3a20&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8Y4LZ48VEC&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.102.1.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wb-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bulgarian-offers.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ch/ads/ 42 B
107 B 286ms
93ms Image
image/gif 142.250.186.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ch/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-8Y4LZ48VEC&cid=1651249133.1696478518&gtm=45je3a20&aip=1&z=1887501953

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8709 14 KB
2 KB 537ms
114ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=7498261197&adk=994406813&adf=1477197835&pi=t.ma~as.7498261197&w=1200&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517309&bpp=2&bdt=688&idt=590&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=45&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=p5mHVPmlwG&p=https%3A//www.bulgarian-offers.com&dtd=595

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 05 Oct 2023 03:54:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 8709 2 KB
945 B 648ms
200ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51527
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 400 data=_lYaGEWvFTrvd3K5g34vd9Z5WRzyZ_D96VaDxmMykmHH5BLVOhS2TYUompsb-VVzMDHeDafALT5geRQMAP3w0w
mts0.google.com/vt/ Frame 8709 0
0 661ms
120ms Image
text/html 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mts0.google.com/vt/data=_lYaGEWvFTrvd3K5g34vd9Z5WRzyZ_D96VaDxmMykmHH5BLVOhS2TYUompsb-VVzMDHeDafALT5geRQMAP3w0w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=7498261197&adk=994406813&adf=1477197835&pi=t.ma~as.7498261197&w=1200&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517309&bpp=2&bdt=688&idt=590&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=45&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=p5mHVPmlwG&p=https%3A//www.bulgarian-offers.com&dtd=595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.174 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f14.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 8709 297 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65f22d8aa0690bd9cf8ffe5d68e5f6866b05ed8fc6f6c9083b996c1b3c4c75f4

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 8709 336 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 8709 462 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01cbb105faef1373e9d53ddc5e62c9c7b5f66cbc64c2c045a3daec0328b831e6

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 8709 465 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41b7f4ef86f2344e72da822fe79265700ff1bf3361450a02ab4397ff1a5eb040

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/ Frame 8709 23 KB
9 KB 576ms
171ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51527
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9151
x-xss-protection: 0
server: cafe
etag: 7930219084593097114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 8709 3 KB
1 KB 604ms
199ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51527
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BD4F 1 KB
758 B 115ms
108ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 19548
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 22:36:10 GMT
etag: 48472445140208031
expires: Thu, 05 Oct 2023 22:36:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 8709 20 KB
9 KB 569ms
168ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 03:56:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 335
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 Oct 2023 03:56:23 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8709 0
0 116ms
110ms Image
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS0IURmdZk0LiB8FikjiJvhjEnGfR4sgqTdyFo1eW_IHPdn6pFy8DKpK4Dd77wLYezGQR0A6vnXTKabwP2n0ETtUSDKHg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=7498261197&adk=994406813&adf=1477197835&pi=t.ma~as.7498261197&w=1200&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=1200x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517309&bpp=2&bdt=688&idt=590&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=45&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=p5mHVPmlwG&p=https%3A//www.bulgarian-offers.com&dtd=595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8709 187 KB
59 KB 655ms
127ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

89403ef16933d6911ecc68da312e1934f696994b35d4824928649954a5980bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60043
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696419354076528"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 fda82c26911938d9c7ca79f9220f8b0c.js Show response
www.gstatic.com/mysidia/ Frame 8709 36 KB
15 KB 629ms
111ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fda82c26911938d9c7ca79f9220f8b0c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

8f1843ba4bdea64726280f2365f8ad8a47e70ee54327f98273daf7fac5120074

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 29 Sep 2023 10:18:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 495837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15328
x-xss-protection: 0
last-modified: Mon, 25 Sep 2023 20:14:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 28 Dec 2023 10:18:01 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012309181453000/ Frame 4F9D 223 KB
62 KB 693ms
70ms Script
text/javascript 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309181453000/amp4ads-v0.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=3193551653&adk=1978459429&adf=788956508&pi=t.ma~as.3193551653&w=403&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=403x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517311&bpp=1&bdt=690&idt=602&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=598&ady=963&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=OEtW05aYrV&p=https%3A//www.bulgarian-offers.com&dtd=607

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

fd48a69933bfa6d5e51393b093d776d09a1e7bfb4b7c1e6d4aa00d75f0b3d2d1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 03 Oct 2023 09:05:22 GMT
age: 154597
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62203
x-xss-protection: 0
server: sffe
etag: "59b685ca39a652ba"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 02 Oct 2024 09:05:22 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012309181453000/v0/ Frame 4F9D 15 KB
5 KB 737ms
115ms Script
text/javascript 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309181453000/v0/amp-ad-exit-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

f335a91239c4af1c0491727be910330d3231f01b7498352ddea85ebc5480007a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 03 Oct 2023 09:05:21 GMT
age: 154598
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5217
x-xss-protection: 0
server: sffe
etag: "38a16d64b8e81628"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 02 Oct 2024 09:05:21 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012309181453000/v0/ Frame 4F9D 94 KB
28 KB 741ms
119ms Script
text/javascript 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309181453000/v0/amp-analytics-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

3d23cbcfd35d90cfb139e6f05b6a7fbc22891e2936b6a706ef8147300d66aa08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 03 Oct 2023 09:43:22 GMT
age: 152317
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29033
x-xss-protection: 0
server: sffe
etag: "ac3d68f1a1bd2015"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 02 Oct 2024 09:43:22 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012309181453000/v0/ Frame 4F9D 72 KB
16 KB 738ms
117ms Script
text/javascript 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309181453000/v0/amp-animation-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

f868cbd9df854b57d6bec145062030a53542f58b259e7c43790db3bc0aa8e071

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 02 Oct 2023 17:11:30 GMT
age: 211829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16652
x-xss-protection: 0
server: sffe
etag: "82d94758bb25d178"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 01 Oct 2024 17:11:30 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012309181453000/v0/ Frame 4F9D 5 KB
2 KB 744ms
122ms Script
text/javascript 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309181453000/v0/amp-fit-text-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

309773fa6c23f46befd5880e169b6bc47fe53c4fd326ec1c84d7d53cde803bc9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 03 Oct 2023 09:05:21 GMT
age: 154598
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1919
x-xss-protection: 0
server: sffe
etag: "93680ba5e670b6a8"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 02 Oct 2024 09:05:21 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012309181453000/v0/ Frame 4F9D 40 KB
13 KB 721ms
100ms Script
text/javascript 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309181453000/v0/amp-form-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

f90a0bfda110d40a81d391edeccd1143806c608fd7c64786142c222709d55499

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 03 Oct 2023 09:43:22 GMT
age: 152317
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12946
x-xss-protection: 0
server: sffe
etag: "6bacf375b2677883"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 02 Oct 2024 09:43:22 GMT

GET
DATA 200
OK truncated
/ Frame 4F9D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b50d8f03236874e1741767f5574615296268fb38251414ab1196d26515e6767

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4F9D 2 KB
3 KB 477ms
201ms Image
image/png 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 01:27:29 GMT
x-content-type-options: nosniff
server: cafe
age: 9269
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Fri, 06 Oct 2023 01:27:29 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4F9D 295 B
424 B 445ms
170ms Image
image/png 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 15:21:19 GMT
x-content-type-options: nosniff
server: cafe
age: 45639
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Thu, 05 Oct 2023 15:21:19 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 4F9D 0
0 59ms
59ms Image
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSJy0t3fGlDcY4gz3V5r7zWFq42c506XSTc2S_HrHug5ZJDIrrdisatplP7XbeUxPXNbra4sVVVCF0SxnXJWy9QRCCllg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=3193551653&adk=1978459429&adf=788956508&pi=t.ma~as.3193551653&w=403&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=403x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517311&bpp=1&bdt=690&idt=602&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=598&ady=963&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=OEtW05aYrV&p=https%3A//www.bulgarian-offers.com&dtd=607
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 4F9D 18 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 805d3b588be7de082c664776a0eb36cc9e06a002e814bd25dc0dc8b9d37577a9

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 4F9D 15 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1939709f4d57a3e70527e0adda2ae393f68c8633b03b6e0bcff6227a344b2ab

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 4F9D 13 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a4f7e8fa243a143eec25c5a05d62c8407ee0da3c95da306f520a985cc1b6cdf

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 4F9D 13 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee28eb5c38d047e12af87adcefd400b40da8ec2c745b203231547625c3eb7e35

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/ 154 KB
53 KB 65ms
64ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

75d474f6fa59c3aa6bddb85e9925f67fc79a022d5adfa5ae1d50e80643716ace

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53734
x-xss-protection: 0
server: cafe
etag: 14415078398145618461
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 92ms
92ms Image
image/gif 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-22211580-34&cid=1651249133.1696478518&jid=1697952063&_u=YEBAAEAAAAAAACAAI~&z=179000441

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ch/ads/ 42 B
107 B 89ms
88ms Image
image/gif 142.250.186.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ch/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-22211580-34&cid=1651249133.1696478518&jid=1697952063&_u=YEBAAEAAAAAAACAAI~&z=179000441

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame BD4F
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEOpDLMAGp_6uvZL1vxM3-BQ&google_cver=1&google_push=AXcoOmTlZRlrkSojvDmMHWcGJPn3-ubL8ynCQcqPVxGj_Vu2i7TrI5zZkNZca-bFgmqZu2GvEIrbE7nX0hkW6Yqk...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmTlZRlrkSojvDmMHWcGJPn3-ubL8ynCQcqPVxGj_Vu2i7TrI5zZkNZca-bFgmqZu2GvEIrbE7nX0hkW6YqkwFyj3Wvp4hPR-kPH

170 B
329 B

83ms
78ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmTlZRlrkSojvDmMHWcGJPn3-ubL8ynCQcqPVxGj_Vu2i7TrI5zZkNZca-bFgmqZu2GvEIrbE7nX0hkW6YqkwFyj3Wvp4hPR-kPH

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 05 Oct 2023 04:01:58 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmTlZRlrkSojvDmMHWcGJPn3-ubL8ynCQcqPVxGj_Vu2i7TrI5zZkNZca-bFgmqZu2GvEIrbE7nX0hkW6YqkwFyj3Wvp4hPR-kPH
x-host: tde-deliveryengine-production-8b9d7bc7f-zrjqw
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIo95QFruDgcXzckZwoR7ME&google_cver=1&google_push=AXcoOmSEt_NJq0oSXHFWeTZshLYpjv4QysGIv1eJMNV4Va9yXvCP3GgSitSfQdaWMEIA0ISrjnVF68SfKUGVRleiFkfCuEn...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSEt_NJq0oSXHFWeTZshLYpjv4QysGIv1eJMNV4Va9yXvCP3GgSitSfQdaWMEIA0ISrjnVF68SfKUGVRleiFkfCuEn9bXmO6mkj&google_hm=eS1EcEpBdy5aRTJwR1...

170 B
188 B

72ms
71ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSEt_NJq0oSXHFWeTZshLYpjv4QysGIv1eJMNV4Va9yXvCP3GgSitSfQdaWMEIA0ISrjnVF68SfKUGVRleiFkfCuEn9bXmO6mkj&google_hm=eS1EcEpBdy5aRTJwR1plSmhiUDBfZjBFdW5aeWhuaUFQNH5B

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 05 Oct 2023 04:01:59 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSEt_NJq0oSXHFWeTZshLYpjv4QysGIv1eJMNV4Va9yXvCP3GgSitSfQdaWMEIA0ISrjnVF68SfKUGVRleiFkfCuEn9bXmO6mkj&google_hm=eS1EcEpBdy5aRTJwR1plSmhiUDBfZjBFdW5aeWhuaUFQNH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4F
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESENaEgaaAafxZ2Rpaq5VAwxk&google_cver=1&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdEgL...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESENaEgaaAafxZ2Rpaq5VAwxk&google_cver=1&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdE...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdEgLG7rRQyiwx

170 B
188 B

73ms
73ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdEgLG7rRQyiwx

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmRAzERTMWWiqcjhC3nwqOx_vO24iYLSY8QYxfxyEYajcv6nB1-AkhVYBxBh33gpAUfPsgqaWYbBxGuQirT2d-MdEgLG7rRQyiwx
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4F
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEOIBa6FD7lKtYekhw2Ic9Zk&google_cver=1&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAov...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEOIBa6FD7lKtYekhw2Ic9Zk&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAov...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAovc6FN5xz0Fjs4m29_IY&google_hm=ZnlYUXpFUngwcVpic...

170 B
188 B

193ms
192ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAovc6FN5xz0Fjs4m29_IY&google_hm=ZnlYUXpFUngwcVpicnRuUmgteGw=

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 04:01:59 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmTo4kYjPcGpAmQnmyISJ9SrhD4l8NhE9D5ndZWHE7Zqd2YhuhrB1eTT5u24HyL1wOfpz7okBvz_xOAovc6FN5xz0Fjs4m29_IY&google_hm=ZnlYUXpFUngwcVpicnRuUmgteGw=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 239
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4F
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEIljMpIb1-AKG2zHVybCF9w&google_cver=1&google_push=AXcoOmT5tEvV9tOhKo55uGagbLCTQ68E2Lgh3x-i_rROzJ9zsC1uzpO6a3niXNKXaJ4dz5I7E-DNBnY2nSRQNVx...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmT5tEvV9tOhKo55uGagbLCTQ68E2Lgh3x-i_rROzJ9zsC1uzpO6a3niXNKXaJ4dz5I7E-DNBnY2nSRQNVxqpHp...

170 B
188 B

68ms
68ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmT5tEvV9tOhKo55uGagbLCTQ68E2Lgh3x-i_rROzJ9zsC1uzpO6a3niXNKXaJ4dz5I7E-DNBnY2nSRQNVxqpHp9uS_k-UitHoPC

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmT5tEvV9tOhKo55uGagbLCTQ68E2Lgh3x-i_rROzJ9zsC1uzpO6a3niXNKXaJ4dz5I7E-DNBnY2nSRQNVxqpHp9uS_k-UitHoPC
Date: Thu, 05 Oct 2023 04:01:59 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4F
Redirect Chain

https://im.bluevoox.com/pixel?s1=2&s2=203601&s3=m52eksbsgbowze8o&cm=1&rd=1&google_gid=CAESECv8cmGfOs5difaoGMl4rQ8&google_cver=1&google_push=AXcoOmRl_gcKGuVvq1UdhJwI82foDTuSCzj4Rzk7_94B_RaXbgYXu0KOH...
https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AXcoOmRl_gcKGuVvq1UdhJwI82foDTuSCzj4Rzk7_94B_RaXbgYXu0KOHMj49lDgwZTan5sjolqWCkTLEvz3LOycaygZtC1ihB3fJfL-lw&google_hm=QlMuN2EyNi0y...

170 B
188 B

68ms
68ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AXcoOmRl_gcKGuVvq1UdhJwI82foDTuSCzj4Rzk7_94B_RaXbgYXu0KOHMj49lDgwZTan5sjolqWCkTLEvz3LOycaygZtC1ihB3fJfL-lw&google_hm=QlMuN2EyNi0yYjIwLTRjZGItOWY3ZA==

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AXcoOmRl_gcKGuVvq1UdhJwI82foDTuSCzj4Rzk7_94B_RaXbgYXu0KOHMj49lDgwZTan5sjolqWCkTLEvz3LOycaygZtC1ihB3fJfL-lw&google_hm=QlMuN2EyNi0yYjIwLTRjZGItOWY3ZA==
Date: Thu, 05 Oct 2023 04:01:59 GMT
Server: openresty
Connection: close
Content-Length: 142
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4F
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEDoNYEfq4RJpLV5oesUFSu4&google_cver=1&google_push=AXcoOmT6U2dVm4OjLPf8wJPrL1su5MbwDY71ZygCNzHrhJ8j20r1yN3k8rfmZqenrCeXLhn8lrF3Eeyo-GSZaTmdWTyVMJI...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmT6U2dVm4OjLPf8wJPrL1su5MbwDY71ZygCNzHrhJ8j20r1yN3k8rfmZqenrCeXLhn8lrF3Eeyo-GSZaTmdWTyVMJI3n7OVJWv9cQ&google_hm=ODM0N...

170 B
188 B

74ms
74ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmT6U2dVm4OjLPf8wJPrL1su5MbwDY71ZygCNzHrhJ8j20r1yN3k8rfmZqenrCeXLhn8lrF3Eeyo-GSZaTmdWTyVMJI3n7OVJWv9cQ&google_hm=ODM0NjcxOTM0MjU5ODI4ODgzNA==

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmT6U2dVm4OjLPf8wJPrL1su5MbwDY71ZygCNzHrhJ8j20r1yN3k8rfmZqenrCeXLhn8lrF3Eeyo-GSZaTmdWTyVMJI3n7OVJWv9cQ&google_hm=ODM0NjcxOTM0MjU5ODI4ODgzNA==
Date: Thu, 05 Oct 2023 04:01:59 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame BD4F 0
130 B 352ms
119ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K0uZ8pflX1r36T92dKF9mmt5185wDm2reviymUX7ri3D4vIdhA4rDXLs_Qjk8R8XmR9hvtCTE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/ Frame 085D 10 KB
4 KB 73ms
72ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 45631
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 15:21:27 GMT
etag: 2603938475786422795
expires: Wed, 18 Oct 2023 15:21:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/ Frame 8752 10 KB
4 KB 72ms
71ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 45631
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 15:21:27 GMT
etag: 2603938475786422795
expires: Wed, 18 Oct 2023 15:21:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/ Frame 50D0 10 KB
4 KB 86ms
83ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 45631
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4471
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 15:21:27 GMT
etag: 2603938475786422795
expires: Wed, 18 Oct 2023 15:21:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 085D 4 KB
744 B 159ms
159ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 05 Oct 2023 02:06:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 085D 205 B
519 B 249ms
145ms Image
image/png 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 01:08:26 GMT
x-content-type-options: nosniff
age: 10412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 04 Oct 2024 01:08:26 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 085D 604 B
695 B 250ms
146ms Image
image/png 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 11:42:48 GMT
x-content-type-options: nosniff
age: 58750
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 03 Oct 2024 11:42:48 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/elements/html/ Frame 085D 15 KB
6 KB 186ms
185ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

729bb9007929a8af5c6f300c99e7c5899043ed1734d39fd6f4e0361b94d1adbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 14:00:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50508
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6551
x-xss-protection: 0
server: cafe
etag: 6101707970674548951
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 14:00:10 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/elements/html/ Frame 085D 20 KB
8 KB 185ms
184ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

7f8d937ac3c24cd9099dccaeb3e160dba15d6396b7f8ada3ca95f9ef24633aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 14:00:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50508
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8566
x-xss-protection: 0
server: cafe
etag: 11420928434021954480
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 14:00:10 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame FAA4 49 KB
19 KB 523ms
82ms Document
text/html 178.250.7.4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZR41NQAObK0CO8cKAAn-Im70e1srW3gRrqbswQ&u=%7CE26oTIDD3s1A89%2Bi5P2xTq4IZz41DqiRnjAHTGye8EY%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oVqw7Cvg7ORav6XsKrfZypXol0x0js6wX_heo-ey2iI3mrfMJZp16BwxC42jh3zDaNs5xDjhXMlFmo-psryGrpQHthYXIaBY86XTRPnjcv6huaxpMEpiZBKGp6nw1ecDvFFnLe6WCeyu0VG1EVH_LtvSGChkOYIhCmUJuEIogSacmtPL5yLcBp-v4y5Td5Mx1dYAKXHok4RLKyXMlDGqb79HIuobkdvJLzoT6m6kUjykp13JALXKl-XLmYAMF5IWU_KcqR7prBGaaIartqTD8k9fSnQ9Uzi1aXeoZE5wbqr4ED_fBXNh6QHDDZ-hBav3RW6JT37ux5RG1ZMuqlw0DpUbvboYikjJVYP5UnGpxtxTZKTRNlvlLTvRZVTPXSw_8IC_KyoBa46EeKvObSbD7QpuGEiX4U6vZNyIN3N4OXQoIXkZMDwfnDxQOwl7BcR3iowGa9lRuRjxrej9cTqk1v4L23U4v6jjGU_M9uMpbexFeQ_ce7Z1oHMTR8eLzwDrAGoe22JGbmB06kI7G11TOF-BEM6lR4hN2I3gM9P2WH5yAmV29qUh_b0Al7y84D7Ahk7AEyZQva1RDH4KkT571tjI0yLQZBk_uv6pG9Dgcvpo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIAkENTUeZa3ZOYqO78EPovynyALJntKxXNWdkfdwwI23ARABIABg9dXGgcwEggEXY2EtcHViLTI0OTg3NzExNzM5OTg1NDfIAQmpAhPU3jE7oLE-qAMByAMCqgTtAU_QYfTweckmXvaNdKrt79ZBI9gUFp0WHLpkH6l7BLX4F8exO0JWpCo9tf4nQZkw4OM4qAo2hVJFH-qWu1P1IOBRVgUmezPhOxZAxSc-KdgHATXh1f1zPrEYp5ossNCdx0QFXYrY_4WVrzZg4skiVdlLBaJNwrdAVj7c7yX36adZH5X1Pjsb5kA2zlhcRhmzW0dGn-pcw8slpjNjGJRZ1l9erH0Fp7w7CQf4EDx1EHcM7hK7mqb7qqmQ4XWztugvBDEdh97PdagtWRgtb35hyjMJ0UIVNkWdWwrUsVso5clrO4kBTy3ujza7wdnjcoAGy9-_-5fMovUXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEgiAYRABMgKKAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2DOswumL5oPAzOHuZm25FCoynQHw%26client%3Dca-pub-2498771173998547%26adurl%3D

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b0001552099de600378a80af5f3b106b4125aa67dd0c89220b9eb4145cf3c8ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:58 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=b4nBsEJXvOr0LJ_c7ajdyk5xGCPeKc_TLqF0cd_tupJl93mPm3GcYdSS7BdHgmlW581dfC_YH502cidgOqWbW4MQ3-Y8zTD3NgzKCPMa9jRV2sZh_rsEJqXofr-ij1hKsme3hJ1zuPMiHJ_A4Z_upwRJRDlNKL99qdtkPbFlbiId8nvon4021Gqnkd7ExEt22wcXSP2zN9PitLU2Xk9fhgHuM4aXHk3nETHjxdUsFgQGBGDN6AwPmWYb1kFIo5svv8jwEg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 2298662
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 2BC6 3 KB
1 KB 178ms
177ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51527
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0944 1 KB
677 B 117ms
116ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 19548
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 22:36:10 GMT
etag: 48472445140208031
expires: Thu, 05 Oct 2023 22:36:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 2BC6 20 KB
8 KB 129ms
128ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 03:56:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 335
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 Oct 2023 03:56:23 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2BC6 0
0 120ms
118ms Image
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQizPAB9YbEtu86raj4KhKhvRgzQ3lRZMlpLGGPwuxqrJ5TwOWQ0lGDKwDFY9mWmLoaPtITxnNOS9lcVxEyU18wbvkXQA
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2BC6 187 KB
59 KB 197ms
143ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

89403ef16933d6911ecc68da312e1934f696994b35d4824928649954a5980bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60043
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696419354076528"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 611D 247 B
166 B 142ms
138ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIuDmgEY0P6q7gEwAQ&v=APEucNXWMpAhvdS5nyI8PZuav4aj-8WVwo2bBrsvnARCktjNHMVJzcnYCNRMijO3oXR2KTJ4HGsuOkj0wLHqEwZUZT_VKzRGdA

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

b71f711851635bff1f46249bd0656db01abcebb758d71a0495d4d42e2682c06d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 100
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 26ED 89 KB
31 KB 146ms
142ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1525570/72171777/xbbe/creative/ Frame 26ED 257 KB
78 KB 368ms
90ms Script
application/javascript 52.51.159.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1525570/72171777/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9NomzpKb8-pxV3KVd33bj7UUOIZXjDnqW7C_H46z1om_ezoyuGUei9UtPnQUyirsrS9p50mo3lwYwCaX48Nz1T4wLt1oycIGcOPvbkSuRUAoCZ_4ISz9SW-B26Af2386KgTqTD9wOxj3H52U9gYhecNn9HTeKnqgoAk6HlLP3eu958-2oOfnqwpUACIjaYq9JMfS_NQhpYOlfgJKwvRFU9Qghp0arwuof-Wj0tWPscFBM6MEHz74RyiYYlVqPH2FNyPcXYq_YWqc48CP1mt23YZWuV6V93ZwpOytd2LI559AD735GIky0PQonS4fo5eEVyQstCMtHgMfifB8k55w1xTMe1XXN3YwBOHcqQNs6ii1S_j1MIBIL7BFy3lpPjg_sQbxEBfqxB7sBsBJsl23JU2Lua9-BQsxLo9oyi0AIZaWA4LGOH-P8f3-zmU-XJVTZckb9FN2DJhX0GVEHUrgiey2y_FhKBakDM0fIZfXJSkO2NCB8UhGlNDFsaZrupzNzJxeRDLAaAYJ-T4sAA_oqxQ9ERwkLCpG9mt762byaLdRPhcYL24BkXQqb1yzIti_P4mc58MoLB379Bo9pnIiaI0peaALTee5jDSjeq9NqzFrgVx8aOSnuIsb--5ftqfLjvEjOczbDq70lKr0izmdBcSARiySbNHyBaas_MZ_SDDIFOn7mJnGIp-HXikMBBICUcX-qWamcRIylqYreu4ttWDy5wwMU9y_QLeRLmCNn3J1uaBACEmo4dE5ufFcOkbLPfGN66WTTEEbzR70PtoR9-Nv8Vml7aPfkt0T3yuxhDY6Aj0-z_enWckYgZuvlHgiO6KAPcg5qnWs1eIepl-PcZG486qLTBAhroH4QIz9vE2fiq3EQ5wmfoSsRk2h6KqdwYM399W4T1iRfFZ3ndMHlZVEOyE9KyvrqOdRIdS7yV7d8Bl1tMW49jDpIP0B3Evb31Dw9b3SzgcezHXLYTQ4_gV-BqzyIXXAZ0kTUb2nz66nKo7_3tUI--xKNhAhk9W3OzfONpauI9vmTVpAPYFrYfyC6P4Db2CmUTeqh03HPYFHzQgPBgJJSpqBrbBjoPq0J4hlmNTFjTzwUuPMi0xgZxxcOCL1-DBcHkGk7Phi3pORI6CNLHhijNsAlHgkkOzHCxei53HSW1S2PWztm7uyDDyZC6PZvLw-D_Wmk49gjCcukkSwgJHQL42ygaMfQLOMjy_WRkbpsOYojd62OaBSAiZbd9OBF4clQqRxzpDtpRovqU_5gA3gH72V3Ns23JAodiQoDnw1vQiZU0GMrMy4Vyz4rEiUogw9B8S78dkjvSwviha3lq8pmk5TtSzhtFq-0sXta8vzVs0JX83Lv_KXIrkGoGViJ6xN9cxmDsJuknIrw4bq4QxVGjfFGMJk6WuQ2JjI9a8pXW_TVzLwEEjA7q0kVx4lBV2kMSVg9OgMnW6vwKw8THbMUS6G61g-CpkG1xe5mlecrv-9TTW9dJQupGM179KzhEMa5SUDhHL5kpgx_c3eQQGHJ9rJQzg6TOauwAAkKwCanLJdQL-LejMNU2pqNc_rf6ucOMlnhH-tw3fE7lQsHo52J49oOiRjUAogc4qqcgTrJGNaGvdhJjoVKKjIkjyY-YEfdHlHo9OYQCQXvqkoHVcavP8cn-rqpsgFqumZys_c_1s9i8Kci7X39kG011gmO-3WKPIti3atphOckoIov3Y_R2p5zUE4utHvu_Q32WDlRWl4XG31Ep5rjzQsiMKFNbluMWMy_qZnh33exNDYtrYbitVR8SasB6-loUzr_f7UIhKr3LGrKb7tiCXJHmXcPcVfuHqy6GLS0FFjxCEd_C9fwfJqRyXgW6t3nn0BOkd010Vwq67st-jADUxOoF_J_w_5vcxaHmhqyVueMP6QhCTiZi7SMW-l-XS8ZgzsfCnd_j41GwSVtp7vOQz8G3ajE7LGWD11pG-y9G-tafeXP7YLjRabgoaMb_WWcrrjG4UBcog4elSNbGKnBMe2h07dAe3RsLR2srR1BAr5ixw0UUz73_1JNoUBEqmJWj9B9RPYhVQX-0v7V0tPLmVQPNIx-7VX7BVp4Q4KciYs8wqsqeCFc2gQxZWiPbMn8t5bPzcCXOfBvr1t8LFqGxEY1EHAYAXuBGDAsnPeHfPE1vjUqRaG8a6stikxSKeiK1d8_sIAOcMb42b2ykHOEBfpuxFFQQH7aevdmAsJ2l-DTdxyAluede9rKpivYzP_kWk9-79pL6bxC-xxtkxF9oBZDca6QpBN7xqrVSvTBZAelxv1BXDV5o4_597ZQPIIvQWkLeZQOxWB2xIAg23YqldEhRfR55aimuo8ElEeZE8xXaxMvmE9kJlKwnG13HmxJG9f9gsmQxsGV9GJ80G-zmDYOtoKEH3VJXPI5jqod2TP_jC6Im-GpfAWRpCcL7JQStjKqFlB59HOzKfxAQOhOjTloy9BzsGJMqm1mBIwlvO3TRXl8vcVRiapmjnX-O2yNc4ZR5DdgJP51yl1-lTPgj3vBtLIwBbFaPXFop4-3yOvsKouNiO19-YJOsPpmTGzCqAXuY3q2P8NXtzFo6UEDSpGVsJIEw0Zhq_Zxe9TtefeDqdI7wf15lX5facTk7opIQkbDdpxwlmXfpWZq3ak-EuD4nvbcMUQAqKg2HhAqOw_E_Z-NeZXPr1sv3sdgnITFcZBZvBwzMkepTZHcMHvVhDlMo9jPWobqIPPSxdtXOXNNDLIs82FxsdwkUXl04Mz68Ge8XioVOSPHfWYgiQANXVD-d2K4gTgrrZt-Rno1UYvz0osOiN7Difr4yXkUDjcdnH8PP-_-gsTmgqzfNmqGcgNgdVrgwt9oLJZk8aF9uTMbJ527IZw_PP0sGLuoLv9sNI2B4zoTH-ST7xWzLrQXZOiP4FDW7RHac6gIhrgFMNrX9x7EnLAArFjuDk7vxgktfkjs86KrapwUjfGjg2FT4In4Lgh69QWGgPu_lcaNrtVcz5OaOK3tSx4pUo5pn92ioU-9f-SFmuVqxZWvSxmGPX2Oyj5y0wtShY5POEwk22cBDSgPZ5Ej2quGvhbrf3HXPJ5jv6tKR587S10PktTNp5gnONyaiceNh-_KW6TZNwI7MIKv1C7Mvhmf8_EZn7frAabikk4BCg95T50uvlkFrA5OJGzWQu90syWkNAkBbgnNo5fcUiNgjYk6nHFHkTFxC2rZs1L6E7bEAgM5G7CJCHpzNMOqRTAhON4GKOQCSFYTHIrLLG2LLxuk9oKNfZOI9uSWMt9sQCXoJsRpZBPoW1I2LboryhrV4_pHWrt9l6zxoYniSbmlYUW7w47i9p59DpCPaiEBo0h9YbDyTyAFyRTdiGRWeULi_jCeobPdwl48KI8UcyYxtYkt3CT6100Y35h1gdD_jdJoDM2lebJDc_J49dCoyk8WXTHELkofg0pqkd18PoHv_YC2HzoHEP-_HM3tjBVfrrphuaBxYbS8XeYra-ND3UggBHd_ThcnkPsNdhdZBzW6J2N_tipqWXT2IDqESuTvMjBbBfavUNW9dp3gpa8J2mVg4dMI5zi9gV9KwwG6R16Zg2DrXK4bqDDUeGuQSzZTyQIGBs4DKjdzawDz2bHb2EB_mCJrVeTnii_JBpwqnUDj10fMngPYsgkNSsKpPwVpaX2MoaI9e6gixzSXkGxYDy4AcVpQbu2Cn9OnVIvWsMh5wog18UxCYeOOUqlqQRqCZXU7sc0Oz0DWKni13QKENSEy_K9RJNWaxTpbjDCUhguk0aQggEEjwAyAmmjRn7Hpps7ChxsCzDt6MzAjTUm4Yu4uRdK-6gaJ85kbd6Vr_XBZGalqPdkB9U5XYhQupFRXmuDlsYAWAB&cry=1&bundleId=&ias_dspID=3&ias_campId=1013062319&ias_pubId=pub-2498771173998547&ias_chanId=1&ias_placementId=20276414284&bidurl=https://www.bulgarian-offers.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hrFeEK2UQ1SNPRRnLxgmmH
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.159.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-159-118.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3183de273b2f194bd3f6a1d217f68c4f5be6a1a08aa817cee5ebf43cacdfe7d

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 26ED 3 KB
1 KB 138ms
134ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51527
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 26ED 20 KB
8 KB 136ms
132ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 03:56:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 335
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 Oct 2023 03:56:23 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 26ED 0
0 140ms
137ms Image
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSLefiP5ZWoNl98q_3y2kKEbZd1cfDLam7XsI_Iwap5UBFK5FlUrXXi4yu79aulL4MOr96n819kS4Cm47ZmC8ICo50KpQ
Requested by: Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 26ED 187 KB
59 KB 156ms
144ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

89403ef16933d6911ecc68da312e1934f696994b35d4824928649954a5980bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60043
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696419354076528"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26ED 42 B
110 B 145ms
142ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C6JJYp6aqjUJ83towB2i9Gs7r0bTBPyOaEBZKUD-VCj6VHBSju1JOxy-yJXId5gEq83hUv6IOSWqUjlWE3g7YPW2ZnzaNB1Zx1f0RUczQUcq5aN9s

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26ED 0
121 B 142ms
139ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=12292698654596665169&x=1&ct=76

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 76CC 14 KB
1 KB 84ms
83ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 05 Oct 2023 04:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 05 Oct 2023 03:49:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 05 Oct 2023 04:01:58 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 76CC 2 KB
926 B 75ms
74ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51527
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/ Frame 76CC 23 KB
9 KB 75ms
74ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51527
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9151
x-xss-protection: 0
server: cafe
etag: 7930219084593097114
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 73AF 143 B
228 B 111ms
81ms Document
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 3221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 03:08:18 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 76CC 3 KB
1 KB 101ms
64ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:43:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51528
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:43:11 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5ACF 1 KB
682 B 86ms
64ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 19549
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 22:36:10 GMT
etag: 48472445140208031
expires: Thu, 05 Oct 2023 22:36:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/ Frame 76CC 20 KB
8 KB 89ms
53ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 03:56:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 336
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8339
x-xss-protection: 0
server: cafe
etag: 16954770952846736976
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 19 Oct 2023 03:56:23 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 76CC 0
0 120ms
84ms Image
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQV0NGiqt5QVFzj9UMIMz6nUamVWl6Z6EA3NescrupHtMtQeglyuDp8lRxjfkBsIfqABXkqarOfxZlSJ5QlmcQUzLb0Vw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 76CC 187 KB
59 KB 129ms
94ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

89403ef16933d6911ecc68da312e1934f696994b35d4824928649954a5980bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60043
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1696419354076528"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 04:01:59 GMT

GET
H2 200 fda82c26911938d9c7ca79f9220f8b0c.js Show response
www.gstatic.com/mysidia/ Frame 76CC 36 KB
15 KB 106ms
77ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fda82c26911938d9c7ca79f9220f8b0c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

8f1843ba4bdea64726280f2365f8ad8a47e70ee54327f98273daf7fac5120074

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 29 Sep 2023 10:18:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 495838
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15328
x-xss-protection: 0
last-modified: Mon, 25 Sep 2023 20:14:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 28 Dec 2023 10:18:01 GMT

GET
DATA 200
OK truncated
/ Frame 8709 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6ccc7c8807ab452975a5448458ae8bc9b2dccdf7f07caa84b8edd73fd0b369c

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/ Frame 611D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=turn_dmp&google_cm
https://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/?mpuid=CAESEB-FQNYgxfAxHj3zi1iRX3U&google_cver=1

43 B
398 B

702ms
80ms

Image
image/gif

46.228.164.13
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/?mpuid=CAESEB-FQNYgxfAxHj3zi1iRX3U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIuDmgEY0P6q7gEwAQ&v=APEucNXWMpAhvdS5nyI8PZuav4aj-8WVwo2bBrsvnARCktjNHMVJzcnYCNRMijO3oXR2KTJ4HGsuOkj0wLHqEwZUZT_VKzRGdA
Protocol: H2
Server: 46.228.164.13 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://d.turn.com/r/du/id/L2NzaWQvMS9tcGlkLzI0MTMwODU4/rnd/?mpuid=CAESEB-FQNYgxfAxHj3zi1iRX3U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 309
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 611D 170 B
232 B 70ms
69ms Image
image/png 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIkCEIuDmgEY0P6q7gEwAQ&v=APEucNXWMpAhvdS5nyI8PZuav4aj-8WVwo2bBrsvnARCktjNHMVJzcnYCNRMijO3oXR2KTJ4HGsuOkj0wLHqEwZUZT_VKzRGdA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26ED 0
56 B 101ms
96ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7779868439300&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26ED 0
56 B 98ms
97ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7779868439300&version=m202309260101&ct=76&x=1&cor=12292698654596665000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 26ED 16 KB
12 KB 99ms
98ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bz77m5lKPa3oeWCDL2FaQQDesSj4dllxi2i8rw6pfAbPG7358isPRsyjg7Lg_n6UgLH9F7uDrn-6tGjggN7p-75VllKNkGQQSsgYCr9luBbObwLxe7J-4fVHr8yw-0m0OyTUeJQsEbatUXs35XBaHkRhxZwhsN2q0HJNRj4pE3MC7NDMM&cry=1&dbm_d=AKAmf-DsaYO0ORL0eixQicB2vVFugVz-fd7oizhp2Wlu-J9vKwWr5NUUmcP87s4T9-QIjkGPgnZa72w5feo35FiujBfFtYHo3i_U8KqisPxta6nwMGFq8Z3APNTd4FLoKzDygI3KywpG-X4g33iFWTuG_u7yqbik3CGxKv9LwHiw6HrPikWwcv8E0KrS7-avnRmB0r_Q1ivHoepNhjNcuEKctKD0TNUYrh2PstBdlNS1p5e7V17gEHROjuU4WM-j3L6pjzWecLWy0IhZj53-1t6A21EEpZM_zOMW21ONoIQ_sSj20Q891dCPHZBPeeDg-fBbsQp3tDYsmupeNJpnTUF907EKD8ura1_V3Vz18WHq9A4QdsgEue3rXp99dUZpmaVfTternEMoKMDg-309gRtuWIbrDjgVYYnfI6aR8RZ8T1BVy492VVc9fkTFJoHb_AEG6KeRDN9I9j7mv167iO1ZtnJ1Y8MBXlEi6Vm239cllVrYgMZrw2KQunRxzmY0G1-hMRhxmUobcW8LiMCdCaFEqQMgY7ZRhd_G_So84QQWGqPVGVf0rHp3lYCOghm4LMFe7PlK1QSXwZgTib2W-HT__k1DF2h31QeoAas1_zz5KhXCcOh9G3YHQgp8LZa0x2U9PWgNJUSNiPOy_m_QHSaC-8PrIcIw_Wcaw1aQUspbUvtciRdPpOy4x68NmaFb2kvZ8DsWC7CZ6V2U3_Yn9LIT34cEoN0BOpgVlAFI7gP2xRjU2c4F-0Njr6E93s0G-wqIUq4U0vRA1MI3K_20cT0YGV3ec0oY_Ok7JEbP84Jm0qqEsYkAMA9Md7op1cw9OjA7bxXqtSAFwdJ8NQNO81sDG6r8im3faFypWtzMz6IyAEyf4NPj1sBSum-NBPPAycI-2C3PU3WtK_XzuP6wzv1pRj64CJ_COGpvdXqgMmlz2b-w6EyuW8xNVaWvOFwckqd9q2xH-WyDO650WTKFp2qP6YGXgYMeKZaF6sjmxydsvgSLoj6OwRxoK3Ylz4hQ_h5JeVnpeN6AGB87aR7ykxZknktvJup0RRIHhNogPvDo9U1keg6cBE0EpMoy93oq0kf6tdtW3lLPpb1sVu44QGShBmlYb6BnA9LIiVH3JpSNrUxFcIhwY9WQU8rPdhPIU_Cxu-5F6Ou6B1pOnYsM-MbCriyjht5kP0oBw8q_JhMsux7nUatXm2fzrbndWscEFslB1vWE9_tyJqTrh8v72a-qb6TOZrdrpEL7pCj7Cyd17a4W0EXduyoUrhw59XlTmUyok3TIM5ug96ENUCvmva_eI18PsehMXVQ2cxhhzlA4SPVCAC2Gsvq-FTvgI9BIh0k1O3kO08V8xipdWIs2ZqOBaFaVXLZdUPudvSBY0TQjqz3fAFpYOm833_eFkg-PAdU1zjMvLYWwWvkB83EWyL3FbPdBLAzeTxZ8tMKQHRdhjZgadDzASlL9vjC8y8oiKKaNIefzcbaSrJeY2CmRnJSmlYe_E_bmg8cLqNfauGaNupMS-oTeyvL4NUVnYlOcyRrTkECX8JTBHxwoXyzDWn7aKDbMV_QEPH2F8QINKItZg1x3Pc7WXfD4vViOgzJHMYzYGbD8dSfXzJEpE2fjd2auZtn0qKfdfSyPHNDXWSip2iythiJzt7HgmI1SfEowV0k8I1Ytc4yIm5FcuCya_WpTzB59Kkg3abAja6lBNPZ6yXsvyxKvvQ5QDLxXhlYMxDNxGZt5ZE7z3H2ZFuHStqU8KYi4BxR_FlZyVxDwXMUiPkJiw6v7SKDHyHGINq6fcYSWaaMC-cekyXqc_OA1vuwOlH5_YkjJ3uwjt8lIMveomTXqI2pGErG6Im8TstVcJHO6xumlFDVwOLXnvOetLHBC2yPETHPBOT2cJrHwOmt_0sscZRWlGgAJ4BNoaybA0TxxC8DBmqRn8wmVFXsDWh94rR4_tyjKU6S30UGAhmlFnT7vuhDXPWgOvFVYShH70LxFi9SR0B1So7IyPm2he6Q9r2fx0hJkX2RzrA1H9Zjxxq9S_ZlHVn96g5YlTNe7cZe7cOBXwwOlMZFAmW6yAfh_tbPilxaVwh3H0ArlKJ4Rw1fwTwSg8HrL09d36UEZrtEgZRCrah-51H2RC2JX3CVz7VdTsTPeKnpAVR7fzedtFnUbtBs5utzTLRTl8-EBBEMs0KQy3KNslzB-8-jVpqK04NaDZ4OxSrgyd5xSzUYmp1Y8nbSfj4kBaMmHDlUJwojYH1Eqs5wBmvRk6Ljb35wAjnEQqrGTf0SH3wpPQ6cnDaoDMDvCQGUHCRlW6EMQaNCZOajjJ67UGKKEK2FL4nOvyhtEFCWnFeUbR-3C9XubqDmEMXpYs6ENxa1s-M2QACOPx80rgPgY3YV-yhrBmp8797uONGmLeB696LlQRqikY83oPReALl9V_CKjVkBTGNZPi7RRKCnnqc4ZFAtUpwgwjf8uInwdPOa4Yj6kPP1befZ23dbQICD6f2iyxDXR4i0mZGrPEBGpcmqo14X05VcIcijpswXfoccZsdG1ylK8AEzL_2_-TM4rgvjnzjeH4TxvY6fxaoOB7ARd3-aFX8nwn5bfbhPGt-lwCu-RHMUrwuCIU8hUXcStx3GNrdRK4NB3FFzNZ1SbI5RSE2pIw5Z_OKRE21LbVMPc2__EMmIs5V3m0hq2Y2oTk_AGP4RZeStNnxfWkX4k8-jR8pws2Q7c_N05T0KnM55KQ3TymuqbkFhdacY_cAaDm2g8N5xfHhmhrbsd5Kr3u7k2cnfSrTeisrtgo6F0smWj19XBMynIA9zaBqvTTuCe_cL44C7R3dwlqL9m761Td94grYghtaHbfCiP-rF0FJFTMFxZ5Zh8vLHHm4dsw-ji3PYTOTWbFHkjII8lRgutEuCAJJe2aXTtzlu8ctnnHjKcyXQSn33wHqdBkUOaIIlbFOPbVoaN2EbZDrkZr7rQ5Tg-vwU8E64Nu-tlKSr6w44k-04VTIGE4H7H0AHsgeCyZSM6nrGT6RqAtQvytObpqk0bhiaMdHU_vRhWRSZt_1jUIsgYh-wigCo1pxvyz6oLoujXToyabuTShIiqIa8RqmYESpzXnEbl6aDyfTbrtTK-7UNLrvMLYNByBXphaQxEao2BcMem2K2Nb-xS4VPxQmON73AOf3JPaP4pJKqWRt_fHTTU0JC_W-A8bVb6T3s&cid=CAQSPADICaaNGfsemmzsKHGwLMO3ozMCNNSbhi7i5F0r7qBonzmRt3pWv9cFkZqWo92QH1TldiFC6kVFea4OWxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.bulgarian-offers.com%2F&ds=l&xdt=1&iif=1&cor=12292698654596665000&adk=1877897943&idt=159&cac=0&dtd=33

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

16eace4c32f3712172b7fabaf438514a65ce9aa71f1c95f665d3201ea52aae5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12410
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0944
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFsthhP4wwhbaycp8SoKMLw&google_cver=1&google_push=AXcoOmRFTn6oujJpzGC7-xo7IW_J0tE4BwIZDQ0xg294PTvJzpYUJC-...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=7627bc1676621693&is_secure=true&networkId=14000&version=1&google_gid=CAESEFsthhP4wwhbaycp8SoKMLw&google_cver=1&google_push=AXcoOmRFTn6o...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAIL8WE07ugFAMx5rh0AAAAAAA&expiration=1696564919&google_cver=1&is_secure=true&google_gid=CAESEFsthhP4wwhbaycp8SoKM...

170 B
188 B

103ms
103ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAIL8WE07ugFAMx5rh0AAAAAAA&expiration=1696564919&google_cver=1&is_secure=true&google_gid=CAESEFsthhP4wwhbaycp8SoKMLw&google_push=AXcoOmRFTn6oujJpzGC7-xo7IW_J0tE4BwIZDQ0xg294PTvJzpYUJC-czsaIwkZC-0U2b1mBG7Z1S_qjJ8UjnyOmy5IPr5UGR4oCpHo

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAAIL8WE07ugFAMx5rh0AAAAAAA&expiration=1696564919&google_cver=1&is_secure=true&google_gid=CAESEFsthhP4wwhbaycp8SoKMLw&google_push=AXcoOmRFTn6oujJpzGC7-xo7IW_J0tE4BwIZDQ0xg294PTvJzpYUJC-czsaIwkZC-0U2b1mBG7Z1S_qjJ8UjnyOmy5IPr5UGR4oCpHo
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0944
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEG76JlmHunWuiUN3dXpf_0s&google_cver=1&google_push=AXcoOmQ41V2WSKs2Jnk1gz2xMRosYWA5NHYYlh6yA8akZXlxVC0nREgwdYTGeeWnXMkBXe3_FJ6c_db91In...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQ41V2WSKs2Jnk1gz2xMRosYWA5NHYYlh6yA8akZXlxVC0nREgwdYTGeeWnXMkBXe3_FJ6c_db91InH3RnaOUP61MDbSRuHsw&google_hm=WGbz_KdNTNed7tNM59...

170 B
188 B

87ms
86ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQ41V2WSKs2Jnk1gz2xMRosYWA5NHYYlh6yA8akZXlxVC0nREgwdYTGeeWnXMkBXe3_FJ6c_db91InH3RnaOUP61MDbSRuHsw&google_hm=WGbz_KdNTNed7tNM59i5xPs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQ41V2WSKs2Jnk1gz2xMRosYWA5NHYYlh6yA8akZXlxVC0nREgwdYTGeeWnXMkBXe3_FJ6c_db91InH3RnaOUP61MDbSRuHsw&google_hm=WGbz_KdNTNed7tNM59i5xPs
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0944
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEIcehUgcXt8vjaNga79aQig&google_cver=1&google_push=AXcoOmRorOoBON_EZX-jg7BqzuJTQ1Nl61T5f1vrAFwUfA2lvf2_vTL3CZE2gn22rKfhgXbQxX4RJPOluk6qVwgRBjxLz827tJoNXg
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QjM1OTJBOEQ1MjQ3REZGOA==

170 B
188 B

203ms
203ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QjM1OTJBOEQ1MjQ3REZGOA==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=QjM1OTJBOEQ1MjQ3REZGOA==
date: Thu, 05 Oct 2023 04:01:59 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0944
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEuVFeuNzLkrgSuqYR28c_Y&google_cver=1&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEEuVFeuNzLkrgSuqYR28c_Y&google_cver=1&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwK...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr6xoK1nMdyUw&google_hm=V8BADwexT5CU6QZ68bAq...

170 B
188 B

177ms
176ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr6xoK1nMdyUw&google_hm=V8BADwexT5CU6QZ68bAqxA==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr6xoK1nMdyUw&google_hm=V8BADwexT5CU6QZ68bAqxA==
date: Thu, 05 Oct 2023 04:01:59 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0944
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEKHixlrUnZHZOwx8jADz54E&google_cver=1&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjo...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEKHixlrUnZHZOwx8jADz54E&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjo...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjokz-U3sinJtV-jKweQ&google_hm=aGRrMkJldHJRU09yNl...

170 B
188 B

77ms
76ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjokz-U3sinJtV-jKweQ&google_hm=aGRrMkJldHJRU09yNlJRbFI0ZXU=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 04:01:59 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSfwrGi3W5O1rifxsjTFzoQ7-uMU3rvaBp8M1CNKtOCp9KF1wHcoBfhD3o8nlw8f7-QghK-p_xmj4gjokz-U3sinJtV-jKweQ&google_hm=aGRrMkJldHJRU09yNlJRbFI0ZXU=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 238
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0944
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEH1CPTq1j7MgDLpj3yCoTfA&google_cver=1&google_push=AXcoOmRvW1XJ-y-VGmtWFOlgCMBOkbSOetCFPfDuXCw1ejk6ivD5cPVCwbSFn9hYaROeNd9KOKhwV0vDUKPQ...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_4DGVKitcs-2L_wFrtLSOmo2zgsPfLw&google_push=AXcoOmRvW1XJ-y-VGmtWFOlgCMBOkbSOetCFPfDuXCw1ejk6ivD5cPVCwbSFn9hYaROeNd9KOKhwV0vDUK...

170 B
188 B

181ms
180ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_4DGVKitcs-2L_wFrtLSOmo2zgsPfLw&google_push=AXcoOmRvW1XJ-y-VGmtWFOlgCMBOkbSOetCFPfDuXCw1ejk6ivD5cPVCwbSFn9hYaROeNd9KOKhwV0vDUKPQxaiu9gCb-cr_bDXZxAQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_4DGVKitcs-2L_wFrtLSOmo2zgsPfLw&google_push=AXcoOmRvW1XJ-y-VGmtWFOlgCMBOkbSOetCFPfDuXCw1ejk6ivD5cPVCwbSFn9hYaROeNd9KOKhwV0vDUKPQxaiu9gCb-cr_bDXZxAQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET google
sync-dmp.aura-dsp.com/match/ Frame 0944 0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 0944 0
40 B 67ms
65ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JDUHm6Jy1mU_oNlWXZB9Q9qfqSIlL6-_CiQVbEnw-qLeSQVPlHSkv02kheyPZNgeGiR92cow

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 8709 33 KB
34 KB 590ms
52ms Font
font/woff2 172.217.16.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s65-in-f3.1e100.net

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 05:04:01 GMT
x-content-type-options: nosniff
age: 428278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 Sep 2024 05:04:01 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5ACF
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEGXaeTIumCXn89J33GINB3c&google_cver=1&google_push=AXcoOmS_K0Z8TRUdESxXLbEKld5IIM8FpbBzcy3psXQuDpjMTmbTFZXbJ75yhjINmWITSfIZ7U0mT...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmS_K0Z8TRUdESxXLbEKld5IIM8FpbBzcy3psXQuDpjMTmbTFZXbJ75yhjINmWITSfIZ7U0mT8K08bjFMcdjTMU1efa4uJuv2g

170 B
188 B

89ms
89ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmS_K0Z8TRUdESxXLbEKld5IIM8FpbBzcy3psXQuDpjMTmbTFZXbJ75yhjINmWITSfIZ7U0mT8K08bjFMcdjTMU1efa4uJuv2g

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 05 Oct 2023 04:01:59 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 39681348204341F48C5481E4F5A97869 Ref B: GVA30EDGE0108 Ref C: 2023-10-05T04:01:59Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmS_K0Z8TRUdESxXLbEKld5IIM8FpbBzcy3psXQuDpjMTmbTFZXbJ75yhjINmWITSfIZ7U0mT8K08bjFMcdjTMU1efa4uJuv2g
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYG8C+N2f1CjyTh0pk+3w==

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 5ACF 70 B
149 B 331ms
167ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAXJKzv1o0k4ND9Fd5zDF-8&google_cver=1&google_push=AXcoOmQ3w0gUKHp2dIQh2MnR1SV9qQ4ao1mb4DZL_8WrCiTjKjXwxVNtMvhfsjOu32nWvRNGy-ndrsEKV7gb8VouKpgi7_q6eweE
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:59 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5ACF
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEIcehUgcXt8vjaNga79aQig&google_cver=1&google_push=AXcoOmT6H-MJ4ocuk2iUioegyxQxwKOX6uBCz_56eJ226mobtTo1LL_JGConqUEap30CP-lblDKHw96RZeZDMP5sR1agxwaaKPDH0g
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MUMwMDYzMDVFMEZFMjQ1MQ==

170 B
188 B

221ms
220ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MUMwMDYzMDVFMEZFMjQ1MQ==

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MUMwMDYzMDVFMEZFMjQ1MQ==
date: Thu, 05 Oct 2023 04:01:59 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5ACF
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEEBfh-WPPnfypaYqvA_5-A8&google_cver=1&google_push=AXcoOmT5MXDTGm4JjhOIwXAOGQz_eAlPRmfbnB8fxCL_BTumDlxmtamWeGlkyHeOXnXHeHa1RoGm6sBWHOQblO-c...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmT5MXDTGm4JjhOIwXAOGQz_eAlPRmfbnB8fxCL_BTumDlxmtamWeGlkyHeOXnXHeHa1RoGm6sBWHOQblO-c-nU8BB2ENExRcw

170 B
188 B

207ms
207ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmT5MXDTGm4JjhOIwXAOGQz_eAlPRmfbnB8fxCL_BTumDlxmtamWeGlkyHeOXnXHeHa1RoGm6sBWHOQblO-c-nU8BB2ENExRcw

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 05 Oct 2023 04:01:59 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmT5MXDTGm4JjhOIwXAOGQz_eAlPRmfbnB8fxCL_BTumDlxmtamWeGlkyHeOXnXHeHa1RoGm6sBWHOQblO-c-nU8BB2ENExRcw
x-host: tde-deliveryengine-production-8b9d7bc7f-zrjqw
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5ACF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENLxj5m0VT51cay69a6cWO8&google_cver=1&google_push=AXcoOmQgJO2ss6Uiu_4dqEZFUQpQyapdFLEQd6bl_aGwGkty8lAvcRs6YEwKGzXvijFGF22GOQrc0a0Lgm6XQzd20Td8g7M...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQgJO2ss6Uiu_4dqEZFUQpQyapdFLEQd6bl_aGwGkty8lAvcRs6YEwKGzXvijFGF22GOQrc0a0Lgm6XQzd20Td8g7MJrZW7Vg&google_hm=eS1EcEpBdy5aRTJwR1pl...

170 B
188 B

196ms
195ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQgJO2ss6Uiu_4dqEZFUQpQyapdFLEQd6bl_aGwGkty8lAvcRs6YEwKGzXvijFGF22GOQrc0a0Lgm6XQzd20Td8g7MJrZW7Vg&google_hm=eS1EcEpBdy5aRTJwR1plSmhiUDBfZjBFdW5aeWhuaUFQNH5B

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 05 Oct 2023 04:01:59 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQgJO2ss6Uiu_4dqEZFUQpQyapdFLEQd6bl_aGwGkty8lAvcRs6YEwKGzXvijFGF22GOQrc0a0Lgm6XQzd20Td8g7MJrZW7Vg&google_hm=eS1EcEpBdy5aRTJwR1plSmhiUDBfZjBFdW5aeWhuaUFQNH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5ACF
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEGG_iOuDq6a7N91YahjQSJg&google_cver=1&google_push=AXcoOmR-Dlxb29kzW7yNnOd5hmX7p5sjJFyvL9a2wvp31w103V_TNKbA5iARnstA2HfcetFEdbavfdyHB62_1igG-QgUr5n...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmR-Dlxb29kzW7yNnOd5hmX7p5sjJFyvL9a2wvp31w103V_TNKbA5iARnstA2HfcetFEdbavfdyHB62_1igG-QgUr5niO-PgYA

170 B
188 B

223ms
223ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmR-Dlxb29kzW7yNnOd5hmX7p5sjJFyvL9a2wvp31w103V_TNKbA5iARnstA2HfcetFEdbavfdyHB62_1igG-QgUr5niO-PgYA

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmR-Dlxb29kzW7yNnOd5hmX7p5sjJFyvL9a2wvp31w103V_TNKbA5iARnstA2HfcetFEdbavfdyHB62_1igG-QgUr5niO-PgYA
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5ACF
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEG1l80jjXHc6qsk8BU6mJs0&google_cver=1&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8AwamNzcc...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEG1l80jjXHc6qsk8BU6mJs0&google_cver=1&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8Awa...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODM5MTYxMTAwODk5NjEzMjY4Mg&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8AwamNz...

170 B
188 B

79ms
79ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODM5MTYxMTAwODk5NjEzMjY4Mg&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8AwamNzcc4oY63rhzzEEO_x4MWSpsZg

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODM5MTYxMTAwODk5NjEzMjY4Mg&google_push=AXcoOmRCMuBEYiXW59rmpyxoPoVRM59JO97b_GziKZLJgbQstyEdk-qrvYHEekpGM2ACkTa8AwamNzcc4oY63rhzzEEO_x4MWSpsZg
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5ACF 0
12 B 70ms
63ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lxn0U6-FLh9c6KGGwHPeCpqrGHCG0c8Wo8H08__9yJFBSLm9sDbJI73bOGjNH8ftrfHpV1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:01:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 26ED 41 KB
14 KB 66ms
52ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bz77m5lKPa3oeWCDL2FaQQDesSj4dllxi2i8rw6pfAbPG7358isPRsyjg7Lg_n6UgLH9F7uDrn-6tGjggN7p-75VllKNkGQQSsgYCr9luBbObwLxe7J-4fVHr8yw-0m0OyTUeJQsEbatUXs35XBaHkRhxZwhsN2q0HJNRj4pE3MC7NDMM&cry=1&dbm_d=AKAmf-DsaYO0ORL0eixQicB2vVFugVz-fd7oizhp2Wlu-J9vKwWr5NUUmcP87s4T9-QIjkGPgnZa72w5feo35FiujBfFtYHo3i_U8KqisPxta6nwMGFq8Z3APNTd4FLoKzDygI3KywpG-X4g33iFWTuG_u7yqbik3CGxKv9LwHiw6HrPikWwcv8E0KrS7-avnRmB0r_Q1ivHoepNhjNcuEKctKD0TNUYrh2PstBdlNS1p5e7V17gEHROjuU4WM-j3L6pjzWecLWy0IhZj53-1t6A21EEpZM_zOMW21ONoIQ_sSj20Q891dCPHZBPeeDg-fBbsQp3tDYsmupeNJpnTUF907EKD8ura1_V3Vz18WHq9A4QdsgEue3rXp99dUZpmaVfTternEMoKMDg-309gRtuWIbrDjgVYYnfI6aR8RZ8T1BVy492VVc9fkTFJoHb_AEG6KeRDN9I9j7mv167iO1ZtnJ1Y8MBXlEi6Vm239cllVrYgMZrw2KQunRxzmY0G1-hMRhxmUobcW8LiMCdCaFEqQMgY7ZRhd_G_So84QQWGqPVGVf0rHp3lYCOghm4LMFe7PlK1QSXwZgTib2W-HT__k1DF2h31QeoAas1_zz5KhXCcOh9G3YHQgp8LZa0x2U9PWgNJUSNiPOy_m_QHSaC-8PrIcIw_Wcaw1aQUspbUvtciRdPpOy4x68NmaFb2kvZ8DsWC7CZ6V2U3_Yn9LIT34cEoN0BOpgVlAFI7gP2xRjU2c4F-0Njr6E93s0G-wqIUq4U0vRA1MI3K_20cT0YGV3ec0oY_Ok7JEbP84Jm0qqEsYkAMA9Md7op1cw9OjA7bxXqtSAFwdJ8NQNO81sDG6r8im3faFypWtzMz6IyAEyf4NPj1sBSum-NBPPAycI-2C3PU3WtK_XzuP6wzv1pRj64CJ_COGpvdXqgMmlz2b-w6EyuW8xNVaWvOFwckqd9q2xH-WyDO650WTKFp2qP6YGXgYMeKZaF6sjmxydsvgSLoj6OwRxoK3Ylz4hQ_h5JeVnpeN6AGB87aR7ykxZknktvJup0RRIHhNogPvDo9U1keg6cBE0EpMoy93oq0kf6tdtW3lLPpb1sVu44QGShBmlYb6BnA9LIiVH3JpSNrUxFcIhwY9WQU8rPdhPIU_Cxu-5F6Ou6B1pOnYsM-MbCriyjht5kP0oBw8q_JhMsux7nUatXm2fzrbndWscEFslB1vWE9_tyJqTrh8v72a-qb6TOZrdrpEL7pCj7Cyd17a4W0EXduyoUrhw59XlTmUyok3TIM5ug96ENUCvmva_eI18PsehMXVQ2cxhhzlA4SPVCAC2Gsvq-FTvgI9BIh0k1O3kO08V8xipdWIs2ZqOBaFaVXLZdUPudvSBY0TQjqz3fAFpYOm833_eFkg-PAdU1zjMvLYWwWvkB83EWyL3FbPdBLAzeTxZ8tMKQHRdhjZgadDzASlL9vjC8y8oiKKaNIefzcbaSrJeY2CmRnJSmlYe_E_bmg8cLqNfauGaNupMS-oTeyvL4NUVnYlOcyRrTkECX8JTBHxwoXyzDWn7aKDbMV_QEPH2F8QINKItZg1x3Pc7WXfD4vViOgzJHMYzYGbD8dSfXzJEpE2fjd2auZtn0qKfdfSyPHNDXWSip2iythiJzt7HgmI1SfEowV0k8I1Ytc4yIm5FcuCya_WpTzB59Kkg3abAja6lBNPZ6yXsvyxKvvQ5QDLxXhlYMxDNxGZt5ZE7z3H2ZFuHStqU8KYi4BxR_FlZyVxDwXMUiPkJiw6v7SKDHyHGINq6fcYSWaaMC-cekyXqc_OA1vuwOlH5_YkjJ3uwjt8lIMveomTXqI2pGErG6Im8TstVcJHO6xumlFDVwOLXnvOetLHBC2yPETHPBOT2cJrHwOmt_0sscZRWlGgAJ4BNoaybA0TxxC8DBmqRn8wmVFXsDWh94rR4_tyjKU6S30UGAhmlFnT7vuhDXPWgOvFVYShH70LxFi9SR0B1So7IyPm2he6Q9r2fx0hJkX2RzrA1H9Zjxxq9S_ZlHVn96g5YlTNe7cZe7cOBXwwOlMZFAmW6yAfh_tbPilxaVwh3H0ArlKJ4Rw1fwTwSg8HrL09d36UEZrtEgZRCrah-51H2RC2JX3CVz7VdTsTPeKnpAVR7fzedtFnUbtBs5utzTLRTl8-EBBEMs0KQy3KNslzB-8-jVpqK04NaDZ4OxSrgyd5xSzUYmp1Y8nbSfj4kBaMmHDlUJwojYH1Eqs5wBmvRk6Ljb35wAjnEQqrGTf0SH3wpPQ6cnDaoDMDvCQGUHCRlW6EMQaNCZOajjJ67UGKKEK2FL4nOvyhtEFCWnFeUbR-3C9XubqDmEMXpYs6ENxa1s-M2QACOPx80rgPgY3YV-yhrBmp8797uONGmLeB696LlQRqikY83oPReALl9V_CKjVkBTGNZPi7RRKCnnqc4ZFAtUpwgwjf8uInwdPOa4Yj6kPP1befZ23dbQICD6f2iyxDXR4i0mZGrPEBGpcmqo14X05VcIcijpswXfoccZsdG1ylK8AEzL_2_-TM4rgvjnzjeH4TxvY6fxaoOB7ARd3-aFX8nwn5bfbhPGt-lwCu-RHMUrwuCIU8hUXcStx3GNrdRK4NB3FFzNZ1SbI5RSE2pIw5Z_OKRE21LbVMPc2__EMmIs5V3m0hq2Y2oTk_AGP4RZeStNnxfWkX4k8-jR8pws2Q7c_N05T0KnM55KQ3TymuqbkFhdacY_cAaDm2g8N5xfHhmhrbsd5Kr3u7k2cnfSrTeisrtgo6F0smWj19XBMynIA9zaBqvTTuCe_cL44C7R3dwlqL9m761Td94grYghtaHbfCiP-rF0FJFTMFxZ5Zh8vLHHm4dsw-ji3PYTOTWbFHkjII8lRgutEuCAJJe2aXTtzlu8ctnnHjKcyXQSn33wHqdBkUOaIIlbFOPbVoaN2EbZDrkZr7rQ5Tg-vwU8E64Nu-tlKSr6w44k-04VTIGE4H7H0AHsgeCyZSM6nrGT6RqAtQvytObpqk0bhiaMdHU_vRhWRSZt_1jUIsgYh-wigCo1pxvyz6oLoujXToyabuTShIiqIa8RqmYESpzXnEbl6aDyfTbrtTK-7UNLrvMLYNByBXphaQxEao2BcMem2K2Nb-xS4VPxQmON73AOf3JPaP4pJKqWRt_fHTTU0JC_W-A8bVb6T3s&cid=CAQSPADICaaNGfsemmzsKHGwLMO3ozMCNNSbhi7i5F0r7qBonzmRt3pWv9cFkZqWo92QH1TldiFC6kVFea4OWxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.bulgarian-offers.com%2F&ds=l&xdt=1&iif=1&cor=12292698654596665000&adk=1877897943&idt=159&cac=0&dtd=33

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 28 Sep 2023 12:26:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 574531
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 Sep 2024 12:26:28 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 26ED
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1525570/72171777/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9Nom...

52 KB
21 KB

176ms
160ms

Script
text/javascript

66.102.1.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9NomzpKb8-pxV3KVd33bj7UUOIZXjDnqW7C_H46z1om_ezoyuGUei9UtPnQUyirsrS9p50mo3lwYwCaX48Nz1T4wLt1oycIGcOPvbkSuRUAoCZ_4ISz9SW-B26Af2386KgTqTD9wOxj3H52U9gYhecNn9HTeKnqgoAk6HlLP3eu958-2oOfnqwpUACIjaYq9JMfS_NQhpYOlfgJKwvRFU9Qghp0arwuof-Wj0tWPscFBM6MEHz74RyiYYlVqPH2FNyPcXYq_YWqc48CP1mt23YZWuV6V93ZwpOytd2LI559AD735GIky0PQonS4fo5eEVyQstCMtHgMfifB8k55w1xTMe1XXN3YwBOHcqQNs6ii1S_j1MIBIL7BFy3lpPjg_sQbxEBfqxB7sBsBJsl23JU2Lua9-BQsxLo9oyi0AIZaWA4LGOH-P8f3-zmU-XJVTZckb9FN2DJhX0GVEHUrgiey2y_FhKBakDM0fIZfXJSkO2NCB8UhGlNDFsaZrupzNzJxeRDLAaAYJ-T4sAA_oqxQ9ERwkLCpG9mt762byaLdRPhcYL24BkXQqb1yzIti_P4mc58MoLB379Bo9pnIiaI0peaALTee5jDSjeq9NqzFrgVx8aOSnuIsb--5ftqfLjvEjOczbDq70lKr0izmdBcSARiySbNHyBaas_MZ_SDDIFOn7mJnGIp-HXikMBBICUcX-qWamcRIylqYreu4ttWDy5wwMU9y_QLeRLmCNn3J1uaBACEmo4dE5ufFcOkbLPfGN66WTTEEbzR70PtoR9-Nv8Vml7aPfkt0T3yuxhDY6Aj0-z_enWckYgZuvlHgiO6KAPcg5qnWs1eIepl-PcZG486qLTBAhroH4QIz9vE2fiq3EQ5wmfoSsRk2h6KqdwYM399W4T1iRfFZ3ndMHlZVEOyE9KyvrqOdRIdS7yV7d8Bl1tMW49jDpIP0B3Evb31Dw9b3SzgcezHXLYTQ4_gV-BqzyIXXAZ0kTUb2nz66nKo7_3tUI--xKNhAhk9W3OzfONpauI9vmTVpAPYFrYfyC6P4Db2CmUTeqh03HPYFHzQgPBgJJSpqBrbBjoPq0J4hlmNTFjTzwUuPMi0xgZxxcOCL1-DBcHkGk7Phi3pORI6CNLHhijNsAlHgkkOzHCxei53HSW1S2PWztm7uyDDyZC6PZvLw-D_Wmk49gjCcukkSwgJHQL42ygaMfQLOMjy_WRkbpsOYojd62OaBSAiZbd9OBF4clQqRxzpDtpRovqU_5gA3gH72V3Ns23JAodiQoDnw1vQiZU0GMrMy4Vyz4rEiUogw9B8S78dkjvSwviha3lq8pmk5TtSzhtFq-0sXta8vzVs0JX83Lv_KXIrkGoGViJ6xN9cxmDsJuknIrw4bq4QxVGjfFGMJk6WuQ2JjI9a8pXW_TVzLwEEjA7q0kVx4lBV2kMSVg9OgMnW6vwKw8THbMUS6G61g-CpkG1xe5mlecrv-9TTW9dJQupGM179KzhEMa5SUDhHL5kpgx_c3eQQGHJ9rJQzg6TOauwAAkKwCanLJdQL-LejMNU2pqNc_rf6ucOMlnhH-tw3fE7lQsHo52J49oOiRjUAogc4qqcgTrJGNaGvdhJjoVKKjIkjyY-YEfdHlHo9OYQCQXvqkoHVcavP8cn-rqpsgFqumZys_c_1s9i8Kci7X39kG011gmO-3WKPIti3atphOckoIov3Y_R2p5zUE4utHvu_Q32WDlRWl4XG31Ep5rjzQsiMKFNbluMWMy_qZnh33exNDYtrYbitVR8SasB6-loUzr_f7UIhKr3LGrKb7tiCXJHmXcPcVfuHqy6GLS0FFjxCEd_C9fwfJqRyXgW6t3nn0BOkd010Vwq67st-jADUxOoF_J_w_5vcxaHmhqyVueMP6QhCTiZi7SMW-l-XS8ZgzsfCnd_j41GwSVtp7vOQz8G3ajE7LGWD11pG-y9G-tafeXP7YLjRabgoaMb_WWcrrjG4UBcog4elSNbGKnBMe2h07dAe3RsLR2srR1BAr5ixw0UUz73_1JNoUBEqmJWj9B9RPYhVQX-0v7V0tPLmVQPNIx-7VX7BVp4Q4KciYs8wqsqeCFc2gQxZWiPbMn8t5bPzcCXOfBvr1t8LFqGxEY1EHAYAXuBGDAsnPeHfPE1vjUqRaG8a6stikxSKeiK1d8_sIAOcMb42b2ykHOEBfpuxFFQQH7aevdmAsJ2l-DTdxyAluede9rKpivYzP_kWk9-79pL6bxC-xxtkxF9oBZDca6QpBN7xqrVSvTBZAelxv1BXDV5o4_597ZQPIIvQWkLeZQOxWB2xIAg23YqldEhRfR55aimuo8ElEeZE8xXaxMvmE9kJlKwnG13HmxJG9f9gsmQxsGV9GJ80G-zmDYOtoKEH3VJXPI5jqod2TP_jC6Im-GpfAWRpCcL7JQStjKqFlB59HOzKfxAQOhOjTloy9BzsGJMqm1mBIwlvO3TRXl8vcVRiapmjnX-O2yNc4ZR5DdgJP51yl1-lTPgj3vBtLIwBbFaPXFop4-3yOvsKouNiO19-YJOsPpmTGzCqAXuY3q2P8NXtzFo6UEDSpGVsJIEw0Zhq_Zxe9TtefeDqdI7wf15lX5facTk7opIQkbDdpxwlmXfpWZq3ak-EuD4nvbcMUQAqKg2HhAqOw_E_Z-NeZXPr1sv3sdgnITFcZBZvBwzMkepTZHcMHvVhDlMo9jPWobqIPPSxdtXOXNNDLIs82FxsdwkUXl04Mz68Ge8XioVOSPHfWYgiQANXVD-d2K4gTgrrZt-Rno1UYvz0osOiN7Difr4yXkUDjcdnH8PP-_-gsTmgqzfNmqGcgNgdVrgwt9oLJZk8aF9uTMbJ527IZw_PP0sGLuoLv9sNI2B4zoTH-ST7xWzLrQXZOiP4FDW7RHac6gIhrgFMNrX9x7EnLAArFjuDk7vxgktfkjs86KrapwUjfGjg2FT4In4Lgh69QWGgPu_lcaNrtVcz5OaOK3tSx4pUo5pn92ioU-9f-SFmuVqxZWvSxmGPX2Oyj5y0wtShY5POEwk22cBDSgPZ5Ej2quGvhbrf3HXPJ5jv6tKR587S10PktTNp5gnONyaiceNh-_KW6TZNwI7MIKv1C7Mvhmf8_EZn7frAabikk4BCg95T50uvlkFrA5OJGzWQu90syWkNAkBbgnNo5fcUiNgjYk6nHFHkTFxC2rZs1L6E7bEAgM5G7CJCHpzNMOqRTAhON4GKOQCSFYTHIrLLG2LLxuk9oKNfZOI9uSWMt9sQCXoJsRpZBPoW1I2LboryhrV4_pHWrt9l6zxoYniSbmlYUW7w47i9p59DpCPaiEBo0h9YbDyTyAFyRTdiGRWeULi_jCeobPdwl48KI8UcyYxtYkt3CT6100Y35h1gdD_jdJoDM2lebJDc_J49dCoyk8WXTHELkofg0pqkd18PoHv_YC2HzoHEP-_HM3tjBVfrrphuaBxYbS8XeYra-ND3UggBHd_ThcnkPsNdhdZBzW6J2N_tipqWXT2IDqESuTvMjBbBfavUNW9dp3gpa8J2mVg4dMI5zi9gV9KwwG6R16Zg2DrXK4bqDDUeGuQSzZTyQIGBs4DKjdzawDz2bHb2EB_mCJrVeTnii_JBpwqnUDj10fMngPYsgkNSsKpPwVpaX2MoaI9e6gixzSXkGxYDy4AcVpQbu2Cn9OnVIvWsMh5wog18UxCYeOOUqlqQRqCZXU7sc0Oz0DWKni13QKENSEy_K9RJNWaxTpbjDCUhguk0aQggEEjwAyAmmjRn7Hpps7ChxsCzDt6MzAjTUm4Yu4uRdK-6gaJ85kbd6Vr_XBZGalqPdkB9U5XYhQupFRXmuDlsYAWAB&cry=1&bundleId=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

66.102.1.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wb-in-f155.1e100.net

Software

cafe /

Resource Hash

87b93bad3a5a7a5618df9b890984c7325c8e3c65551708e152fa5f5b8c93518a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21171
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
server: nginx
x-server-name: app05.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9NomzpKb8-pxV3KVd33bj7UUOIZXjDnqW7C_H46z1om_ezoyuGUei9UtPnQUyirsrS9p50mo3lwYwCaX48Nz1T4wLt1oycIGcOPvbkSuRUAoCZ_4ISz9SW-B26Af2386KgTqTD9wOxj3H52U9gYhecNn9HTeKnqgoAk6HlLP3eu958-2oOfnqwpUACIjaYq9JMfS_NQhpYOlfgJKwvRFU9Qghp0arwuof-Wj0tWPscFBM6MEHz74RyiYYlVqPH2FNyPcXYq_YWqc48CP1mt23YZWuV6V93ZwpOytd2LI559AD735GIky0PQonS4fo5eEVyQstCMtHgMfifB8k55w1xTMe1XXN3YwBOHcqQNs6ii1S_j1MIBIL7BFy3lpPjg_sQbxEBfqxB7sBsBJsl23JU2Lua9-BQsxLo9oyi0AIZaWA4LGOH-P8f3-zmU-XJVTZckb9FN2DJhX0GVEHUrgiey2y_FhKBakDM0fIZfXJSkO2NCB8UhGlNDFsaZrupzNzJxeRDLAaAYJ-T4sAA_oqxQ9ERwkLCpG9mt762byaLdRPhcYL24BkXQqb1yzIti_P4mc58MoLB379Bo9pnIiaI0peaALTee5jDSjeq9NqzFrgVx8aOSnuIsb--5ftqfLjvEjOczbDq70lKr0izmdBcSARiySbNHyBaas_MZ_SDDIFOn7mJnGIp-HXikMBBICUcX-qWamcRIylqYreu4ttWDy5wwMU9y_QLeRLmCNn3J1uaBACEmo4dE5ufFcOkbLPfGN66WTTEEbzR70PtoR9-Nv8Vml7aPfkt0T3yuxhDY6Aj0-z_enWckYgZuvlHgiO6KAPcg5qnWs1eIepl-PcZG486qLTBAhroH4QIz9vE2fiq3EQ5wmfoSsRk2h6KqdwYM399W4T1iRfFZ3ndMHlZVEOyE9KyvrqOdRIdS7yV7d8Bl1tMW49jDpIP0B3Evb31Dw9b3SzgcezHXLYTQ4_gV-BqzyIXXAZ0kTUb2nz66nKo7_3tUI--xKNhAhk9W3OzfONpauI9vmTVpAPYFrYfyC6P4Db2CmUTeqh03HPYFHzQgPBgJJSpqBrbBjoPq0J4hlmNTFjTzwUuPMi0xgZxxcOCL1-DBcHkGk7Phi3pORI6CNLHhijNsAlHgkkOzHCxei53HSW1S2PWztm7uyDDyZC6PZvLw-D_Wmk49gjCcukkSwgJHQL42ygaMfQLOMjy_WRkbpsOYojd62OaBSAiZbd9OBF4clQqRxzpDtpRovqU_5gA3gH72V3Ns23JAodiQoDnw1vQiZU0GMrMy4Vyz4rEiUogw9B8S78dkjvSwviha3lq8pmk5TtSzhtFq-0sXta8vzVs0JX83Lv_KXIrkGoGViJ6xN9cxmDsJuknIrw4bq4QxVGjfFGMJk6WuQ2JjI9a8pXW_TVzLwEEjA7q0kVx4lBV2kMSVg9OgMnW6vwKw8THbMUS6G61g-CpkG1xe5mlecrv-9TTW9dJQupGM179KzhEMa5SUDhHL5kpgx_c3eQQGHJ9rJQzg6TOauwAAkKwCanLJdQL-LejMNU2pqNc_rf6ucOMlnhH-tw3fE7lQsHo52J49oOiRjUAogc4qqcgTrJGNaGvdhJjoVKKjIkjyY-YEfdHlHo9OYQCQXvqkoHVcavP8cn-rqpsgFqumZys_c_1s9i8Kci7X39kG011gmO-3WKPIti3atphOckoIov3Y_R2p5zUE4utHvu_Q32WDlRWl4XG31Ep5rjzQsiMKFNbluMWMy_qZnh33exNDYtrYbitVR8SasB6-loUzr_f7UIhKr3LGrKb7tiCXJHmXcPcVfuHqy6GLS0FFjxCEd_C9fwfJqRyXgW6t3nn0BOkd010Vwq67st-jADUxOoF_J_w_5vcxaHmhqyVueMP6QhCTiZi7SMW-l-XS8ZgzsfCnd_j41GwSVtp7vOQz8G3ajE7LGWD11pG-y9G-tafeXP7YLjRabgoaMb_WWcrrjG4UBcog4elSNbGKnBMe2h07dAe3RsLR2srR1BAr5ixw0UUz73_1JNoUBEqmJWj9B9RPYhVQX-0v7V0tPLmVQPNIx-7VX7BVp4Q4KciYs8wqsqeCFc2gQxZWiPbMn8t5bPzcCXOfBvr1t8LFqGxEY1EHAYAXuBGDAsnPeHfPE1vjUqRaG8a6stikxSKeiK1d8_sIAOcMb42b2ykHOEBfpuxFFQQH7aevdmAsJ2l-DTdxyAluede9rKpivYzP_kWk9-79pL6bxC-xxtkxF9oBZDca6QpBN7xqrVSvTBZAelxv1BXDV5o4_597ZQPIIvQWkLeZQOxWB2xIAg23YqldEhRfR55aimuo8ElEeZE8xXaxMvmE9kJlKwnG13HmxJG9f9gsmQxsGV9GJ80G-zmDYOtoKEH3VJXPI5jqod2TP_jC6Im-GpfAWRpCcL7JQStjKqFlB59HOzKfxAQOhOjTloy9BzsGJMqm1mBIwlvO3TRXl8vcVRiapmjnX-O2yNc4ZR5DdgJP51yl1-lTPgj3vBtLIwBbFaPXFop4-3yOvsKouNiO19-YJOsPpmTGzCqAXuY3q2P8NXtzFo6UEDSpGVsJIEw0Zhq_Zxe9TtefeDqdI7wf15lX5facTk7opIQkbDdpxwlmXfpWZq3ak-EuD4nvbcMUQAqKg2HhAqOw_E_Z-NeZXPr1sv3sdgnITFcZBZvBwzMkepTZHcMHvVhDlMo9jPWobqIPPSxdtXOXNNDLIs82FxsdwkUXl04Mz68Ge8XioVOSPHfWYgiQANXVD-d2K4gTgrrZt-Rno1UYvz0osOiN7Difr4yXkUDjcdnH8PP-_-gsTmgqzfNmqGcgNgdVrgwt9oLJZk8aF9uTMbJ527IZw_PP0sGLuoLv9sNI2B4zoTH-ST7xWzLrQXZOiP4FDW7RHac6gIhrgFMNrX9x7EnLAArFjuDk7vxgktfkjs86KrapwUjfGjg2FT4In4Lgh69QWGgPu_lcaNrtVcz5OaOK3tSx4pUo5pn92ioU-9f-SFmuVqxZWvSxmGPX2Oyj5y0wtShY5POEwk22cBDSgPZ5Ej2quGvhbrf3HXPJ5jv6tKR587S10PktTNp5gnONyaiceNh-_KW6TZNwI7MIKv1C7Mvhmf8_EZn7frAabikk4BCg95T50uvlkFrA5OJGzWQu90syWkNAkBbgnNo5fcUiNgjYk6nHFHkTFxC2rZs1L6E7bEAgM5G7CJCHpzNMOqRTAhON4GKOQCSFYTHIrLLG2LLxuk9oKNfZOI9uSWMt9sQCXoJsRpZBPoW1I2LboryhrV4_pHWrt9l6zxoYniSbmlYUW7w47i9p59DpCPaiEBo0h9YbDyTyAFyRTdiGRWeULi_jCeobPdwl48KI8UcyYxtYkt3CT6100Y35h1gdD_jdJoDM2lebJDc_J49dCoyk8WXTHELkofg0pqkd18PoHv_YC2HzoHEP-_HM3tjBVfrrphuaBxYbS8XeYra-ND3UggBHd_ThcnkPsNdhdZBzW6J2N_tipqWXT2IDqESuTvMjBbBfavUNW9dp3gpa8J2mVg4dMI5zi9gV9KwwG6R16Zg2DrXK4bqDDUeGuQSzZTyQIGBs4DKjdzawDz2bHb2EB_mCJrVeTnii_JBpwqnUDj10fMngPYsgkNSsKpPwVpaX2MoaI9e6gixzSXkGxYDy4AcVpQbu2Cn9OnVIvWsMh5wog18UxCYeOOUqlqQRqCZXU7sc0Oz0DWKni13QKENSEy_K9RJNWaxTpbjDCUhguk0aQggEEjwAyAmmjRn7Hpps7ChxsCzDt6MzAjTUm4Yu4uRdK-6gaJ85kbd6Vr_XBZGalqPdkB9U5XYhQupFRXmuDlsYAWAB&cry=1&bundleId=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame ADC5 91 KB
23 KB 585ms
69ms Script
application/javascript 13.225.78.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jun 2023 21:19:49 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 21a3da42c823b5a4a2d9c4c63248bbd6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
age: 10219332
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: G5ngXqDHD_xmt2adCY1e0Ewxhwtt7FpV6mvvzJQQIZ5FJ8unmucKkw==

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame FAA4 2 KB
1 KB 535ms
78ms Image
image/svg+xml 178.250.7.2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZR41NQAObK0CO8cKAAn-Im70e1srW3gRrqbswQ&u=%7CE26oTIDD3s1A89%2Bi5P2xTq4IZz41DqiRnjAHTGye8EY%3D%7C&c1=wLMhjbQtwRerfuYQvtYvucUfx71c_57oVqw7Cvg7ORav6XsKrfZypXol0x0js6wX_heo-ey2iI3mrfMJZp16BwxC42jh3zDaNs5xDjhXMlFmo-psryGrpQHthYXIaBY86XTRPnjcv6huaxpMEpiZBKGp6nw1ecDvFFnLe6WCeyu0VG1EVH_LtvSGChkOYIhCmUJuEIogSacmtPL5yLcBp-v4y5Td5Mx1dYAKXHok4RLKyXMlDGqb79HIuobkdvJLzoT6m6kUjykp13JALXKl-XLmYAMF5IWU_KcqR7prBGaaIartqTD8k9fSnQ9Uzi1aXeoZE5wbqr4ED_fBXNh6QHDDZ-hBav3RW6JT37ux5RG1ZMuqlw0DpUbvboYikjJVYP5UnGpxtxTZKTRNlvlLTvRZVTPXSw_8IC_KyoBa46EeKvObSbD7QpuGEiX4U6vZNyIN3N4OXQoIXkZMDwfnDxQOwl7BcR3iowGa9lRuRjxrej9cTqk1v4L23U4v6jjGU_M9uMpbexFeQ_ce7Z1oHMTR8eLzwDrAGoe22JGbmB06kI7G11TOF-BEM6lR4hN2I3gM9P2WH5yAmV29qUh_b0Al7y84D7Ahk7AEyZQva1RDH4KkT571tjI0yLQZBk_uv6pG9Dgcvpo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIAkENTUeZa3ZOYqO78EPovynyALJntKxXNWdkfdwwI23ARABIABg9dXGgcwEggEXY2EtcHViLTI0OTg3NzExNzM5OTg1NDfIAQmpAhPU3jE7oLE-qAMByAMCqgTtAU_QYfTweckmXvaNdKrt79ZBI9gUFp0WHLpkH6l7BLX4F8exO0JWpCo9tf4nQZkw4OM4qAo2hVJFH-qWu1P1IOBRVgUmezPhOxZAxSc-KdgHATXh1f1zPrEYp5ossNCdx0QFXYrY_4WVrzZg4skiVdlLBaJNwrdAVj7c7yX36adZH5X1Pjsb5kA2zlhcRhmzW0dGn-pcw8slpjNjGJRZ1l9erH0Fp7w7CQf4EDx1EHcM7hK7mqb7qqmQ4XWztugvBDEdh97PdagtWRgtb35hyjMJ0UIVNkWdWwrUsVso5clrO4kBTy3ujza7wdnjcoAGy9-_-5fMovUXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEgiAYRABMgKKAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2DOswumL5oPAzOHuZm25FCoynQHw%26client%3Dca-pub-2498771173998547%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 29 Sep 2024 04:02:00 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame FAA4 2 KB
1 KB 530ms
75ms Image
image/svg+xml 178.250.7.2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 29 Sep 2024 04:02:00 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame FAA4 308 B
636 B 419ms
77ms Image
image/svg+xml 178.250.7.2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 29 Sep 2024 04:02:00 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame FAA4 293 B
622 B 415ms
73ms Image
image/svg+xml 178.250.7.2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 29 Sep 2024 04:02:00 GMT

GET
H2 200 lg.php
cat.fr3.eu.criteo.com/delivery/ Frame FAA4 43 B
348 B 305ms
52ms Image
image/gif 178.250.7.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=isvXpeOe-E065L8WPNwP9g93x5bqoqc6t4ouVysCaHvJSe4uXdZWd_5X7GBrHhwcc-LVBkNqC-wfesWFDICQxgqAXlY9JH3ap7Ro7xlF0jynonGCnFwldvigadPtwC448R0_040-IM5oK06sD3slUFSlfIelThv9jXZJXolKUWj8mQZ7PPML4d_xq0nGSpxb5qhQuT5tDoUa0SLQ7-hZ4uxIZBvWChcWAs_kV0k-0vZanyeFgk_pGIJqKelJ5pf4_NgMozu9rG6VzZhnQxfjzXmxyn1M8Ea390XEKx0ftzrAnpmAU_ptDLWCSTj5uk2gCP6b6FUMHg1UcCALg81pkv6UsNCN4Gltof-v2tyZ6vBoRHeXx0BbUPj8CI1JKFXv61v4z9jh5G_j0BU0nZXnJBImHkp4yTSBa7Mf5hk4NyVsEb3X

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1695956
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 4d85bc1cc0134da58cf404172e3cca56_image_ad_120x600.jpeg
static.criteo.net/design/dt/92327/4988122/ Frame FAA4 68 KB
69 KB 417ms
76ms Image
image/jpeg 178.250.7.2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/92327/4988122/4d85bc1cc0134da58cf404172e3cca56_image_ad_120x600.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

95fbb867a36b0214a41136cac5db604cfadf9ef793f9edcc65f2b615acab889d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 27 Sep 2023 12:17:52 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "65141d70-110c3"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 69827
expires: Sun, 29 Sep 2024 04:02:00 GMT

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 73AF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
170 B

153ms
152ms

Document
text/html

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:59 GMT
expires: Thu, 05 Oct 2023 04:01:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:01:59 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 26ED 43 B
216 B 717ms
130ms Image
image/gif 23.20.73.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1525570&asId=69b6d4fb-7909-f599-d9a2-7f1e732bb80a&tv=%7Bc:q8TCjf,pingTime:-3,time:252,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:35%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:252,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:35,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B242~0%5D,as:%5B241~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,rmeas:1,rend:0,renddet:IMG.us,siq:37%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.73.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-73-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
server: nginx
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 26ED 43 B
215 B 713ms
131ms Image
image/gif 23.20.73.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1525570&asId=69b6d4fb-7909-f599-d9a2-7f1e732bb80a&tv=%7Bc:q8TCjh,pingTime:-6,time:254,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:254,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:35,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B244~0%5D,as:%5B243~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,rmeas:1,rend:0,renddet:IMG.us,siq:37%7D&tpiLookup=ao:www.bulgarian-offers.com*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.73.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-73-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
server: nginx
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js Show response
pagead2.googlesyndication.com/bg/ Frame D3E9 37 KB
15 KB 129ms
129ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

16fadb06557f8c559b25e437d47286d3886b6f361900f479f1bf928198e8d0f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Oct 2023 04:27:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 171289
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14696
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 02 Oct 2024 04:27:10 GMT

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012309181453000/ 23 KB
8 KB 121ms
121ms Script
text/javascript 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309181453000/amp4ads-host-v0.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

e93711fdf4472d8754c5fe85ee2df0c9da30a83083ea3f965631683598735af8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 04 Oct 2023 22:18:37 GMT
age: 20602
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7814
x-xss-protection: 0
server: sffe
etag: "f4050340e88893d4"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 03 Oct 2024 22:18:37 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4F9D 2 KB
3 KB 147ms
147ms Image
image/png 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012309181453000/amp4ads-v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 01:27:29 GMT
x-content-type-options: nosniff
server: cafe
age: 9270
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Fri, 06 Oct 2023 01:27:29 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4F9D 295 B
358 B 148ms
148ms Image
image/png 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012309181453000/amp4ads-v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 15:21:19 GMT
x-content-type-options: nosniff
server: cafe
age: 45640
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Thu, 05 Oct 2023 15:21:19 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 26ED 43 B
215 B 643ms
132ms Image
image/gif 23.20.73.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1525570&asId=69b6d4fb-7909-f599-d9a2-7f1e732bb80a&tv=%7Bc:q8TCkr,pingTime:-2,time:326,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:532,beZ:534,mfA:538,cmA:540,inA:541,inZ:548,prA:548,prZ:556,si:569,poA:571,poZ:644,cmZ:644,mfZ:644,loA:786,loZ:791,ltA:858,ltZ:858%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:35%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:326,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:35,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B316~0%5D,as:%5B315~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:37,sinceFw:287,readyFired:false%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.73.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-73-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 all
csm.eu.criteo.net/ Frame FAA4 0
128 B 568ms
88ms Ping
text/plain 178.250.1.25
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=b4nBsEJXvOr0LJ_c7ajdyk5xGCPeKc_TLqF0cd_tupJl93mPm3GcYdSS7BdHgmlW581dfC_YH502cidgOqWbW4MQ3-Y8zTD3NgzKCPMa9jRV2sZh_rsEJqXofr-ij1hKsme3hJ1zuPMiHJ_A4Z_upwRJRDlNKL99qdtkPbFlbiId8nvon4021Gqnkd7ExEt22wcXSP2zN9PitLU2Xk9fhgHuM4aXHk3nETHjxdUsFgQGBGDN6AwPmWYb1kFIo5svv8jwEg&sds=2&rev=88684&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.25 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 05 Oct 2023 04:01:59 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame FAA4 2 KB
1 KB 384ms
94ms Image
image/svg+xml 178.250.7.2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 29 Sep 2024 04:02:00 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame FAA4 2 KB
1 KB 134ms
132ms Image
image/svg+xml 178.250.7.2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.7.2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 29 Sep 2024 04:02:00 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 073A 22 KB
8 KB 142ms
141ms Document
text/html 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

accept-ranges: bytes
age: 574531
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 28 Sep 2023 12:26:28 GMT
expires: Fri, 27 Sep 2024 12:26:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4F9D 0
131 B 103ms
101ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CmKlsNTUeZebnOrHhx_AProukiASThtGJc5j43OedEtzZHhABIPC1yRxg9dXGgcwEoAHVqt6_AsgBCakC192DYntMsj6oAwHIAwiqBPsBT9B9wFo1mwl93mYzU1BUIBt_skVcCO8Ue70eB4amfK8NzZpOA3qR5_e6JAHGme2T8pn9PE61R2oO4qUIVXWHaNFeUaEkrRDU2X4-l0KOPAKoIqfFa6DU7WuAMJ26NfNL_DdAqAe1XleMz7A12l2SN0wjB0-ZZKtDs_nSTg4YG8YmE3VKxdeQSDaNVetnpRKWVBtm46wOZGZPGYmv-wXxKzQf2fdqguTn9ycXNbq70n68o2k0hL6smNBjXeCQh61w4PfdAmDkvmoEYOh5em0J8s-LqdpkodOr8kX7xDDZNejgLlFHNeVwTkZ73J_-u3BMaNZTLsV2u9VFD2fABJnQ5pW6BIgFhryVzEygBi6AB5PVocABqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQiuIm0ggUCIBhEAEYHzICigI6AoBASL39wTqaCaMBaHR0cHM6Ly9mb3JtLnBldWdlb3QuY2gvZGUvZTIwMDg_dXRtX2NhbXBhaWduPTA5MjAyM2UyMDA4JnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09ZGlzcGxheSZ1dG1fY29udGVudD1nZG4mdXRtX3Rlcm09ZTIwMDgmZmRBZElkPUU3bG1qRFNDWHomZmRTaXRlSWQ9ZVpGN2syMnByOYAKAcgLAdoMEQoLEKCI3dnq7p7JwgESAgED2BMDiBQB0BUBgBcBshccChoIABIUcHViLTI0OTg3NzExNzM5OTg1NDcYAA&sigh=Zw8iJt5V2tQ&uach_m=[]&ase=2&nis=5&cid=CAQSPADICaaNI7ZjlikGJjTnpbfvkYB2s-2Cdqv2z2sKI9biY6mOWJCm3_omDW0b6MWtQU1l-ix1e_vViGDyuBgB&template_id=419&cbvp=2

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2498771173998547&output=html&h=280&slotname=3193551653&adk=1978459429&adf=788956508&pi=t.ma~as.3193551653&w=403&fwrn=4&fwrnh=100&lmt=1696471317&rafmt=1&format=403x280&url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1696478517311&bpp=1&bdt=690&idt=602&shv=r20231003&mjsv=m202309291101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2542847512249&frm=20&pv=1&ga_vid=1651249133.1696478518&ga_sid=1696478518&ga_hid=548341587&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=598&ady=963&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44759876%2C44759837%2C31078297%2C44804179&oid=2&pvsid=1812058741298236&tmod=1461565787&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=OEtW05aYrV&p=https%3A//www.bulgarian-offers.com&dtd=607
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 05 Oct 2023 04:01:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 8709
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C6OEtNTUeZcfxOdTVgAfT07CoDuHj7OVw4P6orqURh7-kzfcKEAEg8LXJHGD11caBzASgAc7ul4UpyAEJqQIggDP9OUyyPqgDAcgDywSqBIoCT9Co2A4yeFwWwGBtL9UH9n6fjtgCNwyyhtQ...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xdd2c167d0beb30640000000000000000%22,%222%22:%220x3ec9cd4baa17bad80000000000000000%22,%223%22:%220xe1493c...

0
0

496ms
78ms

Fetch
text/css

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xdd2c167d0beb30640000000000000000%22,%222%22:%220x3ec9cd4baa17bad80000000000000000%22,%223%22:%220xe1493cb1ced8fb8e0000000000000000%22,%224%22:%220x35a36013a2f990e40000000000000000%22,%225%22:%220x87c74ada44781dbc0000000000000000%22},%22debug_key%22:%2216071645526841637753%22,%22debug_reporting%22:true,%22destination%22:%22https://acqualife.ch%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211016730446%22],%224%22:[%2210-05%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%223159016382139767873%22}&andc=true

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xdd2c167d0beb30640000000000000000","2":"0x3ec9cd4baa17bad80000000000000000","3":"0xe1493cb1ced8fb8e0000000000000000","4":"0x35a36013a2f990e40000000000000000","5":"0x87c74ada44781dbc0000000000000000"},"debug_key":"16071645526841637753","debug_reporting":true,"destination":"https://acqualife.ch","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11016730446"],"4":["10-05"],"6":["true"]},"priority":"500","source_event_id":"3159016382139767873"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 05 Oct 2023 04:02:00 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 05 Oct 2023 04:02:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xdd2c167d0beb30640000000000000000","2":"0x3ec9cd4baa17bad80000000000000000","3":"0xe1493cb1ced8fb8e0000000000000000","4":"0x35a36013a2f990e40000000000000000","5":"0x87c74ada44781dbc0000000000000000"},"debug_key":"16071645526841637753","debug_reporting":true,"destination":"https://acqualife.ch","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11016730446"],"4":["10-05"],"6":["true"]},"priority":"500","source_event_id":"3159016382139767873"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 4249 Show response
ads.everesttech.net/ads/mts/24651/ Frame 26ED 7 KB
7 KB 660ms
321ms Script
text/javascript 44.216.83.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.everesttech.net/ads/mts/24651/4249?DFA_Click_Tracker=^(t_cq_ue_https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjstAUtmjiyD5IeKtnR-U_p3ihGDS_crO7ssADxqCQlVL8GcuwKzn6rpD2l7DxfdBNx6DDJq5hG5zZZko4ruSr0g_xC1Y0e8ejK7TXuIYF-4iMMHMtOGxL1-I1BmEZ4cMfbGrZ3aaf1i40ldgJFhwV7rRXF5eITJogedXVJLfmKFpkULi62B_ALVIwRROWUnkICDWsi0j5DriDpieTkwBjTGPlGayFPc2TIm38wyP7H4jAPDnj0-xgUwacTRXaw4aDs0-m5nAFqzzSvibX38b8wTybVukqZvegakmdQRheA8KkwbHzAFe0X88AwvWjnkoSw978_3dBejulY6o1twycKfn9nIvqEL0sSHDSTTOXzguCUJ5kz7rx1T5xfQCbllNIsDvTV_AnYxb1PEyTn7tMBQ3Ar6EwplHxaQvmkn7axpFTW5txCcT1YKugPdtt-6olZhp3QPNG9U6MUAtX_vuhmAYmyzwkaVmD-TuEFKRKSB3Ul6O69IVl1in-Plw6QeI9Te7Qf1zgMQZSuFwypDjYfa96xGyVP3F0S3IQugoRQUN3IW1FBoxpRLWLypVRYxAQ-QT6ituj5vMEQaC6VOetC_wffDaR4BQEVMFKohVM73EG6l53eE3HBMqOudqZi21k7T9Ha-raMWy3P1LMycSkZ29RwE0702QyHdmXDNTn5UIVjbVE8zMs6AxPpr_tDdw1CNEctqCC3L2BCa_eKb0ffayis-9jKactdc6iAT3ti-HzaW0_fHua9DN2BkPZRe0vC8QPwGVBP7lWQLFHEbF_ibkrNGYsy92zqDZb5v8Miw25Y-Epo5wckVJx7lRi4EbyNsFwG24rMl_yxuXC4SE0XW2ATwA3lR4D8f3fZYdP__t4SmGg6YGECqec8FugrncY9y-ta5sl8wiJvmwlq3qipa6Ej3ZJsR9GIdxFm-oY3MuskE4jWw6-L5jcJvcbFs5vOxIVSs8qbD3rpSVIyplwK-W8UCu-gEYEIVeLo62ZfVU4HwYTu7hREsju-EA6V3s9o8SMCEQGLseExwSFvZbB9jlRpFWWtcxn8dg_ZxVdsYSkQI2s_rwv9WZrSoaynGDrl_3awSKPk1LOOPG3vJQs4r4bz3EeTpwl_ljQuIv0W2lL_oYnmVBhv_EFP1F1TLZ3igzmi8WgLOGL3iiOqTp_d_sUiZkjXaJL9cCh5v1bAqrjSQRtbIJ5B0Kjneo1b4RuZf1ey-Nt3gjba2tE2SdskgZvrLmBMRvtuhs4md6hrRqiI8Y2aQ0BbaZiRCJMplEGSFYCOjB2sVNfUJYNzzEbl4LUfN-vn0ZGjMzfHnPAICx4yQYQ23ur1PTHPZbwp_h_7RKZu-iz4cj3DnnVQ_ippGMzGpcfbInb0dERg-0raGbgcIZd98&sai=AMfl-YTZK7JdsoQaTlLOtT6nR-DrPxxu5WfovM7RpUYegtHMODgCWsRxS1AKYTTXAqsUnDTmpr02S6vQzZDQt89rV84R7rKXhGBR7wEptpxlzdINlOoJBtH44TPqb4au7k9s0qgQJCjuKzMjsOawjOrf8sB9jchpJ6JoQCl1MHOIXLlhfM8cy56O77KoNfVJRKPeWqHxbxcsC1VmeGjagP3bbni6WWVLvIOT8IfTuHQMs-dL91rZE-0IbfBJkoc95uSAIrp-ZWMa5ZsC_n_hKp1G7o0lTiYK3SWV5GvukJaSPKQrR_a2mLB-5u3Q1g3moQsFLfytqX6Iurzgxtn_hZudvuzAJz6dnMmv2Hk&sig=Cg0ArKJSzF3xGKHr5QO0EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=_ue_cq)&DFA_BuyId=30152505&DFA_PlacementId=369314977&DFA_AdId=560486750&DFA_CreativeId=168271340&DFA_SiteId=6958819&TC_1=cmml5req2uv&TC_2=30152505&TC_3=369314977&TC_4=168271340&TC_5=dcmadvertiserid|8391437$dcmcampaignid|30152505$dcmadid|560486750$dcmrenderingid|168672506$dcmsiteid|6958819$dcmplacementid|369314977$customer|Microsoft$dv360auctionid|ct=CH&st=&city=12800&dma=0&zp=6850&bw=4&DCM_PlacementID=369314977
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1525570/72171777/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9NomzpKb8-pxV3KVd33bj7UUOIZXjDnqW7C_H46z1om_ezoyuGUei9UtPnQUyirsrS9p50mo3lwYwCaX48Nz1T4wLt1oycIGcOPvbkSuRUAoCZ_4ISz9SW-B26Af2386KgTqTD9wOxj3H52U9gYhecNn9HTeKnqgoAk6HlLP3eu958-2oOfnqwpUACIjaYq9JMfS_NQhpYOlfgJKwvRFU9Qghp0arwuof-Wj0tWPscFBM6MEHz74RyiYYlVqPH2FNyPcXYq_YWqc48CP1mt23YZWuV6V93ZwpOytd2LI559AD735GIky0PQonS4fo5eEVyQstCMtHgMfifB8k55w1xTMe1XXN3YwBOHcqQNs6ii1S_j1MIBIL7BFy3lpPjg_sQbxEBfqxB7sBsBJsl23JU2Lua9-BQsxLo9oyi0AIZaWA4LGOH-P8f3-zmU-XJVTZckb9FN2DJhX0GVEHUrgiey2y_FhKBakDM0fIZfXJSkO2NCB8UhGlNDFsaZrupzNzJxeRDLAaAYJ-T4sAA_oqxQ9ERwkLCpG9mt762byaLdRPhcYL24BkXQqb1yzIti_P4mc58MoLB379Bo9pnIiaI0peaALTee5jDSjeq9NqzFrgVx8aOSnuIsb--5ftqfLjvEjOczbDq70lKr0izmdBcSARiySbNHyBaas_MZ_SDDIFOn7mJnGIp-HXikMBBICUcX-qWamcRIylqYreu4ttWDy5wwMU9y_QLeRLmCNn3J1uaBACEmo4dE5ufFcOkbLPfGN66WTTEEbzR70PtoR9-Nv8Vml7aPfkt0T3yuxhDY6Aj0-z_enWckYgZuvlHgiO6KAPcg5qnWs1eIepl-PcZG486qLTBAhroH4QIz9vE2fiq3EQ5wmfoSsRk2h6KqdwYM399W4T1iRfFZ3ndMHlZVEOyE9KyvrqOdRIdS7yV7d8Bl1tMW49jDpIP0B3Evb31Dw9b3SzgcezHXLYTQ4_gV-BqzyIXXAZ0kTUb2nz66nKo7_3tUI--xKNhAhk9W3OzfONpauI9vmTVpAPYFrYfyC6P4Db2CmUTeqh03HPYFHzQgPBgJJSpqBrbBjoPq0J4hlmNTFjTzwUuPMi0xgZxxcOCL1-DBcHkGk7Phi3pORI6CNLHhijNsAlHgkkOzHCxei53HSW1S2PWztm7uyDDyZC6PZvLw-D_Wmk49gjCcukkSwgJHQL42ygaMfQLOMjy_WRkbpsOYojd62OaBSAiZbd9OBF4clQqRxzpDtpRovqU_5gA3gH72V3Ns23JAodiQoDnw1vQiZU0GMrMy4Vyz4rEiUogw9B8S78dkjvSwviha3lq8pmk5TtSzhtFq-0sXta8vzVs0JX83Lv_KXIrkGoGViJ6xN9cxmDsJuknIrw4bq4QxVGjfFGMJk6WuQ2JjI9a8pXW_TVzLwEEjA7q0kVx4lBV2kMSVg9OgMnW6vwKw8THbMUS6G61g-CpkG1xe5mlecrv-9TTW9dJQupGM179KzhEMa5SUDhHL5kpgx_c3eQQGHJ9rJQzg6TOauwAAkKwCanLJdQL-LejMNU2pqNc_rf6ucOMlnhH-tw3fE7lQsHo52J49oOiRjUAogc4qqcgTrJGNaGvdhJjoVKKjIkjyY-YEfdHlHo9OYQCQXvqkoHVcavP8cn-rqpsgFqumZys_c_1s9i8Kci7X39kG011gmO-3WKPIti3atphOckoIov3Y_R2p5zUE4utHvu_Q32WDlRWl4XG31Ep5rjzQsiMKFNbluMWMy_qZnh33exNDYtrYbitVR8SasB6-loUzr_f7UIhKr3LGrKb7tiCXJHmXcPcVfuHqy6GLS0FFjxCEd_C9fwfJqRyXgW6t3nn0BOkd010Vwq67st-jADUxOoF_J_w_5vcxaHmhqyVueMP6QhCTiZi7SMW-l-XS8ZgzsfCnd_j41GwSVtp7vOQz8G3ajE7LGWD11pG-y9G-tafeXP7YLjRabgoaMb_WWcrrjG4UBcog4elSNbGKnBMe2h07dAe3RsLR2srR1BAr5ixw0UUz73_1JNoUBEqmJWj9B9RPYhVQX-0v7V0tPLmVQPNIx-7VX7BVp4Q4KciYs8wqsqeCFc2gQxZWiPbMn8t5bPzcCXOfBvr1t8LFqGxEY1EHAYAXuBGDAsnPeHfPE1vjUqRaG8a6stikxSKeiK1d8_sIAOcMb42b2ykHOEBfpuxFFQQH7aevdmAsJ2l-DTdxyAluede9rKpivYzP_kWk9-79pL6bxC-xxtkxF9oBZDca6QpBN7xqrVSvTBZAelxv1BXDV5o4_597ZQPIIvQWkLeZQOxWB2xIAg23YqldEhRfR55aimuo8ElEeZE8xXaxMvmE9kJlKwnG13HmxJG9f9gsmQxsGV9GJ80G-zmDYOtoKEH3VJXPI5jqod2TP_jC6Im-GpfAWRpCcL7JQStjKqFlB59HOzKfxAQOhOjTloy9BzsGJMqm1mBIwlvO3TRXl8vcVRiapmjnX-O2yNc4ZR5DdgJP51yl1-lTPgj3vBtLIwBbFaPXFop4-3yOvsKouNiO19-YJOsPpmTGzCqAXuY3q2P8NXtzFo6UEDSpGVsJIEw0Zhq_Zxe9TtefeDqdI7wf15lX5facTk7opIQkbDdpxwlmXfpWZq3ak-EuD4nvbcMUQAqKg2HhAqOw_E_Z-NeZXPr1sv3sdgnITFcZBZvBwzMkepTZHcMHvVhDlMo9jPWobqIPPSxdtXOXNNDLIs82FxsdwkUXl04Mz68Ge8XioVOSPHfWYgiQANXVD-d2K4gTgrrZt-Rno1UYvz0osOiN7Difr4yXkUDjcdnH8PP-_-gsTmgqzfNmqGcgNgdVrgwt9oLJZk8aF9uTMbJ527IZw_PP0sGLuoLv9sNI2B4zoTH-ST7xWzLrQXZOiP4FDW7RHac6gIhrgFMNrX9x7EnLAArFjuDk7vxgktfkjs86KrapwUjfGjg2FT4In4Lgh69QWGgPu_lcaNrtVcz5OaOK3tSx4pUo5pn92ioU-9f-SFmuVqxZWvSxmGPX2Oyj5y0wtShY5POEwk22cBDSgPZ5Ej2quGvhbrf3HXPJ5jv6tKR587S10PktTNp5gnONyaiceNh-_KW6TZNwI7MIKv1C7Mvhmf8_EZn7frAabikk4BCg95T50uvlkFrA5OJGzWQu90syWkNAkBbgnNo5fcUiNgjYk6nHFHkTFxC2rZs1L6E7bEAgM5G7CJCHpzNMOqRTAhON4GKOQCSFYTHIrLLG2LLxuk9oKNfZOI9uSWMt9sQCXoJsRpZBPoW1I2LboryhrV4_pHWrt9l6zxoYniSbmlYUW7w47i9p59DpCPaiEBo0h9YbDyTyAFyRTdiGRWeULi_jCeobPdwl48KI8UcyYxtYkt3CT6100Y35h1gdD_jdJoDM2lebJDc_J49dCoyk8WXTHELkofg0pqkd18PoHv_YC2HzoHEP-_HM3tjBVfrrphuaBxYbS8XeYra-ND3UggBHd_ThcnkPsNdhdZBzW6J2N_tipqWXT2IDqESuTvMjBbBfavUNW9dp3gpa8J2mVg4dMI5zi9gV9KwwG6R16Zg2DrXK4bqDDUeGuQSzZTyQIGBs4DKjdzawDz2bHb2EB_mCJrVeTnii_JBpwqnUDj10fMngPYsgkNSsKpPwVpaX2MoaI9e6gixzSXkGxYDy4AcVpQbu2Cn9OnVIvWsMh5wog18UxCYeOOUqlqQRqCZXU7sc0Oz0DWKni13QKENSEy_K9RJNWaxTpbjDCUhguk0aQggEEjwAyAmmjRn7Hpps7ChxsCzDt6MzAjTUm4Yu4uRdK-6gaJ85kbd6Vr_XBZGalqPdkB9U5XYhQupFRXmuDlsYAWAB&cry=1&bundleId=&ias_dspID=3&ias_campId=1013062319&ias_pubId=pub-2498771173998547&ias_chanId=1&ias_placementId=20276414284&bidurl=https://www.bulgarian-offers.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hrFeEK2UQ1SNPRRnLxgmmH&adsafe_url=https%3A%2F%2Fwww.bulgarian-offers.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231003%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231003%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-3-%26adk%3D1812271801%26client%3Dca-pub-2498771173998547%26fa%3D1%26ifi%3D7%26uci%3Da!7%26btvi%3D3%26xpc%3Dr8K0a4O9jd%26p%3Dhttps%253A%2F%2Fwww.bulgarian-offers.com&adsafe_type=be&adsafe_jsinfo=,id:69b6d4fb-7909-f599-d9a2-7f1e732bb80a,c:q8TCfK,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-797d947f74-xbspw,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:5,mot:0,app:0,maw:0,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:36,oid:ee8c06bc-6333-11ee-9b36-16747d9df865,v:19.8.439,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.216.83.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-83-210.compute-1.amazonaws.com
Software: AMO-jAds/1.1 /
Resource Hash: 8840fc6de901dd025088a6a2f41044ed3c3353c07934c45a87467c0c046c6e17

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
server: AMO-jAds/1.1
p3p: NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 6819
expires: Thu Oct 05 04:02:00 UTC 2023

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231003/r20110914/ Frame 26ED 30 KB
11 KB 57ms
56ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231003/r20110914/abg_lite.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1525570/72171777/xbbe/creative/adj?p=APEucNVdetAIvSsD3qb_sAXfE3et3tzI1LrCTiPdh1H8XCqGeu7mZ1s&d=CokBAKAmf-DY60Ly6Xao6xcq17g8UU2Wb0s0oYU5z1qrBPzyZ2rvCI67a3mwnt-hYdJSMojxB3tpCZ6Nq38dv9NomzpKb8-pxV3KVd33bj7UUOIZXjDnqW7C_H46z1om_ezoyuGUei9UtPnQUyirsrS9p50mo3lwYwCaX48Nz1T4wLt1oycIGcOPvbkSuRUAoCZ_4ISz9SW-B26Af2386KgTqTD9wOxj3H52U9gYhecNn9HTeKnqgoAk6HlLP3eu958-2oOfnqwpUACIjaYq9JMfS_NQhpYOlfgJKwvRFU9Qghp0arwuof-Wj0tWPscFBM6MEHz74RyiYYlVqPH2FNyPcXYq_YWqc48CP1mt23YZWuV6V93ZwpOytd2LI559AD735GIky0PQonS4fo5eEVyQstCMtHgMfifB8k55w1xTMe1XXN3YwBOHcqQNs6ii1S_j1MIBIL7BFy3lpPjg_sQbxEBfqxB7sBsBJsl23JU2Lua9-BQsxLo9oyi0AIZaWA4LGOH-P8f3-zmU-XJVTZckb9FN2DJhX0GVEHUrgiey2y_FhKBakDM0fIZfXJSkO2NCB8UhGlNDFsaZrupzNzJxeRDLAaAYJ-T4sAA_oqxQ9ERwkLCpG9mt762byaLdRPhcYL24BkXQqb1yzIti_P4mc58MoLB379Bo9pnIiaI0peaALTee5jDSjeq9NqzFrgVx8aOSnuIsb--5ftqfLjvEjOczbDq70lKr0izmdBcSARiySbNHyBaas_MZ_SDDIFOn7mJnGIp-HXikMBBICUcX-qWamcRIylqYreu4ttWDy5wwMU9y_QLeRLmCNn3J1uaBACEmo4dE5ufFcOkbLPfGN66WTTEEbzR70PtoR9-Nv8Vml7aPfkt0T3yuxhDY6Aj0-z_enWckYgZuvlHgiO6KAPcg5qnWs1eIepl-PcZG486qLTBAhroH4QIz9vE2fiq3EQ5wmfoSsRk2h6KqdwYM399W4T1iRfFZ3ndMHlZVEOyE9KyvrqOdRIdS7yV7d8Bl1tMW49jDpIP0B3Evb31Dw9b3SzgcezHXLYTQ4_gV-BqzyIXXAZ0kTUb2nz66nKo7_3tUI--xKNhAhk9W3OzfONpauI9vmTVpAPYFrYfyC6P4Db2CmUTeqh03HPYFHzQgPBgJJSpqBrbBjoPq0J4hlmNTFjTzwUuPMi0xgZxxcOCL1-DBcHkGk7Phi3pORI6CNLHhijNsAlHgkkOzHCxei53HSW1S2PWztm7uyDDyZC6PZvLw-D_Wmk49gjCcukkSwgJHQL42ygaMfQLOMjy_WRkbpsOYojd62OaBSAiZbd9OBF4clQqRxzpDtpRovqU_5gA3gH72V3Ns23JAodiQoDnw1vQiZU0GMrMy4Vyz4rEiUogw9B8S78dkjvSwviha3lq8pmk5TtSzhtFq-0sXta8vzVs0JX83Lv_KXIrkGoGViJ6xN9cxmDsJuknIrw4bq4QxVGjfFGMJk6WuQ2JjI9a8pXW_TVzLwEEjA7q0kVx4lBV2kMSVg9OgMnW6vwKw8THbMUS6G61g-CpkG1xe5mlecrv-9TTW9dJQupGM179KzhEMa5SUDhHL5kpgx_c3eQQGHJ9rJQzg6TOauwAAkKwCanLJdQL-LejMNU2pqNc_rf6ucOMlnhH-tw3fE7lQsHo52J49oOiRjUAogc4qqcgTrJGNaGvdhJjoVKKjIkjyY-YEfdHlHo9OYQCQXvqkoHVcavP8cn-rqpsgFqumZys_c_1s9i8Kci7X39kG011gmO-3WKPIti3atphOckoIov3Y_R2p5zUE4utHvu_Q32WDlRWl4XG31Ep5rjzQsiMKFNbluMWMy_qZnh33exNDYtrYbitVR8SasB6-loUzr_f7UIhKr3LGrKb7tiCXJHmXcPcVfuHqy6GLS0FFjxCEd_C9fwfJqRyXgW6t3nn0BOkd010Vwq67st-jADUxOoF_J_w_5vcxaHmhqyVueMP6QhCTiZi7SMW-l-XS8ZgzsfCnd_j41GwSVtp7vOQz8G3ajE7LGWD11pG-y9G-tafeXP7YLjRabgoaMb_WWcrrjG4UBcog4elSNbGKnBMe2h07dAe3RsLR2srR1BAr5ixw0UUz73_1JNoUBEqmJWj9B9RPYhVQX-0v7V0tPLmVQPNIx-7VX7BVp4Q4KciYs8wqsqeCFc2gQxZWiPbMn8t5bPzcCXOfBvr1t8LFqGxEY1EHAYAXuBGDAsnPeHfPE1vjUqRaG8a6stikxSKeiK1d8_sIAOcMb42b2ykHOEBfpuxFFQQH7aevdmAsJ2l-DTdxyAluede9rKpivYzP_kWk9-79pL6bxC-xxtkxF9oBZDca6QpBN7xqrVSvTBZAelxv1BXDV5o4_597ZQPIIvQWkLeZQOxWB2xIAg23YqldEhRfR55aimuo8ElEeZE8xXaxMvmE9kJlKwnG13HmxJG9f9gsmQxsGV9GJ80G-zmDYOtoKEH3VJXPI5jqod2TP_jC6Im-GpfAWRpCcL7JQStjKqFlB59HOzKfxAQOhOjTloy9BzsGJMqm1mBIwlvO3TRXl8vcVRiapmjnX-O2yNc4ZR5DdgJP51yl1-lTPgj3vBtLIwBbFaPXFop4-3yOvsKouNiO19-YJOsPpmTGzCqAXuY3q2P8NXtzFo6UEDSpGVsJIEw0Zhq_Zxe9TtefeDqdI7wf15lX5facTk7opIQkbDdpxwlmXfpWZq3ak-EuD4nvbcMUQAqKg2HhAqOw_E_Z-NeZXPr1sv3sdgnITFcZBZvBwzMkepTZHcMHvVhDlMo9jPWobqIPPSxdtXOXNNDLIs82FxsdwkUXl04Mz68Ge8XioVOSPHfWYgiQANXVD-d2K4gTgrrZt-Rno1UYvz0osOiN7Difr4yXkUDjcdnH8PP-_-gsTmgqzfNmqGcgNgdVrgwt9oLJZk8aF9uTMbJ527IZw_PP0sGLuoLv9sNI2B4zoTH-ST7xWzLrQXZOiP4FDW7RHac6gIhrgFMNrX9x7EnLAArFjuDk7vxgktfkjs86KrapwUjfGjg2FT4In4Lgh69QWGgPu_lcaNrtVcz5OaOK3tSx4pUo5pn92ioU-9f-SFmuVqxZWvSxmGPX2Oyj5y0wtShY5POEwk22cBDSgPZ5Ej2quGvhbrf3HXPJ5jv6tKR587S10PktTNp5gnONyaiceNh-_KW6TZNwI7MIKv1C7Mvhmf8_EZn7frAabikk4BCg95T50uvlkFrA5OJGzWQu90syWkNAkBbgnNo5fcUiNgjYk6nHFHkTFxC2rZs1L6E7bEAgM5G7CJCHpzNMOqRTAhON4GKOQCSFYTHIrLLG2LLxuk9oKNfZOI9uSWMt9sQCXoJsRpZBPoW1I2LboryhrV4_pHWrt9l6zxoYniSbmlYUW7w47i9p59DpCPaiEBo0h9YbDyTyAFyRTdiGRWeULi_jCeobPdwl48KI8UcyYxtYkt3CT6100Y35h1gdD_jdJoDM2lebJDc_J49dCoyk8WXTHELkofg0pqkd18PoHv_YC2HzoHEP-_HM3tjBVfrrphuaBxYbS8XeYra-ND3UggBHd_ThcnkPsNdhdZBzW6J2N_tipqWXT2IDqESuTvMjBbBfavUNW9dp3gpa8J2mVg4dMI5zi9gV9KwwG6R16Zg2DrXK4bqDDUeGuQSzZTyQIGBs4DKjdzawDz2bHb2EB_mCJrVeTnii_JBpwqnUDj10fMngPYsgkNSsKpPwVpaX2MoaI9e6gixzSXkGxYDy4AcVpQbu2Cn9OnVIvWsMh5wog18UxCYeOOUqlqQRqCZXU7sc0Oz0DWKni13QKENSEy_K9RJNWaxTpbjDCUhguk0aQggEEjwAyAmmjRn7Hpps7ChxsCzDt6MzAjTUm4Yu4uRdK-6gaJ85kbd6Vr_XBZGalqPdkB9U5XYhQupFRXmuDlsYAWAB&cry=1&bundleId=&ias_dspID=3&ias_campId=1013062319&ias_pubId=pub-2498771173998547&ias_chanId=1&ias_placementId=20276414284&bidurl=https://www.bulgarian-offers.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hrFeEK2UQ1SNPRRnLxgmmH&adsafe_url=https%3A%2F%2Fwww.bulgarian-offers.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fwww.bulgarian-offers.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231003%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231003%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-3-%26adk%3D1812271801%26client%3Dca-pub-2498771173998547%26fa%3D1%26ifi%3D7%26uci%3Da!7%26btvi%3D3%26xpc%3Dr8K0a4O9jd%26p%3Dhttps%253A%2F%2Fwww.bulgarian-offers.com&adsafe_type=be&adsafe_jsinfo=,id:69b6d4fb-7909-f599-d9a2-7f1e732bb80a,c:q8TCfK,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-797d947f74-xbspw,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:5,mot:0,app:0,maw:0,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:36,oid:ee8c06bc-6333-11ee-9b36-16747d9df865,v:19.8.439,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

4fcc2c45e5c8be67198b1d2c38bef90e3373e59b91be75e915711bfa7c10d22a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:48:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11602
x-xss-protection: 0
server: cafe
etag: 2362517075893974484
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:48:51 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231003/r20110914/elements/html/ Frame 26ED 11 KB
4 KB 61ms
60ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231003/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 04 Oct 2023 13:48:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 18 Oct 2023 13:48:02 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 26ED 0
0 160ms
131ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuaJHUNCnVWem_K2YI2cUE-yKfmaBfA5RAsCYcgwTTgUAcheAOggLO07rIsyKaOoh4jLl41atHRr6MQfQKn-V1u6ik3qtNm8gcQofQCNH-71sdgOnQpsHgXTnkfG3qjxQ34qxU4vEo-eM3iQ0p9xJRTz5FlBjOAc9Zc7jhYmy48CktGAoA&sai=AMfl-YRIG0excVH2CqSCeTNg32bW_dZWh0Z89q-VqR1De43b45QYiWCBecSSyqOeaaM2HKjsA-GgUKz8E60IIIHZWxR11zZNpM-mQqXXYDZdvPXg3oVO0LI3RGkJ1dBCvEA&sig=Cg0ArKJSzE-nd0DKBSyoEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20231003.96388&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js Show response
pagead2.googlesyndication.com/bg/ Frame E0B2 37 KB
14 KB 91ms
90ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

16fadb06557f8c559b25e437d47286d3886b6f361900f479f1bf928198e8d0f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Oct 2023 04:27:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 171290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14696
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 02 Oct 2024 04:27:10 GMT

GET
H2 200 FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js Show response
pagead2.googlesyndication.com/bg/ Frame 073A 37 KB
14 KB 103ms
101ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/FvrbBlV_jFWbJeQ31HKG04hrbzYZAPR58b-SgZjo0Pc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

16fadb06557f8c559b25e437d47286d3886b6f361900f479f1bf928198e8d0f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Oct 2023 04:27:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 171290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14696
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 02 Oct 2024 04:27:10 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 227ms
87ms Preflight
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 05 Oct 2023 04:02:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2BC6 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72e00c7ffc1098262dc5f62edc1229b2b83c7436f91a9ecf2cb14e377871f19a

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2BC6 0
56 B 417ms
416ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CGBf3NTUeZa3ZOYqO78EPovynyALJntKxXNWdkfdwwI23ARABIABg9dXGgcwEggEXY2EtcHViLTI0OTg3NzExNzM5OTg1NDfIAQmpAhPU3jE7oLE-qAMByAMCqgTqAU_QYfTweckmXvaNdKrt79ZBI9gUFp0WHLpkH6l7BLX4F8exO0JWpCo9tf4nQZkw4OM4qAo2hVJFH-qWu1P1IOBRVgUmezPhOxZAxSc-KdgHATXh1f1zPrEYp5ossNCdx0QFXYrY_4WVrzZg4skiVdlLBaJNwrdAVj7c7yX36adZH5X1Pjsb5kA2zlhcRhmzW0dGn-pcw8slpjNjGJRZ1l9erH0Fp7w7CQf4EDx1EHcM7hK7mqb7qqmQ4XWztugvBDEdh96Nd4m_2Yv9Utix7emF8auxOGKX7QD6qdmcLfTNyTYfYzV2RaKbKIAGy9-_-5fMovUXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIEgiAYRABMgKKAjoCgEBIvf3BOoAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0yNDk4NzcxMTczOTk4NTQ3GAA&sigh=dDlHu6i-Iyc&uach_m=[UACH]&cid=CAQSPADICaaNGfsemmzsKHGwLMO3ozMCNNSbhi7i5F0r7qBonzmRt3pWv9cFkZqWo92QH1TldiFC6kVFea4OWxgB&cbvp=2&vis=1

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 05 Oct 2023 04:02:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame 2BC6 0
126 B 571ms
56ms Image
text/plain 178.250.1.10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kIv1F5e6MHjYBJ2DYgICAAAAi7MHMwHHSmIQNTUeZXbOZPLKzzsS04oAABIAAAoKQVFVREFRRUJBUQ&wp=ZR41NQAObK0CO8cKAAn-Im70e1srW3gRrqbswQ&cbvp=2

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:00 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 178254
server: Kestrel
content-length: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 26ED 43 B
215 B 392ms
392ms Image
image/gif 23.20.73.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1525570&asId=69b6d4fb-7909-f599-d9a2-7f1e732bb80a&tv=%7Bc:q8TCw1,pingTime:-10,time:1044,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtMTIwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODkuMC40Mzg5LjcyIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1696478520416%7C%7C4bd8aef37981871662bb6c1befb65473%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7Cbdbdcc3add4bc83ed62f0acd72e24bfe%7C%7C2937807def9313c9d0a978b1411d95de%7C%7C011c4c976372ac33758872502fec31a6%7C%7C1fd5370e68cfdcdfd509e5ad289738a7%7C%7C6f2d51fcf609e6b19d828bb7ce6bbd20%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.73.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-73-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
server: nginx
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 073A 0
56 B 304ms
303ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BnFHpNzUeZaCcCvP33wPtmaWwBwAAAAA4AeAEAg&bg=!NjWlNXrNAAYMG8UMLBs7ADQBe5WfOLey37TUNF1qaXvpCBp9cXxT4drQNu4PlyRGbjg4N00EiXpUFe3ALkVRqFMPIFlZAgAAANVSAAAADGgBB5kDFMjhWe915RoHa4CVKpwapCwwlTYL3Uu6gtUwrlItY_wlpGdT_1r_3bkP6N7oSu4DLCFPqvcO1wDXcwgcutjDlWXiu0jXm_MYqFOkG8hgq5PGCHIbzrVv2PbuDuvzzw5feK5y1IcJJJ__i6myfvpFT8RUpoFfxoTD2juJSr1V-0iz4BU-sVC0wNkkTkpwr6-IZL-I7wH0Mk_LfVR7H25Qf2W8ap6gR6DEo_WRbPT90ti7mBmBBbQ0PPH94DCZZIv8GeIzbFrCX3jyigK7DDqfyDtBnpAT0u3XO18sCR4-cjHwDSIjvoa1gduqBdvAxZdx-EqsdwSP_a9Y0YpYvzChIdRIcccEfQIeTkOH_NbSJMNhAiRp0YKn88kzMjn-G5CpEEewvNeWA9VffM7uo7Qgihl4wOOuJXy5rVKgULAV6ifjXqvEBaeM1BfhAEEDOaupBaXuEE3rCNLx5PMNtkrmTgSo4xjL4yyyn0ocqSx5OYyj3DzFdSD1oDt8h6ZwaC05B3IYUCO4CmR3kOvmjFr5g9fecirGZ9f4yGZn5-xDOFcumoPi-0GzlZ2_Kos6YhPwmXtK-Pl-NAZSLR825Vma3ivsA-ubOkQ6T3cQ_BbSy-i-7SSWnqxQuZYY1TzKJsDVZVsWrBsTLePXbXXJJ_KxvkOl_ssAm3yXCdCha8u1kQZVTL8CAvZ0epHNdr-7x5NAcl92rCZZTRbkMZlamOqMnmUW5S6-34UPfDMS7jzTpv5R7C6e7TfJyFMCdyKKFqOZ7D1xdZyJd2X_7vQ8eAMnB1sHqPwfwQx0BQnKksdHzNEyighNE3o8yRTpCQnPnTq8vHMlK2HakTIKok09r4BTYaZjMTTFNjaLAm91-04dAX4PmK44moMCDPWyNFV_U9V6YOeJU-ZibgKHj0Ocz5N7ih5L33a-X0St0xoE2p99_H7U0aCuGbGhXHmDhkGleIOEmEqa3m90OdMNzC41DMvZ81aKHpD3BTbXe3ybYSdvPSmPW1cGwLdQ7wqVLmb8-hGRzuWW0oF8AWl1RNq63-kbUlYA0PkI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4249 Show response
ads.everesttech.net/ads/mts/24651/ Frame 26ED 11 KB
12 KB 139ms
139ms Script
text/javascript 44.216.83.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.everesttech.net/ads/mts/24651/4249?DFA_Click_Tracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstAUtmjiyD5IeKtnR-U_p3ihGDS_crO7ssADxqCQlVL8GcuwKzn6rpD2l7DxfdBNx6DDJq5hG5zZZko4ruSr0g_xC1Y0e8ejK7TXuIYF-4iMMHMtOGxL1-I1BmEZ4cMfbGrZ3aaf1i40ldgJFhwV7rRXF5eITJogedXVJLfmKFpkULi62B_ALVIwRROWUnkICDWsi0j5DriDpieTkwBjTGPlGayFPc2TIm38wyP7H4jAPDnj0-xgUwacTRXaw4aDs0-m5nAFqzzSvibX38b8wTybVukqZvegakmdQRheA8KkwbHzAFe0X88AwvWjnkoSw978_3dBejulY6o1twycKfn9nIvqEL0sSHDSTTOXzguCUJ5kz7rx1T5xfQCbllNIsDvTV_AnYxb1PEyTn7tMBQ3Ar6EwplHxaQvmkn7axpFTW5txCcT1YKugPdtt-6olZhp3QPNG9U6MUAtX_vuhmAYmyzwkaVmD-TuEFKRKSB3Ul6O69IVl1in-Plw6QeI9Te7Qf1zgMQZSuFwypDjYfa96xGyVP3F0S3IQugoRQUN3IW1FBoxpRLWLypVRYxAQ-QT6ituj5vMEQaC6VOetC_wffDaR4BQEVMFKohVM73EG6l53eE3HBMqOudqZi21k7T9Ha-raMWy3P1LMycSkZ29RwE0702QyHdmXDNTn5UIVjbVE8zMs6AxPpr_tDdw1CNEctqCC3L2BCa_eKb0ffayis-9jKactdc6iAT3ti-HzaW0_fHua9DN2BkPZRe0vC8QPwGVBP7lWQLFHEbF_ibkrNGYsy92zqDZb5v8Miw25Y-Epo5wckVJx7lRi4EbyNsFwG24rMl_yxuXC4SE0XW2ATwA3lR4D8f3fZYdP__t4SmGg6YGECqec8FugrncY9y-ta5sl8wiJvmwlq3qipa6Ej3ZJsR9GIdxFm-oY3MuskE4jWw6-L5jcJvcbFs5vOxIVSs8qbD3rpSVIyplwK-W8UCu-gEYEIVeLo62ZfVU4HwYTu7hREsju-EA6V3s9o8SMCEQGLseExwSFvZbB9jlRpFWWtcxn8dg_ZxVdsYSkQI2s_rwv9WZrSoaynGDrl_3awSKPk1LOOPG3vJQs4r4bz3EeTpwl_ljQuIv0W2lL_oYnmVBhv_EFP1F1TLZ3igzmi8WgLOGL3iiOqTp_d_sUiZkjXaJL9cCh5v1bAqrjSQRtbIJ5B0Kjneo1b4RuZf1ey-Nt3gjba2tE2SdskgZvrLmBMRvtuhs4md6hrRqiI8Y2aQ0BbaZiRCJMplEGSFYCOjB2sVNfUJYNzzEbl4LUfN-vn0ZGjMzfHnPAICx4yQYQ23ur1PTHPZbwp_h_7RKZu-iz4cj3DnnVQ_ippGMzGpcfbInb0dERg-0raGbgcIZd98%26sai%3DAMfl-YTZK7JdsoQaTlLOtT6nR-DrPxxu5WfovM7RpUYegtHMODgCWsRxS1AKYTTXAqsUnDTmpr02S6vQzZDQt89rV84R7rKXhGBR7wEptpxlzdINlOoJBtH44TPqb4au7k9s0qgQJCjuKzMjsOawjOrf8sB9jchpJ6JoQCl1MHOIXLlhfM8cy56O77KoNfVJRKPeWqHxbxcsC1VmeGjagP3bbni6WWVLvIOT8IfTuHQMs-dL91rZE-0IbfBJkoc95uSAIrp-ZWMa5ZsC_n_hKp1G7o0lTiYK3SWV5GvukJaSPKQrR_a2mLB-5u3Q1g3moQsFLfytqX6Iurzgxtn_hZudvuzAJz6dnMmv2Hk%26sig%3DCg0ArKJSzF3xGKHr5QO0EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&DFA_BuyId=30152505&DFA_PlacementId=369314977&DFA_AdId=560486750&DFA_CreativeId=168271340&DFA_SiteId=6958819&TC_1=cmml5req2uv&TC_2=30152505&TC_3=369314977&TC_4=168271340&TC_5=dcmadvertiserid|8391437$dcmcampaignid|30152505$dcmadid|560486750$dcmrenderingid|168672506$dcmsiteid|6958819$dcmplacementid|369314977$customer|Microsoft$dv360auctionid|ct=CH&st=&city=12800&dma=0&zp=6850&bw=4&DCM_PlacementID=369314977&edge=y&html5=y&nr=0.6825019272733774
Requested by: Host: ads.everesttech.net
URL: https://ads.everesttech.net/ads/mts/24651/4249?DFA_Click_Tracker=^(t_cq_ue_https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjstAUtmjiyD5IeKtnR-U_p3ihGDS_crO7ssADxqCQlVL8GcuwKzn6rpD2l7DxfdBNx6DDJq5hG5zZZko4ruSr0g_xC1Y0e8ejK7TXuIYF-4iMMHMtOGxL1-I1BmEZ4cMfbGrZ3aaf1i40ldgJFhwV7rRXF5eITJogedXVJLfmKFpkULi62B_ALVIwRROWUnkICDWsi0j5DriDpieTkwBjTGPlGayFPc2TIm38wyP7H4jAPDnj0-xgUwacTRXaw4aDs0-m5nAFqzzSvibX38b8wTybVukqZvegakmdQRheA8KkwbHzAFe0X88AwvWjnkoSw978_3dBejulY6o1twycKfn9nIvqEL0sSHDSTTOXzguCUJ5kz7rx1T5xfQCbllNIsDvTV_AnYxb1PEyTn7tMBQ3Ar6EwplHxaQvmkn7axpFTW5txCcT1YKugPdtt-6olZhp3QPNG9U6MUAtX_vuhmAYmyzwkaVmD-TuEFKRKSB3Ul6O69IVl1in-Plw6QeI9Te7Qf1zgMQZSuFwypDjYfa96xGyVP3F0S3IQugoRQUN3IW1FBoxpRLWLypVRYxAQ-QT6ituj5vMEQaC6VOetC_wffDaR4BQEVMFKohVM73EG6l53eE3HBMqOudqZi21k7T9Ha-raMWy3P1LMycSkZ29RwE0702QyHdmXDNTn5UIVjbVE8zMs6AxPpr_tDdw1CNEctqCC3L2BCa_eKb0ffayis-9jKactdc6iAT3ti-HzaW0_fHua9DN2BkPZRe0vC8QPwGVBP7lWQLFHEbF_ibkrNGYsy92zqDZb5v8Miw25Y-Epo5wckVJx7lRi4EbyNsFwG24rMl_yxuXC4SE0XW2ATwA3lR4D8f3fZYdP__t4SmGg6YGECqec8FugrncY9y-ta5sl8wiJvmwlq3qipa6Ej3ZJsR9GIdxFm-oY3MuskE4jWw6-L5jcJvcbFs5vOxIVSs8qbD3rpSVIyplwK-W8UCu-gEYEIVeLo62ZfVU4HwYTu7hREsju-EA6V3s9o8SMCEQGLseExwSFvZbB9jlRpFWWtcxn8dg_ZxVdsYSkQI2s_rwv9WZrSoaynGDrl_3awSKPk1LOOPG3vJQs4r4bz3EeTpwl_ljQuIv0W2lL_oYnmVBhv_EFP1F1TLZ3igzmi8WgLOGL3iiOqTp_d_sUiZkjXaJL9cCh5v1bAqrjSQRtbIJ5B0Kjneo1b4RuZf1ey-Nt3gjba2tE2SdskgZvrLmBMRvtuhs4md6hrRqiI8Y2aQ0BbaZiRCJMplEGSFYCOjB2sVNfUJYNzzEbl4LUfN-vn0ZGjMzfHnPAICx4yQYQ23ur1PTHPZbwp_h_7RKZu-iz4cj3DnnVQ_ippGMzGpcfbInb0dERg-0raGbgcIZd98&sai=AMfl-YTZK7JdsoQaTlLOtT6nR-DrPxxu5WfovM7RpUYegtHMODgCWsRxS1AKYTTXAqsUnDTmpr02S6vQzZDQt89rV84R7rKXhGBR7wEptpxlzdINlOoJBtH44TPqb4au7k9s0qgQJCjuKzMjsOawjOrf8sB9jchpJ6JoQCl1MHOIXLlhfM8cy56O77KoNfVJRKPeWqHxbxcsC1VmeGjagP3bbni6WWVLvIOT8IfTuHQMs-dL91rZE-0IbfBJkoc95uSAIrp-ZWMa5ZsC_n_hKp1G7o0lTiYK3SWV5GvukJaSPKQrR_a2mLB-5u3Q1g3moQsFLfytqX6Iurzgxtn_hZudvuzAJz6dnMmv2Hk&sig=Cg0ArKJSzF3xGKHr5QO0EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=_ue_cq)&DFA_BuyId=30152505&DFA_PlacementId=369314977&DFA_AdId=560486750&DFA_CreativeId=168271340&DFA_SiteId=6958819&TC_1=cmml5req2uv&TC_2=30152505&TC_3=369314977&TC_4=168271340&TC_5=dcmadvertiserid|8391437$dcmcampaignid|30152505$dcmadid|560486750$dcmrenderingid|168672506$dcmsiteid|6958819$dcmplacementid|369314977$customer|Microsoft$dv360auctionid|ct=CH&st=&city=12800&dma=0&zp=6850&bw=4&DCM_PlacementID=369314977
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.216.83.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-83-210.compute-1.amazonaws.com
Software: AMO-jAds/1.1 /
Resource Hash: 58e3c62f27e68518cb5fdfca71af138e38721359981cf6934ec7c03f091045ad

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/javascript;charset=utf-8
pragma: no-cache
date: Thu, 05 Oct 2023 04:02:00 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
server: AMO-jAds/1.1
expires: Thu Oct 05 04:02:00 UTC 2023

GET
H/1.1 200
OK html5-ad-script_v4.html Show response
dco-assets.everestads.net/ics-campaign/static/dco/ Frame F381 16 KB
4 KB 159ms
44ms Document
text/html 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dco-assets.everestads.net/ics-campaign/static/dco/html5-ad-script_v4.html?data=ZR41OAAAHMp37Qe6
Requested by: Host: ads.everesttech.net
URL: https://ads.everesttech.net/ads/mts/24651/4249?DFA_Click_Tracker=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstAUtmjiyD5IeKtnR-U_p3ihGDS_crO7ssADxqCQlVL8GcuwKzn6rpD2l7DxfdBNx6DDJq5hG5zZZko4ruSr0g_xC1Y0e8ejK7TXuIYF-4iMMHMtOGxL1-I1BmEZ4cMfbGrZ3aaf1i40ldgJFhwV7rRXF5eITJogedXVJLfmKFpkULi62B_ALVIwRROWUnkICDWsi0j5DriDpieTkwBjTGPlGayFPc2TIm38wyP7H4jAPDnj0-xgUwacTRXaw4aDs0-m5nAFqzzSvibX38b8wTybVukqZvegakmdQRheA8KkwbHzAFe0X88AwvWjnkoSw978_3dBejulY6o1twycKfn9nIvqEL0sSHDSTTOXzguCUJ5kz7rx1T5xfQCbllNIsDvTV_AnYxb1PEyTn7tMBQ3Ar6EwplHxaQvmkn7axpFTW5txCcT1YKugPdtt-6olZhp3QPNG9U6MUAtX_vuhmAYmyzwkaVmD-TuEFKRKSB3Ul6O69IVl1in-Plw6QeI9Te7Qf1zgMQZSuFwypDjYfa96xGyVP3F0S3IQugoRQUN3IW1FBoxpRLWLypVRYxAQ-QT6ituj5vMEQaC6VOetC_wffDaR4BQEVMFKohVM73EG6l53eE3HBMqOudqZi21k7T9Ha-raMWy3P1LMycSkZ29RwE0702QyHdmXDNTn5UIVjbVE8zMs6AxPpr_tDdw1CNEctqCC3L2BCa_eKb0ffayis-9jKactdc6iAT3ti-HzaW0_fHua9DN2BkPZRe0vC8QPwGVBP7lWQLFHEbF_ibkrNGYsy92zqDZb5v8Miw25Y-Epo5wckVJx7lRi4EbyNsFwG24rMl_yxuXC4SE0XW2ATwA3lR4D8f3fZYdP__t4SmGg6YGECqec8FugrncY9y-ta5sl8wiJvmwlq3qipa6Ej3ZJsR9GIdxFm-oY3MuskE4jWw6-L5jcJvcbFs5vOxIVSs8qbD3rpSVIyplwK-W8UCu-gEYEIVeLo62ZfVU4HwYTu7hREsju-EA6V3s9o8SMCEQGLseExwSFvZbB9jlRpFWWtcxn8dg_ZxVdsYSkQI2s_rwv9WZrSoaynGDrl_3awSKPk1LOOPG3vJQs4r4bz3EeTpwl_ljQuIv0W2lL_oYnmVBhv_EFP1F1TLZ3igzmi8WgLOGL3iiOqTp_d_sUiZkjXaJL9cCh5v1bAqrjSQRtbIJ5B0Kjneo1b4RuZf1ey-Nt3gjba2tE2SdskgZvrLmBMRvtuhs4md6hrRqiI8Y2aQ0BbaZiRCJMplEGSFYCOjB2sVNfUJYNzzEbl4LUfN-vn0ZGjMzfHnPAICx4yQYQ23ur1PTHPZbwp_h_7RKZu-iz4cj3DnnVQ_ippGMzGpcfbInb0dERg-0raGbgcIZd98%26sai%3DAMfl-YTZK7JdsoQaTlLOtT6nR-DrPxxu5WfovM7RpUYegtHMODgCWsRxS1AKYTTXAqsUnDTmpr02S6vQzZDQt89rV84R7rKXhGBR7wEptpxlzdINlOoJBtH44TPqb4au7k9s0qgQJCjuKzMjsOawjOrf8sB9jchpJ6JoQCl1MHOIXLlhfM8cy56O77KoNfVJRKPeWqHxbxcsC1VmeGjagP3bbni6WWVLvIOT8IfTuHQMs-dL91rZE-0IbfBJkoc95uSAIrp-ZWMa5ZsC_n_hKp1G7o0lTiYK3SWV5GvukJaSPKQrR_a2mLB-5u3Q1g3moQsFLfytqX6Iurzgxtn_hZudvuzAJz6dnMmv2Hk%26sig%3DCg0ArKJSzF3xGKHr5QO0EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&DFA_BuyId=30152505&DFA_PlacementId=369314977&DFA_AdId=560486750&DFA_CreativeId=168271340&DFA_SiteId=6958819&TC_1=cmml5req2uv&TC_2=30152505&TC_3=369314977&TC_4=168271340&TC_5=dcmadvertiserid|8391437$dcmcampaignid|30152505$dcmadid|560486750$dcmrenderingid|168672506$dcmsiteid|6958819$dcmplacementid|369314977$customer|Microsoft$dv360auctionid|ct=CH&st=&city=12800&dma=0&zp=6850&bw=4&DCM_PlacementID=369314977&edge=y&html5=y&nr=0.6825019272733774
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3bdf27a1124d341aa2b1880639ae305d9af0d84dd79d7e7f460794038ff75fbf

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 3934
Content-Type: text/html; charset=UTF-8
Date: Thu, 05 Oct 2023 04:02:00 GMT
ETag: "150315370-3fce-5e32201ac1000"
Expires: Thu, 05 Oct 2023 05:02:00 GMT
Last-Modified: Wed, 06 Jul 2022 12:21:20 GMT
Server: Apache
Vary: Accept-Encoding
X-Permitted-Cross-Domain-Policies: all

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 52FB 1 KB
682 B 46ms
44ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

age: 19550
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 22:36:10 GMT
etag: 48472445140208031
expires: Thu, 05 Oct 2023 22:36:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 26ED 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b0c27feb6274ac910961b1f1f47af5a0dadde2c73e11f973c94b28ab85b2e89

Request headers

accept-language: de-CH,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 4F9D 42 B
108 B 86ms
86ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuOhQ5ufXUyOKtvw-ICAcbVAcTqLnpfMyV7PFA5I7t0RRqBRh7DPJYjLwpdXkuL-0F-wzBC1tDiPwQ3bvnB-rloE0qiZE-nAROpModV_dsbT5fbKgVkRfH9VKfVkgrrwlBUhD3XPK6tSQ2n4BP4GflyQcW_-sArI3g0uuv4tW7Xa9eHaB7kHFKvncuM6lu13SB1tAlv3vgZkOoil2qpchDXwQsF3xwDeZqEZ0pcvm2j1pT3ZqOHdfGQ9Cbj4nJB8EYrlXybj90CrAXYR3vWjwEeL0lkMInwbXwRRkhe6VX8EQzXyH3P30_oxLDGFOd0L9eqr2sJLJsEP6yHKRh9diEhELb0qLRQCLneH4nGp3wZD0HT_tZis2WR3X72L_Y4lC5O-f8iOBBHObcCOl3X2HhHYm7i_tx8S_qZzt2tTsHkGTssi7RhHzyaFP7fgKNJQyzvS4BTVg7KJScqRs4FQrHxqSQrrIPettBusrDlbQ1WELFx-7_u10sTZPNQUXC1fAJzpIHineNFky73bffk24xVVZFmaWA4myWjdrQGKlCqiZRsofZjhOq3vC05nCXpLpALot88sWkCV4Fous9TnoovJqYL1ArZN6TM40fKEk9ildFcM5UPBOi6VhMknfYgwMtN2TIUv8xhRp2ggkJgAS1Mmgdfn0Z1ZrXz13lGXp5pMSwoB43Y4MDC0eBqIFnek1nKtbAvxiSy5uNc8-X6uBWFeyBaZvhzcOvMlvWiJLKXdUzWsmF7HPj3jy0wYlfEmSVZdhohQf0LJt_j7am6VBvP9U4DTzNpVlnaOL7h5v0a5mDlabA9ACp62h_2TvtUQtUemEUSBpLGpWRHHtlBhmrF-45aU8V7C8SoP83l1Y1exgB3xhHP79YusRLHOeG7w7Sjlw1278mkgBSM2lrjUvFTiVB3iQKOXpwHVsEXNt5BSj6BpGdPBtyAslPus3QoqJdbhJ4DfLmXogR-rtOd-uCDW-fYB4hMbp301o3P9BpgabZGehxtZ0IBRwMrr6fasR119AFvfEZ_H_4FBjIU-XnAiyE1TMdbbYF4tX7c0zJxZKmzRBJ3JetXPyxBmLPdf3SSNHI9aKbEGOjUCEDsyCs7lKrhafXIuTCgY2XHvlOWSYVBiDHakCCTP_lqx8mg3jztAoFGqVzG4CT07a_73HbATiXHIY6OgH9BooYURKKDF3QbFdCdk0Rq7-EPAcq5vQyTqLCYaVTW8EMyRbD_tnkn-ds0qq4Gkm1tB8tRRieBJ4M88Paf59VxnG2eB078krGXualqbZ4J_hsJmvCahegUf8JPyD8mNzs3Bpqcmfij3HjSuheH6S6DPXK-Fziuc066BDt-dLv5fF2D-uEBSHwuo64JKanMFWJQ7DonJziheYadk4qu6TBDzg&sai=AMfl-YSQdqiHHCZ5UQVssibjH4FBpa6zHC8IIOti45bam8nGS4Eso7YxDzzjKvZ1wq2dO1YkLTi8d4ocIgb0WZLqSroKfspmSkTw8Onvx34ocV0qd5Pnya54UA8MVeZ-JbMn1cmv0tAaGUUdwQ&sig=Cg0ArKJSzDiWoyI9UQqEEAE&cid=CAQSPADICaaNI7ZjlikGJjTnpbfvkYB2s-2Cdqv2z2sKI9biY6mOWJCm3_omDW0b6MWtQU1l-ix1e_vViGDyuBgB&id=ampim&o=598,963&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1076&mtos=0,0,1076,1076,1076&tos=0,0,1076,0,0&tfs=1420&tls=2496&g=84.64285731315613&h=84.64285731315613&tt=2497&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Requested by

Host: www.bulgarian-offers.com
URL: https://www.bulgarian-offers.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 52FB
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEJNvky_Bsx8gWNp1bine8m8&google_cver=1&google_push=AXcoOmSLe5Yln6pWahXdrauk4lr0CvUsjVToD1r9kVSNXqF1loUcB2aDfpnOj8afBCDh4TvcqeCTpkn0gvzBh-4vY4yrIDXVWpHt-A
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjcyNTgwMDY5MTUzNDkzNjQ0OQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEG_ovByclwRaeeR54w1XdEg&google_cver=1

43 B
398 B

108ms
74ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEG_ovByclwRaeeR54w1XdEg&google_cver=1
Protocol: H2
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEG_ovByclwRaeeR54w1XdEg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 52FB
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELIniKk_HT01JP-R2bqB37A&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELIniKk_HT01JP-R2bqB37A&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OE1udXp0SHMxUU9meU41&google_gid=CAESELIniKk_HT01JP-R2bqB37A&google_cver=1&google_push=AXcoOmTQdK0uSDDcp7G5i0RntrE8uEz8r_2QV4NGTfVK24x...

170 B
188 B

94ms
94ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OE1udXp0SHMxUU9meU41&google_gid=CAESELIniKk_HT01JP-R2bqB37A&google_cver=1&google_push=AXcoOmTQdK0uSDDcp7G5i0RntrE8uEz8r_2QV4NGTfVK24x7SmiP1sVz7T55oN2gQMVlIakGrTjtxeYb2hBHWhLP5JEx_gJIT6Dqtg

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 04:02:00 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-790-g2a3fdc2#rel-ec2-master i-0e3fa82937dfe784e@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OE1udXp0SHMxUU9meU41&google_gid=CAESELIniKk_HT01JP-R2bqB37A&google_cver=1&google_push=AXcoOmTQdK0uSDDcp7G5i0RntrE8uEz8r_2QV4NGTfVK24x7SmiP1sVz7T55oN2gQMVlIakGrTjtxeYb2hBHWhLP5JEx_gJIT6Dqtg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 52FB
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEEBfh-WPPnfypaYqvA_5-A8&google_cver=1&google_push=AXcoOmQn4kejYF_BcDgwUrX3az_xheRZquB79TeeurUJiaBaWQ_ZZK_obxJre_8ou-xvCbxoNrbOlAcPS0ygU45k...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmQn4kejYF_BcDgwUrX3az_xheRZquB79TeeurUJiaBaWQ_ZZK_obxJre_8ou-xvCbxoNrbOlAcPS0ygU45kfJXGXibfrWc

170 B
188 B

52ms
51ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmQn4kejYF_BcDgwUrX3az_xheRZquB79TeeurUJiaBaWQ_ZZK_obxJre_8ou-xvCbxoNrbOlAcPS0ygU45kfJXGXibfrWc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 05 Oct 2023 04:02:01 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=RQIgC_0sTk8leyw7fsI3FA&google_push=AXcoOmQn4kejYF_BcDgwUrX3az_xheRZquB79TeeurUJiaBaWQ_ZZK_obxJre_8ou-xvCbxoNrbOlAcPS0ygU45kfJXGXibfrWc
x-host: tde-deliveryengine-production-8b9d7bc7f-zrjqw
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 52FB
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEKHixlrUnZHZOwx8jADz54E&google_cver=1&google_push=AXcoOmSDzK1CDRJFuhslENn98X3JSpJ_UCGDF2cWLUa3r2SNmPLy8KZsF6KWsyWPyIUbPbNYIypho_CCwB11G...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSDzK1CDRJFuhslENn98X3JSpJ_UCGDF2cWLUa3r2SNmPLy8KZsF6KWsyWPyIUbPbNYIypho_CCwB11GU_bzEKrPHRRYmtsQQ&google_hm=aGRrMkJldHJRU09yNl...

170 B
188 B

66ms
66ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSDzK1CDRJFuhslENn98X3JSpJ_UCGDF2cWLUa3r2SNmPLy8KZsF6KWsyWPyIUbPbNYIypho_CCwB11GU_bzEKrPHRRYmtsQQ&google_hm=aGRrMkJldHJRU09yNlJRbFI0ZXU=

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 05 Oct 2023 04:02:01 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmSDzK1CDRJFuhslENn98X3JSpJ_UCGDF2cWLUa3r2SNmPLy8KZsF6KWsyWPyIUbPbNYIypho_CCwB11GU_bzEKrPHRRYmtsQQ&google_hm=aGRrMkJldHJRU09yNlJRbFI0ZXU=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 238
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 52FB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEItJ-up3Ou_SW5t0J9iVce0&google_cver=1&google_push=AXcoOmTSeaxFEOGGIVb6ik4esfosoXR0pf4NBRuRY2CoKN4Kslq8WFDLrnQe3PzokKkTgXTuxqNs6LYtVs9iOgQ...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmTSeaxFEOGGIVb6ik4esfosoXR0pf4NBRuRY2CoKN4Kslq8WFDLrnQe3PzokKkTgXTuxqNs6LYtVs9iOgQ6d3a...

170 B
188 B

66ms
66ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmTSeaxFEOGGIVb6ik4esfosoXR0pf4NBRuRY2CoKN4Kslq8WFDLrnQe3PzokKkTgXTuxqNs6LYtVs9iOgQ6d3a-WCgiFa1yTQ

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=e_FHHEVkRMZly_dYOsVBaw&google_push=AXcoOmTSeaxFEOGGIVb6ik4esfosoXR0pf4NBRuRY2CoKN4Kslq8WFDLrnQe3PzokKkTgXTuxqNs6LYtVs9iOgQ6d3a-WCgiFa1yTQ
Date: Thu, 05 Oct 2023 04:02:01 GMT
Connection: keep-alive
Content-Length: 239
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 52FB
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEH1CPTq1j7MgDLpj3yCoTfA&google_cver=1&google_push=AXcoOmQ15bkORKS46DZLz4rQMD83fK7Ni0ocsYNTvNvv_vtwMEXNI52q9nW_KpWuV6ZCbI4o5lsopv11WKGz...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_5rgZfbu0ISkxgRa_LrQ-kGyNLMVJsQ&google_push=AXcoOmQ15bkORKS46DZLz4rQMD83fK7Ni0ocsYNTvNvv_vtwMEXNI52q9nW_KpWuV6ZCbI4o5lsopv11WK...

170 B
188 B

55ms
54ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_5rgZfbu0ISkxgRa_LrQ-kGyNLMVJsQ&google_push=AXcoOmQ15bkORKS46DZLz4rQMD83fK7Ni0ocsYNTvNvv_vtwMEXNI52q9nW_KpWuV6ZCbI4o5lsopv11WKGzXv1xO8asPNb6_BA9Gg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABiv3_5rgZfbu0ISkxgRa_LrQ-kGyNLMVJsQ&google_push=AXcoOmQ15bkORKS46DZLz4rQMD83fK7Ni0ocsYNTvNvv_vtwMEXNI52q9nW_KpWuV6ZCbI4o5lsopv11WKGzXv1xO8asPNb6_BA9Gg
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame 52FB
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEDAX6GcoERUtZ-rw7BCUB9k?ext-param=AXcoOmT4vvgllJV8eROMXJI7kLIvrGOa2viUvpGSpaYACm-5czLLJ44_snw7dwRHfBJaVCu0oJOfUPP1B9FNs1tjrogJ-oCd62xt0Cs&partner-tag=yandex_a...
https://an.yandex.ru/mapuid/google/CAESEDAX6GcoERUtZ-rw7BCUB9k?redir-setuniq=1&ext-param=AXcoOmT4vvgllJV8eROMXJI7kLIvrGOa2viUvpGSpaYACm-5czLLJ44_snw7dwRHfBJaVCu0oJOfUPP1B9FNs1tjrogJ-oCd62xt0Cs&part...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEDAX6GcoERUtZ-rw7BCUB9k&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
144 B

244ms
242ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Protocol

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Thu, 19 Sep 2024 04:02:01 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 52FB 0
12 B 56ms
55ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KNGGv_b6dPPTKtYnPrPr7Qiy9gJys8TO06PHlOw5NnVLlzNJRKZeEek1pbM0xZYGUJKgu7AQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8709 42 B
174 B 89ms
89ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvT9gL9N8814XU9dYMTpvgWJyDMiJYfa3V0v3lpv14XOgqb7NUKwX7eb85yXY0Wt5j6jF9X_104Q46-uN0NqFmasMJN3tT-EzZNAlQ2hASK1WQ2e4sweK2hMmMs5vAJ5vTpxxbJLEq1SQ&sai=AMfl-YQTCyxbyJEmpz_XuWr2Ed5lDNkm8JwtNRI5I2ek8IPUYIioecOZRi1o2NxksCl7GVWrYDvx1aaHMj1BVPfYx6kE09qlP_7z_rVvSV9vSaaz8k35DXQh6ZKaoxI&sig=Cg0ArKJSzPFFe4cD87YeEAE&cid=CAQSOwDICaaNPMd800iwL_jWHdxregMuf-FBFgPUoTkb5hOBd10ZCdHRUlOWe11uspzjvoILcPUzVX6wbVKdGAE&id=lidar2&mcvt=1001&p=0,0,280,1200&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231004&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=994406813&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1696478517905&rpt=2080&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK mraid.js Show response
dco-assets.everestads.net/ics-campaign/static/dco/ Frame F381 0
390 B 45ms
45ms Script
text/javascript 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dco-assets.everestads.net/ics-campaign/static/dco/mraid.js
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign/static/dco/html5-ad-script_v4.html?data=ZR41OAAAHMp37Qe6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign/static/dco/html5-ad-script_v4.html?data=ZR41OAAAHMp37Qe6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:01 GMT
Last-Modified: Wed, 06 Jul 2022 12:21:20 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "150315371-0-5e32201ac1000"
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0
Expires: Thu, 05 Oct 2023 05:02:01 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 26ED 0
0 91ms
90ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuaJHUNCnVWem_K2YI2cUE-yKfmaBfA5RAsCYcgwTTgUAcheAOggLO07rIsyKaOoh4jLl41atHRr6MQfQKn-V1u6ik3qtNm8gcQofQCNH-71sdgOnQpsHgXTnkfG3qjxQ34qxU4vEo-eM3iQ0p9xJRTz5FlBjOAc9Zc7jhYmy48CktGAoA&sai=AMfl-YRIG0excVH2CqSCeTNg32bW_dZWh0Z89q-VqR1De43b45QYiWCBecSSyqOeaaM2HKjsA-GgUKz8E60IIIHZWxR11zZNpM-mQqXXYDZdvPXg3oVO0LI3RGkJ1dBCvEA&sig=Cg0ArKJSzE-nd0DKBSyoEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1028&vt=11&dtpt=1026&dett=4&cstd=0&cisv=r20231003.96388&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 page.php Show response
www.facebook.com/v3.2/plugins/ Frame 62E9 45 KB
17 KB 236ms
236ms Document
text/html 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=973a4220a2e08ffe5d4f8371a6486ddd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

01022cdc1a0b2e19a3f6d1bb2fe847479d9a9e4df3207b69ac36f57aac4c53d1

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:02:01 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version: v12.0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: zqyf4cVmuAWAGHERBbDO2o4yYuoXh7RRudaU+15WsLNWRMRBxeiJoCerj6Clcw1lSuEBOJy5PFG8mk+HJgYiVA==
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 77ms
77ms XHR
application/json 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231003&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

259f913ca078aa8ba859bfa03778762875f1f96254b121c4b84aa7c6ff6ed73f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12052
x-xss-protection: 0

GET
H2 200 asyncspc.php Show response
ads.dotcomadvert.com/ads/www/delivery/ 132 B
555 B 79ms
79ms XHR
application/json 5.9.5.184
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.dotcomadvert.com/ads/www/delivery/asyncspc.php?zones=1&prefix=revive-0-&loc=https%3A%2F%2Fwww.bulgarian-offers.com%2F

Requested by

Host: ads.dotcomadvert.com
URL: https://ads.dotcomadvert.com/ads/www/delivery/asyncjs.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

5.9.5.184 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.5-9-5-184.clients.your-server.de

Software

nginx/1.20.1 / PHP/8.1.16

Resource Hash

64c73faba3c8e17b28ad23a81a275658afee4290323a0b524901b599c0d1e33c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:01:59 GMT
x-content-type-options: nosniff
server: nginx/1.20.1
x-powered-by: PHP/8.1.16
x-frame-options: SAMEORIGIN
p3p: CP="CUR ADM OUR NOR STA NID"
content-type: application/json
access-control-allow-origin: https://www.bulgarian-offers.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: 0

GET
H/1.1 200
OK 728x90.html Show response
dco-assets.everestads.net/ics-campaign//5031/t/8980/13/ Frame 1A36 14 KB
4 KB 44ms
44ms Document
text/html 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign/static/dco/html5-ad-script_v4.html?data=ZR41OAAAHMp37Qe6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 91ea9d151e7ab252501a473e052b27bf88d2096dc8cff8a0e298cffd710c31f4

Request headers

Referer: https://dco-assets.everestads.net/ics-campaign/static/dco/html5-ad-script_v4.html?data=ZR41OAAAHMp37Qe6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 3926
Content-Type: text/html; charset=UTF-8
Date: Thu, 05 Oct 2023 04:02:01 GMT
ETag: "1a9258bdd-395d-60561f72aae40"
Expires: Thu, 05 Oct 2023 05:02:01 GMT
Last-Modified: Fri, 15 Sep 2023 08:56:17 GMT
Server: Apache
Vary: Accept-Encoding
X-Permitted-Cross-Domain-Policies: all

GET
H/1.1 200
OK style.min.css
dco-assets.everestads.net/ics-campaign//5031/t/8980/13/css/ Frame 1A36 4 KB
5 KB 58ms
58ms Stylesheet
text/css 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/css/style.min.css
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2bd128170f24b963f67f17e2a1312ae8371c44c3ecad64cedde585555f4d55ef

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:01 GMT
Last-Modified: Fri, 15 Sep 2023 08:56:17 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "1a90bd26e-11d1-60561f72aae40"
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4561
Expires: Thu, 05 Oct 2023 05:02:01 GMT

GET
H2 200 AMOLibrary.js Show response
ads.everesttech.net/ads/static/local/ Frame 1A36 5 KB
6 KB 151ms
150ms Script
application/javascript 44.216.83.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.everesttech.net/ads/static/local/AMOLibrary.js
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.216.83.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-83-210.compute-1.amazonaws.com
Software: AMO-jAds/1.1 /
Resource Hash: e66ad7a792dcaa684917803058147d54e110728a7cef76562e5bc5ca1388339e

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: cache
date: Thu, 05 Oct 2023 04:02:01 GMT
last-modified: Wed, 22 Dec 2021 09:29:42 GMT
server: AMO-jAds/1.1
etag: W/"5582-1640165382000"
content-type: application/javascript
cache-control: cache,store,max-age=86400
accept-ranges: bytes
content-length: 5582

GET
H2 200 gsap.min.js Show response
cdn.jsdelivr.net/npm/gsap@3.0.1/dist/ Frame 1A36 54 KB
23 KB 542ms
116ms Script
application/javascript 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/gsap@3.0.1/dist/gsap.min.js

Requested by

Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8154aa9057e3367d9d3e4bb1f85db9645c01fc0690091aadc57dbae849ba3499

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1933688
x-jsd-version: 3.0.1
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230095-FRA, cache-jnb7023-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"d8fc-fe8VvabeDqL+WzK+waTDAMtuAsE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qcJWBNuoQfTpkREU6bTUCndvoY%2B5yQG5cOrmzmwLP2cy7akoss5r8aM994Msp%2Fkx%2Bj5KcbxgF4G8qzugn12dyMH46NjmtiV%2BNFa21Ywmb0zFJxTfLFZ%2FWDAZnc5YnGnJ8Ms%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 8112c4482eed2397-ZRH

GET
H/1.1 200
OK script.min.js Show response
dco-assets.everestads.net/ics-campaign//5031/t/8980/13/js/ Frame 1A36 7 KB
8 KB 119ms
60ms Script
text/javascript 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/js/script.min.js
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6ed03c02eec456fe89e228d6cdf45bf7088aa9402beaab5a2a1214a1aa35ce3c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:01 GMT
Last-Modified: Fri, 15 Sep 2023 08:56:17 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "1a95254fe-1cef-60561f72aae40"
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7407
Expires: Thu, 05 Oct 2023 05:02:01 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 87ms
87ms Script
text/javascript 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202309291101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 05 Oct 2023 04:02:01 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BD5B 13 KB
5 KB 61ms
59ms Document
text/html 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f1.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

accept-ranges: bytes
age: 41811
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 04 Oct 2023 16:25:10 GMT
expires: Thu, 03 Oct 2024 16:25:10 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 3612 829 B
982 B 75ms
74ms Document
text/html 142.250.186.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f4.1e100.net

Software

GSE /

Resource Hash

5686573b84e593087df88d51f2986ae2e2b74e4c0faf7939dfd4f362ae07da11

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kkRc2hpaIrByBjKw3mbhiw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bulgarian-offers.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-kkRc2hpaIrByBjKw3mbhiw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 05 Oct 2023 04:02:01 GMT
expires: Thu, 05 Oct 2023 04:02:01 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2BC6 42 B
108 B 95ms
95ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst03e-VBi7sDk2PsIZHGfMhmfJD_7FfnRYim3DL6AP3zVl65IytrW2z6qDqAK-Pg1cu5Dlb8qLsfZW_qApzUi1OS6PMYis_9MF1D1A&sig=Cg0ArKJSzH8Tm10AqKr4EAE&id=lidar2&mcvt=1000&p=0,0,600,120&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231004&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1696478518789&rpt=458&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame FAA4 0
127 B 70ms
69ms Ping
text/plain 178.250.1.25
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.25 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 05 Oct 2023 04:02:01 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 G-1IRRew8dx.css
static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/ Frame 62E9 21 KB
6 KB 89ms
87ms Stylesheet
text/css 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/G-1IRRew8dx.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

74d9b3dfc8c5f44db0dc49d54f1e3d905a131bc5f8d7e8d3c5b68cfb37c21410

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 0vzlq1it/jKtUPZjyH0ahA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5572
x-fb-debug: 6NuPFt9H20JGF6Rb4EjftBlNJj3xj8WTiwkqxdvI8QDN6y9PUKUzHfRFbwJI+AyfSE8Q5T6AGUqBdt84GCnpEg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 14:48:54 GMT

GET
H2 200 RBH7b7zeA6F.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yx/r/ Frame 62E9 317 KB
85 KB 118ms
115ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

fb09f381a7fd67f63466a1907cd29deca884217da40a7611da3db93cb49b6daa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: GV4dq3F6xNAvtSDystA10Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86391
x-fb-debug: qFA69kvoAgz2y9rvvN25EwILqt06Sfsdux+6NIamaOHUtad+X9s8KnkRp8dKm4aKILO0rnT4OAI3O4ZLqhXNCQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 18:26:20 GMT

GET
H2 200 hE7AGUevGQ0.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yG/r/ Frame 62E9 7 KB
2 KB 89ms
87ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yG/r/hE7AGUevGQ0.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

810ca9b560f154784c1f1ba5851fd7f727c272d55c2522a3e8d1c627d6881b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: TgV2gECEtJtr2Yof5YcksQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2209
x-fb-debug: IvnDkNI5jIn+oXNhPnRy5DMePwuHDgNuJJyKDnVEJQkiCitJrNIw7C7K8FKLgMEa/vOaYiVlWyMi+GWBUh0boQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 28 Sep 2024 17:50:52 GMT

GET
H2 200 9scU3tR13V5.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y7/r/ Frame 62E9 95 KB
27 KB 89ms
87ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y7/r/9scU3tR13V5.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

731be4de7f0aa9ffd16a422e7a5437f22aa9a54a4be322c661b374ddfdcea24c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: IIw83In/MyfavmBlXzN8jg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27728
x-fb-debug: zQmGGphnPwfcV741i8qyxKcS/Gv+0NDZyICFhwz2yHORbeRKCfL9AASKSc+K8MydcZeXmIDlv/0Mxc2R1Vgc/w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Wed, 02 Oct 2024 05:29:08 GMT

GET
H2 200 W4_BvyDmvhJ.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yJ/r/ Frame 62E9 50 KB
14 KB 100ms
98ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yJ/r/W4_BvyDmvhJ.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

6df0c4c67913ac25fa9e01d7a7dfd29a73dbc7e59b4642ad8eafc52b700f444c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: BymUWkdR8wJ95C8Tnn47DA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 14127
x-fb-debug: i+3/q0p09Ks9TeY1fVVaGq5Z/t+YcNKByxxOh+rUvPWejsVWaG++D+/89JQYa9e6Gz6xY4SytsezNioNBqzbAA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Wed, 02 Oct 2024 22:18:22 GMT

GET
H2 200 boyaF0f8rq_.js Show response
static.xx.fbcdn.net/rsrc.php/v3iLl54/yO/l/en_US/ Frame 62E9 233 KB
65 KB 99ms
98ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iLl54/yO/l/en_US/boyaF0f8rq_.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

80a307d2e9ccd6b085ec008df10a1a406ee968bf82ef5f7fb01862fea5d8945a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: laYjgcbrAmtL7nf5rYY2hg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 66827
x-fb-debug: Hmv9WPG4cp1EfbQyAd1kbeRtRmHGJ4SQZabmXfx6qnltk/7xrhzqbZ/vJL7jLuWA0HmyJwDSO0YdOEpCerGeLQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 20:56:01 GMT

GET
H2 200 p55HfXW__mM.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yF/r/ Frame 62E9 507 B
488 B 117ms
116ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/p55HfXW__mM.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

9e57fedb96b3686621bccd5521f43a2037a823c74f062176952890b179b3955b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: L5E9gSgR735vyjAzTFly4g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 293
x-fb-debug: q2TEyZGR8+zHKHt3G/ng3H8hSB4fBhNpVKoTym98VTplsJrlwVEBRoYK+qumffIljLk7gFzPHROCZ4FoKnA7Dg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 04 Oct 2024 01:57:20 GMT

GET
H2 200 -zelArf0zwm.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yB/l/en_US/ Frame 62E9 102 KB
29 KB 116ms
115ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yB/l/en_US/-zelArf0zwm.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

543ad425d0e52ebe544ededc7478f95837a4265b9d0caaad5bc232d1a02dbc09

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 8C8bbUMnH+KOK3zdN8mloA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 29951
x-fb-debug: 6wdorjvGHB85wOnIQlSKEmMue1oDm9B86ng0akeDcDHF7yqEeMnW7xxo5gSYynHm12yUj1ifuh9sgaSPY+7+iA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 20:52:43 GMT

GET
H2 200 301011291_545315644060098_8698705367140719146_n.jpg
scontent.xx.fbcdn.net/v/t39.30808-1/ Frame 62E9 2 KB
2 KB 46ms
45ms Image
image/jpeg 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/v/t39.30808-1/301011291_545315644060098_8698705367140719146_n.jpg?stp=c3.0.50.50a_cp0_dst-jpg_p50x50&_nc_cat=108&ccb=1-7&_nc_sid=5fac6f&_nc_ohc=bPYmj_JdeecAX9CQ7CW&_nc_ht=scontent.xx&edm=ACzrp0UEAAAA&oh=00_AfCrvkq4176i5EAG7RVYtNKnSBjo568Fq0B_Qwzc7lWw1Q&oe=65240064
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-01-fra5.fbcdn.net
Software: /
Resource Hash: a224e0b93e46d11289744d1462fd3bf979e37ce4b6e267a2cdd0d89962c9aac2

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Wed, 24 Aug 2022 13:22:16 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3480657543
thrift_fmhk: GBCJ/XHJSfXCzNS6yfWu9msyFfDr4Z0EAA==
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 361806413
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 1898

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3612 0
0 106ms
105ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231003&jk=1812058741298236&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 YeTNF82ErcXtSc42GSWrie2SEIEL8DxR64dbf1nZkSc.js Show response
pagead2.googlesyndication.com/bg/ Frame BD5B 37 KB
14 KB 64ms
64ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YeTNF82ErcXtSc42GSWrie2SEIEL8DxR64dbf1nZkSc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

61e4cd17cd84adc5ed49ce361925ab89ed9210810bf03c51eb875b7f59d99127

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Oct 2023 04:26:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 171307
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14663
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 02 Oct 2024 04:26:54 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 26ED 43 B
215 B 148ms
148ms Image
image/gif 23.20.73.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1525570&asId=69b6d4fb-7909-f599-d9a2-7f1e732bb80a&tv=%7Bc:q8TCNe,time:2111,type:e,im:%7Bpci:%7Btdr:2011%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:2111,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:35,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B2101~0%5D,as:%5B2100~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:396,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:37,sis:676%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.73.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-73-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
server: nginx
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 UXtr_j2Fwe-.png
static.xx.fbcdn.net/rsrc.php/v3/yw/r/ Frame 62E9 573 B
810 B 405ms
98ms Image
image/png 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yw/r/UXtr_j2Fwe-.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/G-1IRRew8dx.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/G-1IRRew8dx.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
x-content-type-options: nosniff
content-md5: 07aG/2AEtDHVAZ5LUajMDQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 573
x-fb-debug: I7wrPO1o7j88hPvdkW3o6oqfgSe62qs6xRrC2nZ1qVLMHQ6N8fL1wE8cnsAMg6nfxh0/USuAWsir0Oce3wSfTw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
x-fb-optimizer: 0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sun, 29 Sep 2024 02:23:51 GMT

GET
H2 200 / Show response
www.facebook.com/platform/plugin/tab/renderer/ Frame 62E9 182 KB
35 KB 698ms
698ms XHR
application/x-javascript 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22776730922422337%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F%22%2C%22width%22%3A420%2C%22height%22%3A500%2C%22has_cta%22%3Afalse%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Afalse%2C%22has_cover%22%3Afalse%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Fwww.bulgarian-offers.com%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=19635.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=EXCELLENT&__rev=1009050604&__s=%3A%3Acxpzeo&__hsi=7286319767917784589&__dyn=7wKxa13wt8K2WmhwRwqo98nwgU6C7UW3q320-E7W0TUhwem0nCq1ewcG0KE4C1Vwooa81VohwnU1oU1O81u83mwaS0zE5W0PU1AE17U2ZwrU19E36w&__csr=&locale=en_US&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yB/l/en_US/-zelArf0zwm.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

20963f8348fada16d52d1c802ca10fa00e363fb0c793532638033335fe870a09

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: MOgVRGp6wz1pW2ONwJFlJf
Referer: https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420
X-ASBD-ID: 129477
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 04:02:02 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
pragma: no-cache
x-fb-debug: O9R8F3kOLZ/XBP3N/vK8YWr2HM7uJVsUQ7IsaVg0KlF9AxTYrrD02vuKjsvXHm3LjdECUuMKIbIXny7HCs7vuw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: private, no-cache, no-store, must-revalidate
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 / Show response
www.facebook.com/platform/plugin/page/logging/ Frame 62E9 62 B
352 B 110ms
109ms XHR
application/x-javascript 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/page/logging/

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yB/l/en_US/-zelArf0zwm.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

28d3b6866c6acc045eaa1e74e08c603add7aefd9f6c2c8ebeb275e4e9f0dcd25

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: MOgVRGp6wz1pW2ONwJFlJf
Referer: https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420
X-ASBD-ID: 129477
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 04:02:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
pragma: no-cache
x-fb-debug: 0rZng64lyawmmHXIm+zdfdWu2YVdFgh+R5KAbVff/dXhOuLwTEwZs8OYcKW79fyx1pvYZNpKo8IUPgf9a4IWDA==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
access-control-allow-methods: OPTIONS
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
vary: Origin, Accept-Encoding
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 xgVgalBG80z.png
static.xx.fbcdn.net/rsrc.php/v3/yH/r/ Frame 62E9 1 KB
1 KB 486ms
185ms Image
image/png 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yH/r/xgVgalBG80z.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/G-1IRRew8dx.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

45444d590a67d30e8b2fde01bb6482f829383b64bf14a4b19b86e22fdc319fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/G-1IRRew8dx.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: Qj1Xy/ROmACa+3NOZTCvZGkdgrW0HROoXkrV9aLDaLmdRkg5ixmlAnqYyo7Av2+4F4jqmCjqkzLR18rnLUP30w==
date: Thu, 05 Oct 2023 04:02:01 GMT
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: rB4cTW8WNZcBsFntToJGtA==
document-policy: force-load-at-top
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 1315
expires: Sat, 28 Sep 2024 05:24:55 GMT

GET
H2 204 generate_204
tpc.googlesyndication.com/ Frame BD5B 0
41 B 76ms
76ms Image
text/plain 172.217.16.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?UvHN0Q
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.16.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s08-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:01 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK SegoePro-Semibold.woff
dco-assets.everestads.net/ics-campaign//5031/t/8980/13/fonts/ Frame 1A36 29 KB
30 KB 87ms
86ms Font
application/octet-stream 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/fonts/SegoePro-Semibold.woff
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: dba5db65eacdd32e82b077fce0282798e8a702ecbead9b1a1afc305c2fdba33c

Request headers

Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
Origin: https://dco-assets.everestads.net
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:01 GMT
Last-Modified: Fri, 15 Sep 2023 08:56:17 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "1a9258bdf-74a0-60561f72aae40"
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29856
Expires: Thu, 05 Oct 2023 05:02:01 GMT

GET
H/1.1 200
OK e51232cf9fc8dd7b4756cbe34f3be9cc.png
dco-assets.everestads.net/iCornerStore/rescaled-images/MICROSOFTSTORE/current/ Frame 1A36 110 B
497 B 110ms
107ms Image
image/png 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dco-assets.everestads.net/iCornerStore/rescaled-images/MICROSOFTSTORE/current/e51232cf9fc8dd7b4756cbe34f3be9cc.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6f064b11007507ecebb88b25c6b21a41e51189b079c5a30342c8dc8950019c0c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:01 GMT
Last-Modified: Wed, 04 Oct 2023 14:41:11 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "106564822-6e-606e4ffa411a0"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 110
Expires: Thu, 05 Oct 2023 05:02:01 GMT

GET
H/1.1 200
OK 4467c2509a13ff90c4ecc85f51cf25c9.png
dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/ Frame 1A36 29 KB
29 KB 132ms
129ms Image
image/png 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/4467c2509a13ff90c4ecc85f51cf25c9.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0e32bad91acf2148e31322e78858dbc5701dde6127b2d42aaef3bfd0ed323e4f

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:01 GMT
Last-Modified: Wed, 04 Oct 2023 14:42:01 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "13d8cdaf1-7395-606e502990119"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29589
Expires: Thu, 05 Oct 2023 05:02:01 GMT

GET
H/1.1 200
OK f71b18ba3153b509865445c7b4706219.png
dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/ Frame 1A36 2 KB
2 KB 278ms
168ms Image
image/png 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/f71b18ba3153b509865445c7b4706219.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 48058c7cae6c0edd1606307d30e0bfec5267501b07d1b1a664644c7e30121911

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:01 GMT
Last-Modified: Wed, 04 Oct 2023 14:41:53 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "10573e103-758-606e50224efac"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1880
Expires: Thu, 05 Oct 2023 05:02:01 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 26ED 42 B
108 B 165ms
165ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsszUh-H-ujqkI1njrGiV4qcsaE2Y6UjQaOhqn7SGdtes34ED7UDAgrtzaUEtqhhokvIM9EWSdhXAFWTRJvbMF7yBKKnwfBvZIxW9XcE5mm3nFAnQg5SUtavbd0HbHEV_hgkrfuVUiNOBA&sai=AMfl-YS5Q4m4MaopHEGDHwkVuK9sMG9a4OLmZFiqra8u5XP0xHYRAqb08-vhePibYgvxZCE8b4t5qcp-jE4HkA5NU6YOxsXdJ3KEARQSjanw1QttfuqjOXVvB5guxhd7&sig=Cg0ArKJSzCHaxaAajJXNEAE&cid=CAQSPADICaaNGfsemmzsKHGwLMO3ozMCNNSbhi7i5F0r7qBonzmRt3pWv9cFkZqWo92QH1TldiFC6kVFea4OWxgB&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231004&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1696478518841&rpt=2054&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 26ED 0
56 B 102ms
101ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7779868439300&version=m202309260101&ct=76&x=1&cor=12292698654596665000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 4467c2509a13ff90c4ecc85f51cf25c9.png
dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/ Frame 1A36 29 KB
29 KB 90ms
89ms Image
image/png 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/4467c2509a13ff90c4ecc85f51cf25c9.png
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/js/script.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0e32bad91acf2148e31322e78858dbc5701dde6127b2d42aaef3bfd0ed323e4f

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:02 GMT
Last-Modified: Wed, 04 Oct 2023 14:42:01 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "13d8cdaf1-7395-606e502990119"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29589
Expires: Thu, 05 Oct 2023 05:02:02 GMT

GET
H/1.1 200
OK f71b18ba3153b509865445c7b4706219.png
dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/ Frame 1A36 2 KB
2 KB 89ms
88ms Image
image/png 23.32.185.206
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dco-assets.everestads.net/iCornerStore/source-images/MICROSOFTSTORE/current/f71b18ba3153b509865445c7b4706219.png
Requested by: Host: dco-assets.everestads.net
URL: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/js/script.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.32.185.206 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-185-206.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 48058c7cae6c0edd1606307d30e0bfec5267501b07d1b1a664644c7e30121911

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/ics-campaign//5031/t/8980/13/728x90.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 05 Oct 2023 04:02:02 GMT
Last-Modified: Wed, 04 Oct 2023 14:41:53 GMT
Server: Apache
X-Permitted-Cross-Domain-Policies: all
ETag: "10573e103-758-606e50224efac"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1880
Expires: Thu, 05 Oct 2023 05:02:02 GMT

GET
H2 204 imp
analyticspixel.microsoft.com/aid/ Frame 1A36 0
590 B 296ms
107ms Image
text/plain 204.79.197.204
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://analyticspixel.microsoft.com/aid/imp?dcoimpid=ZR41OAAAHMp37Qe6&dcmadvertiserid|8391437$dcmcampaignid|30152505$dcmadid|560486750$dcmrenderingid|168672506$dcmsiteid|6958819$dcmplacementid|369314977$customer|Microsoft$dv360auctionid|ct=CH
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 204.79.197.204 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS: a-0005.a-msedge.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://dco-assets.everestads.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:01 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 41DD0B11A00A4F62BE971162FE0C7E27 Ref B: GVA30EDGE0116 Ref C: 2023-10-05T04:02:02Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 114ms
113ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231003&jk=1812058741298236&bg=!ubqluvXNAAbjlzx0w5c7ADQBe5WfOM__r0HMVbl-PwdX5xX9ZN_hlzsiZkc59nnqLEIBIED7ZnAUm-KH0mrIzNEYd2EeAgAAALdSAAAABWgBB5kCu_Rj0MCnBeuUazNf8BYyCBoabZGlS6lY_whndVTafaBgKibdWMNKhi-rnZYrH0C18fRjpX36IfUrFvb1Tao_h_zxcXnkBkoeWjmeZq5qrKZu-4NQ6hTsQjW0AA8lH91icFgAeNM-gvsDokKe_CiKRKUjlRgb6ZZFQUGeYLTDPYFdYLYGwL9s6AGZxQ2X3LKsGfCDeURbZVofsNA43COCHZIuM1ahXihQiA8DGuIDwVqs9lUVDZfG0fJc6P5sq0rye2dF0fNH2xg-zh1MpukBrc5e2XAJw8PN2VrV6rlVhyObGWHx3GMMg3RMk2vSniIn2YwZ7SRXUm6M9LnwHSflCVuRbvYelOeuQXFIXWx5E-dZObQtjnkLaxkhTtYZLS57BQYG3PLAZEknu7mNF8iLtLkfVQOIlf8L1-I5XNicWqfUfmthmkZ9Dumnx6_AfWqY_Xuw6HFzd4ZsIi-XfVkwfEoAunhsdtYP_cQJBeBBmXWRDe-BfdpzqpcXnj-0shj8KCvqxLoj-XkLXjMRTRu79wq0mIk85xb3X_GosloXpN_21dEs-reCteSsOhqKOYJ2-9X5xIZqjnkUOSdorHWLympUqXgD2T83a2mdOyv3YZ0Zgj7jgGcOJkpYPf1lraOVDMiCk2giYW90FMbtZFoeLsNpMuRyYDVAshlqLdXC2qUgBSmM_xQs6hkV8Vih_bvIvGu0z8cc7tJW2mvdV3uwZkO85fkAZfbn_Zb4PBRlpYUjBBlGmN--DQvGQFLV3Ex_lfT-P94QjlifUXr-e2xR0yEdpKbR5N7iq_Sm5b7QUB7RFxGioSQW1QYVrj4r3O4WCu5U1OOOHEiJJ8PB_MVtL1eFcg28OqPvY-FUgytgaZTn3KcBXh_0ruB7HCuCVsSt_iahCFgL7P9IMDf_mChoHHyrI5xtnv53ax9U9A
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.bulgarian-offers.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 uLtFSKf35yv.css
static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/ Frame 62E9 21 KB
5 KB 71ms
68ms Stylesheet
text/css 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/uLtFSKf35yv.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

f0420f366a8220046ff34ea8b89a49bb225b4b5ac42f995d94195693d2998516

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 1gC5ga/hPcwItIW9O2Ci0Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4711
x-fb-debug: XsKukR1TUO8scIk8g/IFm6Grf5Uvw5sVMu3kc5wGn00tQbJw2etobawZNUWv4ZwZng844jo8EDfEJHY2RhmzIQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Wed, 02 Oct 2024 15:36:24 GMT

GET
H2 200 3lqM6j3VAtP.css
static.xx.fbcdn.net/rsrc.php/v3/yZ/l/0,cross/ Frame 62E9 12 KB
3 KB 72ms
68ms Stylesheet
text/css 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yZ/l/0,cross/3lqM6j3VAtP.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

8fe891ba12a3f008264152d4cfc7b26eaa744c4f6513d25aeafee3c5f74373e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: +RtqwaXPtizZmXe/+9bfPg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3355
x-fb-debug: SYTct+H1n9y63hr0CSLqhx4qynTN0kmae6y6JgT0ZNzXvcTn2sti4gFJamQ6biSE4DuVVN2N9IN+Azh9eWdP9Q==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 14:50:56 GMT

GET
H2 200 0SW2ImPqMvy.css
static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/ Frame 62E9 10 KB
3 KB 86ms
82ms Stylesheet
text/css 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/0SW2ImPqMvy.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

d8997b211c6ba42e14e78e29a6892a222d3539a30a9d80d2e7d964ab6f1249fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: HNPvamkEw5H84rBred3Dig==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2535
x-fb-debug: b8usd6w/nyjsJaZ7wudQ005/Vr4yopJHbgtpJ0VnVJJrf4/73gNfS88bO3PkC/Ky0xpl/mAEa/XjXg811FBA6A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sun, 22 Sep 2024 15:38:26 GMT

GET
H2 200 XsCxmYYui7J.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yC/r/ Frame 62E9 19 KB
7 KB 86ms
83ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yC/r/XsCxmYYui7J.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

d705c583adbdd3f894f85889ec1ee8ad58c6dec025201c81ab0e73a0cce23806

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: E6/9/Pr5yCRV+itNJbAdFA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6532
x-fb-debug: KtX4LTBHVDdCYH/DVbxW8hKj19IXQvxdLwhe/7N74PSP826KPp0weHDQyWUzn5PZgF3NktzJ3aJXOcem0JWT9A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 16:05:03 GMT

GET
DATA 200
OK truncated
/ Frame 62E9 2 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb4a1ce6dfcba35211052403191f739a43aafef3ebab7af5e3866d02da0e60fe

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/css;charset=utf-8

GET
H2 200 fO0J8C6r-Ht.css
static.xx.fbcdn.net/rsrc.php/v3/yI/l/0,cross/ Frame 62E9 36 KB
8 KB 78ms
75ms Stylesheet
text/css 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yI/l/0,cross/fO0J8C6r-Ht.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

1bc8c4e39fffd603a664ad29b0ede06b5bea9e31eedf629be4884730642f3a08

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: nbHVcw0kfy/gvR5TSkqdRA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8307
x-fb-debug: PclENi/l3Nbg8TUYT42oYvegM+WMZf/pqzwvWz80UQgsOUSBZ15dASundEbyrps3lcF8SafIgMqa6aySutZTGw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 20:31:40 GMT

GET
H2 200 dCVL80jFlkJ.css
static.xx.fbcdn.net/rsrc.php/v3/yf/l/0,cross/ Frame 62E9 18 KB
4 KB 70ms
67ms Stylesheet
text/css 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yf/l/0,cross/dCVL80jFlkJ.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

b12978a4a837127afa5f6d720d54d52f7a21d13d1b7d49a74e5eb1cf8ff12830

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: pFC8L7tr6idCuD8KDVjmaA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4305
x-fb-debug: K3hA/jgw4WxtIaw/Oma2b5ebgymymB2mF766+kg5DooVOE+sCJI183OObUUKdRgV8WDCyN0dDBSUOLymWEuLpQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 23:36:46 GMT

GET
H2 200 E78dBvrFp-J.css
static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/ Frame 62E9 37 KB
7 KB 85ms
82ms Stylesheet
text/css 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/E78dBvrFp-J.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

efba2776ce1c31fbe824fe82b567510e9c410127d03973eb52884fb90b56b80d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: CVr+E3TMW5Jze+U6BEDLfg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 7164
x-fb-debug: m+py3AzhcGpi+CuCqCPjKRSlp9oWhzyh+i2STkNgvSzS5ydwFlDE5P5sJ/zhczg/wrP4WJzwqOgHdmar1irmOg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 14:51:18 GMT

GET
H2 200 IXQosj2nhPX.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yq/r/ Frame 62E9 57 KB
15 KB 72ms
69ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/IXQosj2nhPX.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

7fdbfe3513a400f9bda5ff18e1e194283c298d6ddd0ccec8547f59920971db20

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: AaQrKpS7Wt2qjZn96USv2A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 15463
x-fb-debug: TH9oup8Vav2Xx7gihW7j9K2nROgUmkglhI/cKaclNP3oJ3OSEDo7DDjZ8g2xUfhGwV83IFu3DnJX8lvrLOTH0w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 20 Sep 2024 18:10:05 GMT

GET
H2 200 nhZydafZFlv.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yi/r/ Frame 62E9 14 KB
4 KB 72ms
69ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yi/r/nhZydafZFlv.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

d0c750516e363bf1d943ac3a3015c94f08c1e422a3097f8052bb29e57d26c062

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: XL5AMZSp8oPmIq8c1HGPPA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4361
x-fb-debug: gkCMnGO/OMWLaWnz0NbiPbkpWa1ELmPVnNKN1Puu+t4QusynlsAR2daZ+89Pl2tuv+oGDHKYV2iOVZc+/80XCA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sun, 22 Sep 2024 05:52:24 GMT

GET
H2 200 wfuNCkIpYfk.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yz/r/ Frame 62E9 12 KB
4 KB 87ms
84ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/wfuNCkIpYfk.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

c37130a13512e9d39744a70173a65dfc229317c7678d9c5ab6d9c0bc798ebfca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: LskkhqSsyRzC71Rb7npkIA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4124
x-fb-debug: YJUYVHBfw88vs3xi4cO+eGTa5VazHVzNULZL5y0MUjdHbsaqksQtXnPGhyssZ7Nsc5qg97hEGC3qDkCLCQQ85g==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 04 Oct 2024 00:53:22 GMT

GET
H2 200 zuyMT9bw4Hz.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEBX4/yE/l/en_US/ Frame 62E9 23 KB
7 KB 110ms
108ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEBX4/yE/l/en_US/zuyMT9bw4Hz.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

8e767059e2c08dda82f50d2856b495e33b018872ffb8c929f51e74f71a86c50a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 0/5f9qX1gZ5sA8s/HTM8NQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6917
x-fb-debug: ciYjJJwtq/7VJ298gdtbVHOMZKnKVTeBVlaiHSxuLDNDeLZC3AAKR6OnpFklo5t8CuyyEQryuZlIDUdi5c2eDQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Wed, 25 Sep 2024 17:10:24 GMT

GET
H2 200 Zj4GuFghQl4.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yS/r/ Frame 62E9 12 KB
4 KB 111ms
108ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yS/r/Zj4GuFghQl4.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

d8c52fe5bb662564ab7edf0abe01a2202dcc36eaa71ce6a465cd64210c4eb2c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: dBSAisRg2e2k/EbKxbTt7g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3450
x-fb-debug: 9IiBmrVT2mkA1W3faJOt2/pD35etwpBMtcVe3buguku62cVA4KMVx1CBJoQLgEtqEYAQg4iosutSONtxCz8g0w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
x-fb-optimizer: 1
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 27 Sep 2024 16:32:14 GMT

GET
H2 200 hhHzO7n3ZCT.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yM/r/ Frame 62E9 19 KB
4 KB 125ms
123ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yM/r/hhHzO7n3ZCT.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

3fe8e089a270d279ecb69c83dcb71e48f5af86759dd898a5bdd72fefb00272a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: jzNzyMspg5xv0BwfVJHUjg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3682
x-fb-debug: CAwTWQJAgSUbGKxAIg0AQ5HUUs0+4ex2snzmqFtlcju+ZH+5FYJWDcUtQY10H4jdPy4DtjiZfSkREZf5BHsbEA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 18:54:33 GMT

GET
H2 200 fLpJn9funEW.js Show response
static.xx.fbcdn.net/rsrc.php/v3iKw34/yb/l/en_US/ Frame 62E9 80 KB
21 KB 121ms
119ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iKw34/yb/l/en_US/fLpJn9funEW.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

9da2a7beb9cabbccf73938c8ac404aead072094c5ff53449f6cd6f975f42345f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: Ktrmq4XPDkb57lBLrJCkxQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 21249
x-fb-debug: 4mUKIdMj2M/moMiYdYpx3zKqBUPgy4GRYP/L1Jy1b8LxxY09YfhOMMDN7WwepYEJoTEee4p+DgJN0FxGthfbyA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 19:25:19 GMT

GET
H2 200 0VAhCKx4ahO.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yv/r/ Frame 62E9 75 KB
18 KB 111ms
109ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/0VAhCKx4ahO.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

daeeb4718cd41b993de8ee8061b06ab87b26ebf920342eacc526425b1b77a8ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: KcRsBAr07aYgTdLQ2lkwyQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 17991
x-fb-debug: UKzwMomTiUGv6wW7Xah4g5bvCkWqv/rZ3vkE9xcCqwnZwEuQQeC9b2c1PIFUvJtcvTDOWMfmq+d9sJRdIBz7Hw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Wed, 25 Sep 2024 23:09:47 GMT

GET
H2 200 hXAPqRJ0ViT.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y8/r/ Frame 62E9 18 KB
6 KB 121ms
119ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y8/r/hXAPqRJ0ViT.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

dc13aa6a8d7961250441cc9632aa322eff337f92ad5e2a09b983fc698e9e57b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: TpJGoswvJdOj7VGVMSmhrg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6143
x-fb-debug: prSFpYZZiNrTz/7Kc0gfNkb0ToLonAU3Pe5qEoyFdDWGsjJprqvVRUnhl09WwO3Ya/7T2irHJ6wrt47O4yGb+g==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Thu, 03 Oct 2024 20:25:04 GMT

GET
H2 200 ie38mp0O07P.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y9/r/ Frame 62E9 25 KB
10 KB 110ms
109ms Script
application/x-javascript 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y9/r/ie38mp0O07P.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

a87feaf65170ded496c597c1f1011a79c39a309e415802b49a3fea32f32dfdb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: CEYVgZg04j7erS0ub7sNsg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10390
x-fb-debug: ksQnz/ecJxu+NLNQ0YjFaGNgtwXNAQHL3ar9Qr/letiaxDx7ooEczZfU7Qwfsy4EFL3U7gAsydSuO76yyMRF7Q==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 04 Oct 2024 02:00:26 GMT

GET
H2 200 re1hPxQECWj.png
static.xx.fbcdn.net/rsrc.php/v3/yx/r/ Frame 62E9 3 KB
3 KB 59ms
59ms Image
image/png 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/re1hPxQECWj.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/uLtFSKf35yv.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

fcdaa4a9116d5ab88233e3349fea2428f2a4c46b3538900117cef9c8c1d31f0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/uLtFSKf35yv.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: ZjDJFVkavn0ybh4K4iz6cAvyO1rCpgN5SJg36Ov6ZA/zxqiao3MGn8VhAiloSXIST/KLsohN0Mmdt/mUx4N9Tg==
date: Thu, 05 Oct 2023 04:02:02 GMT
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: i7RWZH3OINQHgRs93K4JmQ==
document-policy: force-load-at-top
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 2674
expires: Sun, 29 Sep 2024 02:25:11 GMT

GET
H2 200 THq7eyfQLlo.png
static.xx.fbcdn.net/rsrc.php/v3/yI/r/ Frame 62E9 905 B
1 KB 72ms
71ms Image
image/png 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yI/r/THq7eyfQLlo.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yZ/l/0,cross/3lqM6j3VAtP.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

71f89d61c6c572acbbd76a0a58fecb2f7796ed304f39bee614e0f0d26d570830

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yZ/l/0,cross/3lqM6j3VAtP.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
x-content-type-options: nosniff
content-md5: vJvsU8BhThs/33wc7Fcflg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 905
x-fb-debug: WGY3owjyvfh4qLuJJ2yStS1gbJxoi2pX8XKbEDU12+R8Ooi2raY8IIDtDRl/To1pN2hnP4SrlmDdMmX9b4QSIg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sun, 29 Sep 2024 18:05:53 GMT

GET
H2 200 MKQzjVd1bVq.png
static.xx.fbcdn.net/rsrc.php/v3/yD/r/ Frame 62E9 548 B
738 B 67ms
67ms Image
image/png 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/MKQzjVd1bVq.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/G-1IRRew8dx.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-fra5.fbcdn.net

Software

Resource Hash

83b7d2afe243941c2527b2d875836ad2cb864290690dd1b253389de3f7bc7da4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/G-1IRRew8dx.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
x-content-type-options: nosniff
content-md5: l20F61ct/3QC2rM+eGjRow==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 548
x-fb-debug: TbukeTbaiPoXiwQtFXcWx3dBfp9EgI5hCyBCOJHvzAIIfVJwqeAvo7wSNdtE041519cQKm4wG3JXBcqLlLgL9Q==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
x-fb-optimizer: 0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sat, 28 Sep 2024 02:24:31 GMT

GET
H2 200 / Show response
www.facebook.com/video/autoplay/nux/ Frame 62E9 62 B
191 B 177ms
177ms XHR
application/x-javascript 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/video/autoplay/nux/?fb_dtsg_ag&__user=0&__a=1&__req=3&__hs=19635.BP%3Aplugin_default_pkg.2.0..0.0&dpr=1&__ccg=EXCELLENT&__rev=1009050604&__s=%3A%3Acxpzeo&__hsi=7286319767917784589&__dyn=7xe6HzE4e685KbwKBAodod8d898nwgU6C7UW3eEc87y0wo7W0TUhwem0nCq3q5U3awbG78b87C1xwEw7Bx61vw55xS0sy0ny0RE2Jw8W5U4q0PU1AE17U2ZwrU2pw8O0NE&__csr=&locale=en_US&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yB/l/en_US/-zelArf0zwm.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

f04f46ae8086f41fcf3ff318e8d0f64ef94898d0078cd5548bc3cb89db0bcbbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: MOgVRGp6wz1pW2ONwJFlJf
Referer: https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420
X-ASBD-ID: 129477
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 04:02:02 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
pragma: no-cache
x-fb-debug: fbDRFL90SjNNHIpF16ok2x6kOhmCFk4EZEycGnZwJRVdwXizf3ze6iCDK61PW0po01179jrgwyVE3aAXGGk0VQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: private, no-cache, no-store, must-revalidate
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 301011291_545315644060098_8698705367140719146_n.jpg
scontent.fqls2-1.fna.fbcdn.net/v/t39.30808-1/ Frame 62E9 2 KB
2 KB 627ms
87ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.fqls2-1.fna.fbcdn.net/v/t39.30808-1/301011291_545315644060098_8698705367140719146_n.jpg?stp=c3.0.50.50a_cp0_dst-jpg_p50x50&_nc_cat=108&ccb=1-7&_nc_sid=5fac6f&_nc_ohc=bPYmj_JdeecAX9YOtLC&_nc_ht=scontent.fqls2-1.fna&oh=00_AfBvVlTJpDTR-kgxYFv2YrxEuCJA1d96zpiRVfEzz4pIrg&oe=65240064
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: a224e0b93e46d11289744d1462fd3bf979e37ce4b6e267a2cdd0d89962c9aac2

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Wed, 24 Aug 2022 13:22:16 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3480657543
thrift_fmhk: GBCJ/XHJSfXCzNS6yfWu9msyFfDr4Z0EAA==
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 361806413
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 1898

GET
H2 200 8374982542264743963
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 69 KB
69 KB 564ms
56ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/8374982542264743963?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201915%2F96850.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p600x600_q75&ccb=13-1&oh=06_AbHN1XTpPi9XPFryvvwmhEvzruVxwMn3nGJ7MJ3W5cXSMg&oe=651F9186&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: e99416bc5be5f174bdc8119ad8dceb1294fd4bef4162a4f49cf5d0a70ed4817a

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 21:05:43 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=742847212
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 71030
alt-svc: h3=":443"; ma=86400

GET
H2 200 13825953505191862155
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 11 KB
11 KB 563ms
54ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/13825953505191862155?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201915%2F96851_t.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p246x246_q75&ccb=13-1&oh=06_AbHhuuxb4TEFdtrHrP28Tr-Vd-zwkZFPfpEZyIQsu61HkQ&oe=651FBF8A&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: e73720b2d682d70f1172751324d4ee50339dac145ae5ed56bc7e16098e3a8d19

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 12:45:16 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3717585015
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 10788
alt-svc: h3=":443"; ma=86400

GET
H2 200 6700825999208087040
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 21 KB
21 KB 594ms
85ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/6700825999208087040?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201915%2F96852_t.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p350x350_q75&ccb=13-1&oh=06_AbFeMdxKm9gvOenNaN6e6EtWE1x6xevG2UNJURFNY6c9WA&oe=652023EA&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: e48bb5012144fc3c744b99c13340bbe7b162b8498b53d6e00d076b6c3d8c1c0c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 21:05:43 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3305918782
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 21673
alt-svc: h3=":443"; ma=86400

GET
H2 200 13975828681492469709
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 22 KB
22 KB 593ms
85ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/13975828681492469709?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201915%2F96853_t.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p350x350_q75&ccb=13-1&oh=06_AbHQ4_9lSJOi6N51Q9_5DJA6cZH2mzvO1wRQXrRENtagvw&oe=65201595&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: c4c5bd0778b3e70e51fa4fb3e0bcce6898701d76d2c0e695c800dc96581a4dd8

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 21:05:44 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=1075234443
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 22620
alt-svc: h3=":443"; ma=86400

GET
H2 200 301011291_545315644060098_8698705367140719146_n.jpg
scontent.fqls2-1.fna.fbcdn.net/v/t39.30808-1/ Frame 62E9 10 KB
10 KB 624ms
85ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.fqls2-1.fna.fbcdn.net/v/t39.30808-1/301011291_545315644060098_8698705367140719146_n.jpg?stp=dst-jpg_s200x200&_nc_cat=108&ccb=1-7&_nc_sid=0f0194&_nc_ohc=bPYmj_JdeecAX9YOtLC&_nc_ht=scontent.fqls2-1.fna&oh=00_AfAiLgxj1qrrg-5Qko77rSwv2rKMe0bWg5DHCDF9Xb3Pxw&oe=65240064
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 56a0e9d2f78d07d9f37622c831405255548cf8deee38672638c0bd28f9b39f4e

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Wed, 24 Aug 2022 13:22:16 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=582966866
thrift_fmhk: GBCzaNkcSCEqQ+lGef+tEqe9FfDr4Z0EAA==
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 361806413
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 10381

GET
H2 200 15283413759316214422
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 26 KB
26 KB 587ms
79ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/15283413759316214422?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201909%2F96742.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p450x450_q75&ccb=13-1&oh=06_AbGIHEu2AmR7Nqc7B47_EdmrNXSGf0yJgIA5PzgOYEGBBA&oe=651F8CF5&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 694f3e412b3d64127aa09991af321ca0f14e0f8e3fc851ab0531620bfebc0df7

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 21:05:44 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=2978875841
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 26399
alt-svc: h3=":443"; ma=86400

GET
H2 200 14220292740606641230
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 10 KB
10 KB 593ms
86ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/14220292740606641230?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201909%2F96743_t.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p262x262_q75&ccb=13-1&oh=06_AbEUNWSH9FoCUPrRiZPqqJKt-CEu9O0uj1I7probhAQKiQ&oe=651F9597&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 71fd592694ea6c3b41cc4dda485ad7c95e91d0c2ce585a9ace4e8b208cc85b95

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 21:05:45 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3718657324
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 10194
alt-svc: h3=":443"; ma=86400

GET
H2 200 16580149419072030761
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 9 KB
9 KB 51ms
50ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/16580149419072030761?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201909%2F96744_t.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p262x262_q75&ccb=13-1&oh=06_AbHT0pPQZqWAYX9Icss2R7qapENE2yLPSJLdUVCPyuBgvQ&oe=652005B4&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 471861077265000a19c3cacbc7f36aa6fc0b9cec00c3319e2b5a4df363d3253d

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 13:45:45 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3618597826
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 8788
alt-svc: h3=":443"; ma=86400

GET
H2 200 10384296927912109436
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 12 KB
12 KB 50ms
49ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/10384296927912109436?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201909%2F96745_t.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p262x262_q75&ccb=13-1&oh=06_AbF_YYSDiOkk_jjsFsbDgW7u4Ff3i_eZ_2FbETYatOenhg&oe=652012F6&_nc_sid=b355c6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 4468750d4441e1b89aee289158e9417671591cc889c0f64699e9381101956edb

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Tue, 03 Oct 2023 21:05:45 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=4174020572
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 12456
alt-svc: h3=":443"; ma=86400

GET
H2 200 17702586305850270168
external.fqls2-1.fna.fbcdn.net/emg1/v/t13/ Frame 62E9 29 KB
29 KB 53ms
52ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external.fqls2-1.fna.fbcdn.net/emg1/v/t13/17702586305850270168?url=https%3A%2F%2Fwww.bulgarian-offers.com%2Fproperty_images%2F201908%2F96741.jpg&fb_obo=1&utld=bulgarian-offers.com&stp=c0.5000x0.5000f_dst-emg0_p476x249_q75_u&ccb=13-1&oh=06_AbHr4iJ1W1__FPp7hcuj4VsCtle7LkZZw5qhZ5COT0PCoA&oe=651FC73F&_nc_sid=bde1b5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 99ffbf6a72061ad21abc0efea1f54367e9faa3fae5e6405163c9b41a59366d7c

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
last-modified: Sat, 30 Sep 2023 10:02:56 GMT
x-fb-original-response-code: 200
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3804203873
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
x-fb-original-response-reason: OK
content-length: 30008
alt-svc: h3=":443"; ma=86400

GET
H2 200 53200974_23843166353310061_2766869424446111744_n.jpg
scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/ Frame 62E9 50 KB
51 KB 587ms
50ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/53200974_23843166353310061_2766869424446111744_n.jpg?stp=c188.0.600.600a_cp0_dst-jpg_p600x600_q75_spS444&_nc_cat=104&ccb=1-7&_nc_sid=67cdda&_nc_ohc=-Fiagfm0f08AX-qO0wy&_nc_ht=scontent.fqls2-1.fna&oh=00_AfDUsuV2cTVldr3snnFs1ibFEeSHLtM8rEMMP4F3g9yvnQ&oe=65238E8A
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 7810cff016f3dbd79704d80fec6830633d594a1ad6c9698e250b47493a94eeb0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Tue, 26 Feb 2019 08:23:49 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=2917052056
thrift_fmhk: GBAJBBqVJl5ke9mxEGHBKWLmFfDr4Z0EAA==
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 3829580924
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 51652

GET
H2 200 53398554_23843166353240061_7066740688334880768_n.png
scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/ Frame 62E9 11 KB
11 KB 626ms
88ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/53398554_23843166353240061_7066740688334880768_n.png?stp=c59.0.233.233a_cp0_dst-jpg_q90_spS444&_nc_cat=105&ccb=1-7&_nc_sid=67cdda&_nc_ohc=jjtLAcae6I0AX_bp8RH&_nc_ht=scontent.fqls2-1.fna&oh=00_AfCkxrz78NdqOmgP0wmqJgEd7JijIkNUp3CbaRXMt7QS_Q&oe=65224E57
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 8447feefabd1bf8689871f96916286974e5f0657726fd2bfe98d003d5a53e5d0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Tue, 26 Feb 2019 08:23:49 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=2348964797
thrift_fmhk: GBAMGURTPFwVFS5lX2CntDTSFfDr4Z0EAA==
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 241788693
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 11124

GET
H2 200 53141917_23843166353290061_2104468214795730944_n.png
scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/ Frame 62E9 12 KB
12 KB 472ms
89ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/53141917_23843166353290061_2104468214795730944_n.png?stp=c59.0.233.233a_cp0_dst-jpg_q90_spS444&_nc_cat=101&ccb=1-7&_nc_sid=67cdda&_nc_ohc=wNC2JD6cZDMAX_LlCJz&_nc_ht=scontent.fqls2-1.fna&oh=00_AfDcwrhKBmlk5gur0jryGB6W1ltQXg1UpIPEafxrCs6uSA&oe=6523EEF3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: 252d9e618575a6748d4fda36b70f8c006cc645ec18dbf6b84e0a19e5c7a2eefa

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Tue, 26 Feb 2019 08:23:50 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=4166831485
thrift_fmhk: GBDCALgKOcfmcNQn9tru0ntiFfDr4Z0EAA==
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 443514952
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 12412

GET
H2 200 53356876_23843166353280061_2733206127910060032_n.png
scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/ Frame 62E9 13 KB
13 KB 473ms
90ms Image
image/jpeg 193.135.136.212
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.fqls2-1.fna.fbcdn.net/v/t45.1600-4/53356876_23843166353280061_2733206127910060032_n.png?stp=c59.0.233.233a_cp0_dst-jpg_q90_spS444&_nc_cat=109&ccb=1-7&_nc_sid=67cdda&_nc_ohc=uVvYljfGh0wAX-TUnoN&_nc_ht=scontent.fqls2-1.fna&oh=00_AfAKr-oWmJ9N3cUe3dpGexr9muEPQ3_KjpUGed7DfyePZA&oe=65225C1D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 193.135.136.212 Dietikon, Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),
Reverse DNS
Software: /
Resource Hash: bd84d4530480a8c7f5f94f3f8838d94dc72174726dbca7eddbe159469ff37b98

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:03 GMT
x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET
last-modified: Tue, 26 Feb 2019 08:23:50 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=2795247171
thrift_fmhk: GBBAPTKmrzACrxGKOTWW8yoQFfDr4Z0EAA==
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 2979738170
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 13618

GET
H2 200 1487645_6012475414660_1439393861_n.png
scontent.xx.fbcdn.net/hads-ak-prn2/ Frame 62E9 79 B
167 B 101ms
101ms Image
image/png 157.240.251.9
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-01-fra5.fbcdn.net
Software: proxygen-bolt /
Resource Hash: c8caed93847affc154cb3d424e34fc146e7340bb29abebd5eba7063e3dca0604

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 05 Oct 2023 04:02:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/png
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 79
expires: Thu, 05 Oct 2023 04:02:02 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 26ED 43 B
215 B 145ms
145ms Image
image/gif 23.20.73.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1525570&asId=69b6d4fb-7909-f599-d9a2-7f1e732bb80a&tv=%7Bc:q8TDbO,pingTime:1,time:3635,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:35%7D,%7Bpiv:100,vs:i,r:,t:2634%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1001,o:2634,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:35,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B2625~0,0~100%5D,as:%5B2624~728.90%5D%7D%7D,%7Bsl:i,t:2634,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:151,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:37,sis:676%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.73.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-73-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:03 GMT
server: nginx
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 26ED 43 B
215 B 135ms
135ms Image
image/gif 23.20.73.218
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1525570&asId=69b6d4fb-7909-f599-d9a2-7f1e732bb80a&tv=%7Bc:q8TDbP,pingTime:1,time:3636,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:35%7D,%7Bpiv:100,vs:i,r:,t:2634%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1002,o:2634,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:35,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B2625~0,0~100%5D,as:%5B2624~728.90%5D%7D%7D,%7Bsl:i,t:2634,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:151,fm:tRMuYI5+11%7C12%7C131%7C141%7C15%7C1611%7C1612%7C1711%7C1712%7C181*.1525570-72171777%7C1811,idMap:181*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:37,sis:676%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.73.218 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-73-218.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 Oct 2023 04:02:03 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 bz Show response
www.facebook.com/ajax/ Frame 62E9 0
944 B 74ms
74ms XHR
text/html 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/ajax/bz?__a=1&__ccg=EXCELLENT&__dyn=7xe6HzE4e685KbwKBAodod8d898nwgU6C7UW3eEc87y0wo7W0TUhwem0nCq3q5U3awbG78b87C1xwEw7Bx61vw55xS0sy0ny0RE2Jw8W5U4q0PU1AE17U2ZwrU2pw8O0NE&__hs=19635.BP%3Aplugin_default_pkg.2.0..0.0&__hsi=7286319767917784589&__req=4&__rev=1009050604&__s=%3A%3Acxpzeo&__sp=1&__user=0&dpr=1&jazoest=21907&locale=en_US&lsd=MOgVRGp6wz1pW2ONwJFlJf

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y7/r/9scU3tR13V5.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-fra5.facebook.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.facebook.com/v3.2/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfe9bb90ef2c758%26domain%3Dwww.bulgarian-offers.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.bulgarian-offers.com%252Ff227de71b1e2dd4%26relation%3Dparent.parent&container_width=421&hide_cover=true&href=https%3A%2F%2Fwww.facebook.com%2FBulgarianOffers%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=timeline&width=420
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeoRh8HWb07Ywfy39

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 04:02:03 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
x-xss-protection: 0
pragma: no-cache
x-fb-debug: BAUdUJJb+hW0WE/UuElj0UQegkK5Ux8bI7CTECY1HuRMDHm32kSy1qveKjIoLzuQXDpejnkfVXdAU9usICLLmQ==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
access-control-allow-methods: OPTIONS
access-control-allow-origin: https://www.facebook.com
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
vary: Origin
content-type: text/html; charset="utf-8"
expires: Sat, 01 Jan 2000 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync-dmp.aura-dsp.com
URL: https://sync-dmp.aura-dsp.com/match/google?google_gid=CAESECetigLJFiqczMCnXS05Jlg&google_cver=1&google_push=AXcoOmQKYtsK0K3e4z777Z-L7-tAHxRAOgT1uVCnVqGKJkKskFhrU-Y2zBcDZq_JBkxIDeudQUd2sOimpsiWF4DuM_pnD_Q4EIqmNkAZ

Verdicts & Comments Add Verdict or Comment

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

53 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.bulgarian-offers.com/	1969-12-31 23:59:59	Name: user_js_gmt_offset Value: -120
.bulgarian-offers.com/	1970-01-20 17:24:14	Name: _gcl_au Value: 1.1.375258186.1696478517
.bulgarian-offers.com/	1970-01-20 17:24:14	Name: _fbp Value: fb.1.1696478517401.470946452
.bulgarian-offers.com/	1970-01-21 00:50:38	Name: _ga Value: GA1.2.1651249133.1696478518
.bulgarian-offers.com/	1970-01-20 15:16:04	Name: _gid Value: GA1.2.1803120288.1696478518
.bulgarian-offers.com/	1970-01-20 15:14:38	Name: _gat_UA-22211580-34 Value: 1
.bulgarian-offers.com/	1970-01-21 00:50:38	Name: _ga_8Y4LZ48VEC Value: GS1.2.1696478518.1.0.1696478518.60.0.0
ads.dotcomadvert.com/	1969-12-31 23:59:59	Name: OAGEO Value: 2%7CCH%7CEU%7C%7CWorb%7C3076%7C46.9316%7C7.5602%7C100%7CEurope%2FZurich%7C%7CBE%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C
.bulgarian-offers.com/	1970-01-21 00:36:14	Name: __gads Value: ID=501127dd7436471b:T=1696478517:RT=1696478517:S=ALNI_MZnvHmU2NnX_Pad_sJSr6dSrMPX7g
.bulgarian-offers.com/	1970-01-21 00:36:14	Name: __gpi Value: UID=00000c8e1e510946:T=1696478517:RT=1696478517:S=ALNI_MbUZ7rqsanWqMulxbxDA1W1fdXB4w
.doubleclick.net/	1970-01-21 00:50:38	Name: IDE Value: AHWqTUkBirpCoKg9Co67Kt04KlBYbo7UFNiTxRYGRZzbQxNhjiukiNP6oO8YcOT-p_w
.travelaudience.com/	1970-01-21 00:46:19	Name: _tracker Value: %7B%22UUID%22%3A%224502200B-FD2C-4E4F-257B-2C3B7EC23714%22%7D
.de17a.com/	1970-01-20 23:53:02	Name: guid Value: 1.4115888567884614340
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MStjA2MTM3tDQ2MTK1tDCysADyhfgMdUOTK8LyMizNff3i0wHcLxa5JQAAAA
.rfihub.com/	1970-01-21 00:36:14	Name: eud Value: H4sIAAAAAAAA_-OSMXR2dA12dcn3i3RNKzQJ8irwCTPNTy0OdQsuNQniNTSzNDMxtzA1tDQwNX3FiMoHAIKaFsA9AAAA
.rfihub.com/	1970-01-21 00:36:14	Name: rud Value: H4sIAAAAAAAA_-MStjA2MTM3tDQ2MTK1tDCysADyhfgMdUOTK8LyMizNff3i0wHcLxa5JQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_-OSMXR2dA12dcn3i3RNKzQJ8irwCTPNTy0OdQsuNQEAj1volB4AAAA
.yahoo.com/	1970-01-21 00:00:36	Name: A3 Value: d=AQABBDc1HmUCEFT6TaHBTqx6Stwe3DbxU7QFEgEBAQGGH2UoZQAAAAAA_eMAAA&S=AQAAAqo5lowVKRyxOefbTpdFUHU
sync.srv.stackadapt.com/	1970-01-21 00:00:14	Name: sa-user-id Value: s%3A0-7bf1471c-4564-44c6-65cb-f7583ac5416b.2WWY7%2BmU0AlWMUKqACbBnon0RIWVSpuyWG5oou%2B88vo
.srv.stackadapt.com/	1970-01-21 00:00:14	Name: sa-user-id Value: s%3A0-7bf1471c-4564-44c6-65cb-f7583ac5416b.2WWY7%2BmU0AlWMUKqACbBnon0RIWVSpuyWG5oou%2B88vo
sync.srv.stackadapt.com/	1970-01-21 00:00:14	Name: sa-user-id-v2 Value: s%3Ae_FHHEVkRMZly_dYOsVBaw.D7HAK3TrsZjCon8LWeX38f3I%2BMMib3PIKyENmYGbtYE
.srv.stackadapt.com/	1970-01-21 00:00:14	Name: sa-user-id-v2 Value: s%3Ae_FHHEVkRMZly_dYOsVBaw.D7HAK3TrsZjCon8LWeX38f3I%2BMMib3PIKyENmYGbtYE
sync.srv.stackadapt.com/	1970-01-21 00:00:14	Name: sa-user-id-v3 Value: s%3AAQAKIDuW3Z6KVUWUbhh_3EqIdAb3V5Y8XNmzHmIVEuxyf0XpEHwYAiC36vioBjoE8Iu9MEIEy3kcWQ.E64FKMZjPQxWH0qR%2BaV7YpQywwO8VgiwG3NGNRXm5%2Fg
.srv.stackadapt.com/	1970-01-21 00:00:14	Name: sa-user-id-v3 Value: s%3AAQAKIDuW3Z6KVUWUbhh_3EqIdAb3V5Y8XNmzHmIVEuxyf0XpEHwYAiC36vioBjoE8Iu9MEIEy3kcWQ.E64FKMZjPQxWH0qR%2BaV7YpQywwO8VgiwG3NGNRXm5%2Fg
.ctnsnet.com/	1970-01-21 00:00:14	Name: gid_CAESEG76JlmHunWuiUN3dXpf_0s Value: 1
.ctnsnet.com/	1970-01-21 00:00:14	Name: cid_5866f3fca74d4cd79deed34ce7d8b9c4 Value: 1
.onetag-sys.com/	1970-01-21 00:44:25	Name: OTP Value: ZrcwPbCwisJo4Df8me29uFavTQG7qYCErx_oOBim4ww
.bidswitch.net/	1970-01-21 00:00:14	Name: tuuid Value: 57c0400f-07b1-4f90-94e9-067af1b02ac4
.bidswitch.net/	1970-01-21 00:00:14	Name: c Value: 1696478519
.bidswitch.net/	1970-01-21 00:00:14	Name: tuuid_lu Value: 1696478519
ads.travelaudience.com/	1970-01-21 00:46:19	Name: _tracker Value: %7B%22UUID%22%3A%224502200B-FD2C-4E4F-257B-2C3B7EC23714%22%7D
.fksnk.com/	1970-01-20 15:16:04	Name: g_001 Value: 1
fksnk.com/	1970-01-20 15:24:43	Name: AWSALBCORS Value: OXJMA7KOf0c2hutXsxIHOx5Ey6Rh/IsEyOqq92KW5GJ8M5pkrbSYe5F5Xr1da1Kp37IJwzoG0Ytma4HoHI3cjLcOElxNJsVEtSt0SAwnj+l/wp6IP48KYLacnLMy
.fksnk.com/	1970-01-20 17:24:14	Name: f_001 Value: 1C006305E0FE2451
.adform.net/	1970-01-20 15:59:16	Name: C Value: 1
.bidswitch.net/	1970-01-20 15:14:38	Name: google_push Value: AXcoOmTm7FLia5kLfywvYiDbzq1tAziClcSM1-zC_PGZVlFzP4vvQ0HyL6Qw4D7Av8wIrHXZE3EzptgPipLzwKD2dlqr6xoK1nMdyUw
.zemanta.com/	1970-01-21 00:00:14	Name: zuid Value: hdk2BetrQSOr6RQlR4eu
.doubleclick.net/	1970-01-20 15:14:42	Name: DSID Value: NO_DATA
.adform.net/	1970-01-20 16:41:02	Name: uid Value: 8391611008996132682
.dotomi.com/	1970-01-20 15:14:38	Name: DotomiTest Value: 7627bc1676621693
.turn.com/	1970-01-20 19:33:50	Name: uid Value: 2725800691534936449
.linkedin.com/	1970-01-21 00:00:14	Name: bcookie Value: "v=2&2bd5c614-74a8-4b47-858e-c3e0b5c16345"
.linkedin.com/	1970-01-20 19:33:50	Name: li_gc Value: MTswOzE2OTY0Nzg1MjA7MjswMjGoAcaalUgHA4E9UAxgK0S0XDHauenbmGdBsRSScrW9sA==
.linkedin.com/	1970-01-20 15:16:04	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=3017:u=1:x=1:i=1696478520:t=1696564920:v=2:sig=AQEAYQjE_PZrn1Dp4OE1JAx1UsuTfgIP"
.everesttech.net/	1970-01-21 00:50:38	Name: everest_g_v2 Value: g_surferid~ZR41OAAAEbY90Wmw
.googleadservices.com/	1970-01-20 17:24:14	Name: ar_debug Value: 1
ads.dotcomadvert.com/	1970-01-21 00:00:14	Name: OAID Value: 01000111010001000101000001010010
.w55c.net/	1970-01-21 00:46:19	Name: wfivefivec Value: 8MnuztHs1QOfyN5
.w55c.net/	1970-01-20 15:57:50	Name: matchgoogle Value: 5
.yandex.ru/	1970-01-21 00:50:38	Name: yuidss Value: 3353607481696478521
.yandex.ru/	1970-01-21 00:50:38	Name: yandexuid Value: 3353607481696478521
.microsoft.com/	1970-01-21 00:00:14	Name: MC1 Value: GUID=0846ed7eae5343f686f9163c9f20d8a8&HASH=0846&LV=202310&V=4&LU=1696478522466
.microsoft.com/	1970-01-21 00:36:14	Name: MUID Value: 23EFCDBEBFDA643F336FDE1FBBDA6218

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	Message: Origin trial controlled feature not enabled: 'attribution-reporting'.
network	error	URL: https://mts0.google.com/vt/data=_lYaGEWvFTrvd3K5g34vd9Z5WRzyZ_D96VaDxmMykmHH5BLVOhS2TYUompsb-VVzMDHeDafALT5geRQMAP3w0w Message: Failed to load resource: the server responded with a status of 400 ()
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
deprecation	warning	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/RBH7b7zeA6F.js?_nc_x=Ij3Wp8lg5Kz(Line 271) Message: Listener added for a synchronous 'DOMSubtreeModified' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.rfihub.com
ad.turn.com
ads.dotcomadvert.com
ads.eu.criteo.com
ads.everesttech.net
ads.travelaudience.com
an.yandex.ru
analyticspixel.microsoft.com
b1sync.zemanta.com
bid.g.doubleclick.net
c1.adform.net
cat.fr3.eu.criteo.com
cdn.ampproject.org
cdn.jsdelivr.net
cm.g.doubleclick.net
connect.facebook.net
csm.eu.criteo.net
d.turn.com
d5p.de17a.com
dclk-match.dotomi.com
dco-assets.everestads.net
dt.adsafeprotected.com
external.fqls2-1.fna.fbcdn.net
fksnk.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
gcm.ctnsnet.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
im.bluevoox.com
match.adsrvr.org
mts0.google.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pm.w55c.net
pr-bh.ybp.yahoo.com
px.ads.linkedin.com
r.turn.com
region1.analytics.google.com
rtb.nl3.eu.criteo.com
scontent.fqls2-1.fna.fbcdn.net
scontent.xx.fbcdn.net
static.adsafeprotected.com
static.criteo.net
static.xx.fbcdn.net
stats.g.doubleclick.net
sync-dmp.aura-dsp.com
sync.srv.stackadapt.com
tpc.googlesyndication.com
www.bulgarian-offers.com
www.facebook.com
www.google-analytics.com
www.google.ch
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
sync-dmp.aura-dsp.com
104.16.88.20
13.107.42.14
13.225.78.4
142.250.181.226
142.250.185.130
142.250.185.193
142.250.186.100
142.250.186.130
142.250.186.170
142.250.186.174
142.250.186.34
142.250.186.35
142.250.186.66
142.250.186.98
142.250.186.99
15.197.193.217
157.240.251.35
157.240.251.9
172.217.16.193
172.217.16.195
178.250.1.10
178.250.1.25
178.250.7.2
178.250.7.4
178.250.7.9
184.73.203.57
193.0.160.130
193.135.136.212
204.79.197.204
213.155.156.166
216.239.32.178
216.239.34.36
216.58.212.168
23.20.73.218
23.32.185.206
35.157.117.145
35.186.193.173
35.190.0.66
37.157.2.228
44.216.83.210
46.228.164.11
46.228.164.13
5.9.5.183
5.9.5.184
51.89.9.251
52.28.245.130
52.45.175.185
52.51.159.118
54.146.162.150
54.229.4.219
66.102.1.155
70.42.32.95
87.250.250.90
89.207.16.140
01022cdc1a0b2e19a3f6d1bb2fe847479d9a9e4df3207b69ac36f57aac4c53d1
01cbb105faef1373e9d53ddc5e62c9c7b5f66cbc64c2c045a3daec0328b831e6
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
0287f649ffcf892b10603ca40ec4506842fe2feafb4f2fc5173ee222d013b4e7
0390b513ae1b116f504f8944871a901101d2988a035eeb1b244bff0544db6893
041fe6e516177e777c651a95708ee4961723db34a974e8be9e6ba597a1313e51
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e32bad91acf2148e31322e78858dbc5701dde6127b2d42aaef3bfd0ed323e4f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
16eace4c32f3712172b7fabaf438514a65ce9aa71f1c95f665d3201ea52aae5c
16fadb06557f8c559b25e437d47286d3886b6f361900f479f1bf928198e8d0f7
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1bc8c4e39fffd603a664ad29b0ede06b5bea9e31eedf629be4884730642f3a08
1f89f672d6c2271799c67931eedb4b480edaa1d3d94d2a025f67dc9d51889eb9
20963f8348fada16d52d1c802ca10fa00e363fb0c793532638033335fe870a09
252d9e618575a6748d4fda36b70f8c006cc645ec18dbf6b84e0a19e5c7a2eefa
259f913ca078aa8ba859bfa03778762875f1f96254b121c4b84aa7c6ff6ed73f
28d3b6866c6acc045eaa1e74e08c603add7aefd9f6c2c8ebeb275e4e9f0dcd25
2bd128170f24b963f67f17e2a1312ae8371c44c3ecad64cedde585555f4d55ef
2cd95361220184bc836ad910263d86e4269c84bba071145f02628962109ba93f
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
309773fa6c23f46befd5880e169b6bc47fe53c4fd326ec1c84d7d53cde803bc9
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3a4f7e8fa243a143eec25c5a05d62c8407ee0da3c95da306f520a985cc1b6cdf
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3b33a70fbf2782be625dd46af56d0247b9fca68c823c5010a6226f2231b3108c
3bdf27a1124d341aa2b1880639ae305d9af0d84dd79d7e7f460794038ff75fbf
3d23cbcfd35d90cfb139e6f05b6a7fbc22891e2936b6a706ef8147300d66aa08
3d89d2a833e0c8b73ddaac6d6ec14c4ab06c648ee6574f1b29e9ab8435e2f41e
3fe8e089a270d279ecb69c83dcb71e48f5af86759dd898a5bdd72fefb00272a3
41b7f4ef86f2344e72da822fe79265700ff1bf3361450a02ab4397ff1a5eb040
4468750d4441e1b89aee289158e9417671591cc889c0f64699e9381101956edb
45444d590a67d30e8b2fde01bb6482f829383b64bf14a4b19b86e22fdc319fbb
471861077265000a19c3cacbc7f36aa6fc0b9cec00c3319e2b5a4df363d3253d
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
48058c7cae6c0edd1606307d30e0bfec5267501b07d1b1a664644c7e30121911
484192ede3741e6bd6df2a1401c504b8bfd21f9c99d3b5126ab3f0b3920fecbc
4862f3918d605d204bac5bf610bb6469d987925f7fb096079b8e9c2d62e0e230
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4a1d4330774e3191a013f24b15bc8c3c61ed2026b99de211c95ad55ce580eff8
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fcc2c45e5c8be67198b1d2c38bef90e3373e59b91be75e915711bfa7c10d22a
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a61db1134643f3360d0e1ff16c4e48fdf700090052d0fcf9301e95884ae9d9
543ad425d0e52ebe544ededc7478f95837a4265b9d0caaad5bc232d1a02dbc09
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5686573b84e593087df88d51f2986ae2e2b74e4c0faf7939dfd4f362ae07da11
56a0e9d2f78d07d9f37622c831405255548cf8deee38672638c0bd28f9b39f4e
58e3c62f27e68518cb5fdfca71af138e38721359981cf6934ec7c03f091045ad
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
616d55248222dd9e041e90f2c186b25c5413485ebf9d5201adec671f6c350659
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61e4cd17cd84adc5ed49ce361925ab89ed9210810bf03c51eb875b7f59d99127
64c73faba3c8e17b28ad23a81a275658afee4290323a0b524901b599c0d1e33c
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
65f22d8aa0690bd9cf8ffe5d68e5f6866b05ed8fc6f6c9083b996c1b3c4c75f4
694f3e412b3d64127aa09991af321ca0f14e0f8e3fc851ab0531620bfebc0df7
6b50d8f03236874e1741767f5574615296268fb38251414ab1196d26515e6767
6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc
6df0c4c67913ac25fa9e01d7a7dfd29a73dbc7e59b4642ad8eafc52b700f444c
6ed03c02eec456fe89e228d6cdf45bf7088aa9402beaab5a2a1214a1aa35ce3c
6f064b11007507ecebb88b25c6b21a41e51189b079c5a30342c8dc8950019c0c
6f41a768f0715fb44bebd372843d7f4b0810318a355fe89893ed7928d074387c
71f89d61c6c572acbbd76a0a58fecb2f7796ed304f39bee614e0f0d26d570830
71fd592694ea6c3b41cc4dda485ad7c95e91d0c2ce585a9ace4e8b208cc85b95
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
729bb9007929a8af5c6f300c99e7c5899043ed1734d39fd6f4e0361b94d1adbc
72e00c7ffc1098262dc5f62edc1229b2b83c7436f91a9ecf2cb14e377871f19a
731be4de7f0aa9ffd16a422e7a5437f22aa9a54a4be322c661b374ddfdcea24c
74d9b3dfc8c5f44db0dc49d54f1e3d905a131bc5f8d7e8d3c5b68cfb37c21410
75d474f6fa59c3aa6bddb85e9925f67fc79a022d5adfa5ae1d50e80643716ace
77ddde2c4f22f96ee03e794b2e8d4703f8e434ac4da9f1e35b14931fd0829ed7
7810cff016f3dbd79704d80fec6830633d594a1ad6c9698e250b47493a94eeb0
7f8d937ac3c24cd9099dccaeb3e160dba15d6396b7f8ada3ca95f9ef24633aee
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
7fdbfe3513a400f9bda5ff18e1e194283c298d6ddd0ccec8547f59920971db20
80185d950137849dce381e6632912d72f2209f3c1bf299e6db404b5d5b8bb585
805270b078cde87b61bb57c8bd44f8b58b0d128f5a8efdd4395470b45b291d65
805d3b588be7de082c664776a0eb36cc9e06a002e814bd25dc0dc8b9d37577a9
80a307d2e9ccd6b085ec008df10a1a406ee968bf82ef5f7fb01862fea5d8945a
810ca9b560f154784c1f1ba5851fd7f727c272d55c2522a3e8d1c627d6881b5a
8154aa9057e3367d9d3e4bb1f85db9645c01fc0690091aadc57dbae849ba3499
83b7d2afe243941c2527b2d875836ad2cb864290690dd1b253389de3f7bc7da4
8447feefabd1bf8689871f96916286974e5f0657726fd2bfe98d003d5a53e5d0
855dc9a6f383513c905390a076f72690c7b7227ae3d65e89629fc9f9a1075db6
859790d507acd06e12295953099b5025fc6d49d41683e0af085c5f8513f3c3c7
87b93bad3a5a7a5618df9b890984c7325c8e3c65551708e152fa5f5b8c93518a
8840fc6de901dd025088a6a2f41044ed3c3353c07934c45a87467c0c046c6e17
89403ef16933d6911ecc68da312e1934f696994b35d4824928649954a5980bec
89868ea5d1b5c17d58ab5bfff72da64db4bd63a308ccba15b93cafbc0e0b4e5c
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e767059e2c08dda82f50d2856b495e33b018872ffb8c929f51e74f71a86c50a
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8f1843ba4bdea64726280f2365f8ad8a47e70ee54327f98273daf7fac5120074
8fe891ba12a3f008264152d4cfc7b26eaa744c4f6513d25aeafee3c5f74373e2
91ea9d151e7ab252501a473e052b27bf88d2096dc8cff8a0e298cffd710c31f4
9312305221a918fcc3b8eeeeb56336a844c0de1a65681138f8a8cff0d50e12fb
95fbb867a36b0214a41136cac5db604cfadf9ef793f9edcc65f2b615acab889d
96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0
98e38fa4a13948af67ac60918d5175b99fb29132e020a81f1a1b895baa5e95db
99ffbf6a72061ad21abc0efea1f54367e9faa3fae5e6405163c9b41a59366d7c
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b0c27feb6274ac910961b1f1f47af5a0dadde2c73e11f973c94b28ab85b2e89
9da2a7beb9cabbccf73938c8ac404aead072094c5ff53449f6cd6f975f42345f
9e0880eca3596976121c505b04932ab904d7cb49177ac0f56e7ee4f61ae9bb47
9e57fedb96b3686621bccd5521f43a2037a823c74f062176952890b179b3955b
9fd696c91aaee1b430fc4988b16f07e418021b26c35cc1ec6502db41ef1b1731
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a224e0b93e46d11289744d1462fd3bf979e37ce4b6e267a2cdd0d89962c9aac2
a6c3938a1c6275906298598d0205639f15bb6671ce183a3a9c7f1714fc0ce819
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a87feaf65170ded496c597c1f1011a79c39a309e415802b49a3fea32f32dfdb8
a8c285f5066b49dd14f436eb5a4f10a02cee37525965a2c6e028ed59c292f9b6
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ae6a4ef12251514bfd296baf74abf0824546dd49e026cb6e6e25f3b69ca18ae3
af597350d8645702d4d08a2bca962e699ac619a84aaecacc0244faee614d64c9
b0001552099de600378a80af5f3b106b4125aa67dd0c89220b9eb4145cf3c8ab
b12978a4a837127afa5f6d720d54d52f7a21d13d1b7d49a74e5eb1cf8ff12830
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b71f711851635bff1f46249bd0656db01abcebb758d71a0495d4d42e2682c06d
bd84d4530480a8c7f5f94f3f8838d94dc72174726dbca7eddbe159469ff37b98
be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e
bf99ef8296121dd59293171d103c5d8ad879e51aff395370af7a417c157f374d
c14d4b51b09deecd26292474b3adab4a891f9d6f14ed199d80f2780ab5845ed8
c37130a13512e9d39744a70173a65dfc229317c7678d9c5ab6d9c0bc798ebfca
c4c5bd0778b3e70e51fa4fb3e0bcce6898701d76d2c0e695c800dc96581a4dd8
c8caed93847affc154cb3d424e34fc146e7340bb29abebd5eba7063e3dca0604
c9971a761b2cbeb47238a427c270cf48276ce0dacefd2608fd8428761680566b
d0c750516e363bf1d943ac3a3015c94f08c1e422a3097f8052bb29e57d26c062
d513ae94bd4ce124e423f621db4b710ed1e76a240f7d2974808b345441f59f82
d705c583adbdd3f894f85889ec1ee8ad58c6dec025201c81ab0e73a0cce23806
d8997b211c6ba42e14e78e29a6892a222d3539a30a9d80d2e7d964ab6f1249fe
d8c52fe5bb662564ab7edf0abe01a2202dcc36eaa71ce6a465cd64210c4eb2c0
daeeb4718cd41b993de8ee8061b06ab87b26ebf920342eacc526425b1b77a8ec
dba5db65eacdd32e82b077fce0282798e8a702ecbead9b1a1afc305c2fdba33c
dc13aa6a8d7961250441cc9632aa322eff337f92ad5e2a09b983fc698e9e57b2
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0309fd597700b89310de557575438fb73dbee569cf734340057c0884ce91c20
e1939709f4d57a3e70527e0adda2ae393f68c8633b03b6e0bcff6227a344b2ab
e23a2a4e2d7c2b41ebcdd8ffc0679df7140eb7f52e1eebabf827a88182643c59
e3183de273b2f194bd3f6a1d217f68c4f5be6a1a08aa817cee5ebf43cacdfe7d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48bb5012144fc3c744b99c13340bbe7b162b8498b53d6e00d076b6c3d8c1c0c
e66ad7a792dcaa684917803058147d54e110728a7cef76562e5bc5ca1388339e
e6ccc7c8807ab452975a5448458ae8bc9b2dccdf7f07caa84b8edd73fd0b369c
e73720b2d682d70f1172751324d4ee50339dac145ae5ed56bc7e16098e3a8d19
e93711fdf4472d8754c5fe85ee2df0c9da30a83083ea3f965631683598735af8
e99416bc5be5f174bdc8119ad8dceb1294fd4bef4162a4f49cf5d0a70ed4817a
ee28eb5c38d047e12af87adcefd400b40da8ec2c745b203231547625c3eb7e35
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efba2776ce1c31fbe824fe82b567510e9c410127d03973eb52884fb90b56b80d
f0420f366a8220046ff34ea8b89a49bb225b4b5ac42f995d94195693d2998516
f04f46ae8086f41fcf3ff318e8d0f64ef94898d0078cd5548bc3cb89db0bcbbe
f335a91239c4af1c0491727be910330d3231f01b7498352ddea85ebc5480007a
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f868cbd9df854b57d6bec145062030a53542f58b259e7c43790db3bc0aa8e071
f90a0bfda110d40a81d391edeccd1143806c608fd7c64786142c222709d55499
fb09f381a7fd67f63466a1907cd29deca884217da40a7611da3db93cb49b6daa
fb4a1ce6dfcba35211052403191f739a43aafef3ebab7af5e3866d02da0e60fe
fcdaa4a9116d5ab88233e3349fea2428f2a4c46b3538900117cef9c8c1d31f0c
fd48a69933bfa6d5e51393b093d776d09a1e7bfb4b7c1e6d4aa00d75f0b3d2d1

www.bulgarian-offers.com Open in urlscan Pro 5.9.5.183 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

252 Requests

88 %HTTPS

0 %IPv6

42 Domains

61 Subdomains

40 IPs

11 Countries

2863 kBTransfer

7842 kBSize

53 Cookies

4 Outgoing links

Redirected requests

252 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bulgarian-offers.com Open in urlscan Pro
5.9.5.183 Public Scan

Screenshot
Live screenshot

Full Image

252
Requests

88 %
HTTPS

0 %
IPv6

42
Domains

61
Subdomains

40
IPs

11
Countries

2863 kB
Transfer

7842 kB
Size

53
Cookies

252 HTTP transactions
14 data transactions