Submitted URL: http://adsys.insert.bg/inslocat.php?ads=anKHiY6oqIGIimdujQ-QQQQ--QQQQ-
Effective URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Submission Tags: falconsandbox
Submission: On August 16 via api from US

Summary

This website contacted 38 IPs in 5 countries across 23 domains to perform 154 HTTP transactions. The main IP is 79.124.75.51, located in Bulgaria and belongs to TELEPOINT, BG. The main domain is media.framar.bg.
TLS certificate: Issued by R3 on July 14th 2021. Valid for: 3 months.
This is the only time media.framar.bg was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 178.132.86.60 31083 (TELEPOINT)
29 79.124.75.51 31083 (TELEPOINT)
1 65.9.79.92 16509 (AMAZON-02)
2 151.139.242.29 33438 (HIGHWINDS2)
1 2a00:1450:400... 15169 (GOOGLE)
1 4 78.128.6.34 31083 (TELEPOINT)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f01... 32934 (FACEBOOK)
2 2a03:2880:f14... 32934 (FACEBOOK)
5 2a00:1450:400... 15169 (GOOGLE)
6 142.250.185.98 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
16 2a00:1450:400... 15169 (GOOGLE)
19 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
16 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
5 7 142.250.181.226 15169 (GOOGLE)
3 5 2.18.234.21 16625 (AKAMAI-AS)
3 4 185.33.221.15 29990 (ASN-APPNEX)
1 2.18.233.67 16625 (AKAMAI-AS)
2 142.250.184.194 15169 (GOOGLE)
1 88.198.52.202 24940 (HETZNER-AS)
6 136.243.3.97 24940 (HETZNER-AS)
3 54.93.158.246 16509 (AMAZON-02)
3 4 35.244.159.8 15169 (GOOGLE)
2 23.45.108.93 16625 (AKAMAI-AS)
3 2.16.186.25 20940 (AKAMAI-ASN1)
2 54.205.87.49 14618 (AMAZON-AES)
154 38
Domain Requested by
25 static.framar.bg media.framar.bg
static.framar.bg
19 tpc.googlesyndication.com media.framar.bg
securepubads.g.doubleclick.net
tpc.googlesyndication.com
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
s0.2mdn.net
googleads.g.doubleclick.net
16 s0.2mdn.net tpc.googlesyndication.com
media.framar.bg
s0.2mdn.net
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
16 pagead2.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
googleads.g.doubleclick.net
s0.2mdn.net
www.googletagservices.com
7 cm.g.doubleclick.net 5 redirects googleads.g.doubleclick.net
6 b141.s248.meetrics.net 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
6 googleads.g.doubleclick.net 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
media.framar.bg
6 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
media.framar.bg
5 dsum-sec.casalemedia.com 3 redirects googleads.g.doubleclick.net
5 www.googletagservices.com static.framar.bg
securepubads.g.doubleclick.net
media.framar.bg
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
4 us-u.openx.net 3 redirects googleads.g.doubleclick.net
4 ib.adnxs.com 3 redirects googleads.g.doubleclick.net
4 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com securepubads.g.doubleclick.net
4 www.google.com 1 redirects media.framar.bg
tpc.googlesyndication.com
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
4 gabg.hit.gemius.pl 1 redirects media.framar.bg
gabg.hit.gemius.pl
4 media.framar.bg media.framar.bg
static.framar.bg
4 adsys.insert.bg 1 redirects static.framar.bg
adsys.insert.bg
3 secure-ds.serving-sys.com bs.serving-sys.com
secure-ds.serving-sys.com
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
3 bs.serving-sys.com 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
secure-ds.serving-sys.com
3 www.google-analytics.com media.framar.bg
www.google-analytics.com
2 lm.serving-sys.com secure-ds.serving-sys.com
2 sync.teads.tv googleads.g.doubleclick.net
2 googleads4.g.doubleclick.net media.framar.bg
2 fonts.gstatic.com fonts.googleapis.com
2 www.facebook.com connect.facebook.net
2 connect.facebook.net media.framar.bg
connect.facebook.net
2 images.dmca.com media.framar.bg
1 s248.meetrics.net s248.mxcdn.net
1 s248.mxcdn.net s0.2mdn.net
1 fonts.googleapis.com tpc.googlesyndication.com
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.de securepubads.g.doubleclick.net
1 www.google.de media.framar.bg
1 stats.g.doubleclick.net www.google-analytics.com
1 cdn-images.mailchimp.com media.framar.bg
154 35
Subject Issuer Validity Valid
framar.bg
R3
2021-07-14 -
2021-10-12
3 months crt.sh
cdn-images.mailchimp.com
Amazon
2021-07-21 -
2022-08-19
a year crt.sh
images.dmca.com
Go Daddy Secure Certificate Authority - G2
2020-03-13 -
2022-04-04
2 years crt.sh
*.google-analytics.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.hit.gemius.pl
Sectigo ECC Domain Validation Secure Server CA
2019-09-11 -
2021-09-24
2 years crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
www.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
www.google.de
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
adsys.insert.bg
R3
2021-08-08 -
2021-11-06
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-07-20 -
2021-10-18
3 months crt.sh
*.google.de
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.googleusercontent.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2021-07-12 -
2021-10-04
3 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2021-02-05 -
2022-02-09
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2021-03-05 -
2022-02-19
a year crt.sh
*.mxcdn.net
DigiCert SHA2 Secure Server CA
2020-12-07 -
2021-12-14
a year crt.sh
meetrics.net
R3
2021-06-30 -
2021-09-28
3 months crt.sh
bs.serving-sys.com
Amazon
2021-05-10 -
2022-06-08
a year crt.sh
*.openx.net
GeoTrust RSA CA 2018
2021-07-08 -
2022-08-08
a year crt.sh
teads.tv
R3
2021-06-14 -
2021-09-12
3 months crt.sh
secure-ds.serving-sys.com
DigiCert SHA2 Secure Server CA
2021-04-28 -
2022-05-03
a year crt.sh
lm.serving-sys.com
Amazon
2020-12-29 -
2022-01-27
a year crt.sh

This page contains 17 frames:

Primary Page: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Frame ID: 50CA146C0AB7E9BAA637FF4F7202DA1F
Requests: 58 HTTP requests in this frame

Frame: https://adsys.insert.bg/insmedia.php?adsid=42
Frame ID: 3BAC5EEE942335791290C0FAB4A26075
Requests: 3 HTTP requests in this frame

Frame: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 57D4C056080E8EA8D3859ED6ADBC5A90
Requests: 1 HTTP requests in this frame

Frame: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E2E1A70301EE5BA1EA70FF1A818E8E53
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Frame ID: DE363B6E770EB097445B481385DBA0F1
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pagead/adview?ai=CVtqTPG8aYaTFI4PD7_UPzsa6sA-zs7esZOCR9cfDDc-v46rDIhABIPyMznJgqbC-gMwBoAGFwMbgA8gBCakCfB8N2gvEsz7gAgCoAwHIAwiqBPABT9C4dgkgQNJDAXBe0n2c9WeC3l3qkgc0uw6uG3H0h7eXELMKf4Y2-YCOpAwJQBSNE6qFBO2ViroZMYsBPuQaFtETYz7PjBUiXA96A64lLFytUq-Ey-TMliBFh8-Z1erBBUAL2Evhd2jOTDuss6Zl_IrcuHHZTsZFZ3u0MERrN793mxOdLgr61cPNqgdm4gR40t4ma3KvJs53a6EsVw5_LzwO6Hw-RlyhlCX-99m_AN0yUFs7vFxqYyKZpUKvmLH3f2NO-GSsYTEliLSE8gvwQE82EJ1bhpjHJNOZvEQ4cE5Nou7zV42fDKdjPL7wxqvZwATTvIjJEeAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAfjv7kfqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEM3SGNIICQiI4YAQEAEYHYAKAcgLAdgTDYgUAdAVAYAXAbIXHgocCAASFHB1Yi0zNTU1NTYwOTA5Nzc2MzI1GIuFcA&sigh=fE6UdEldWhY&template_id=419
Frame ID: 6DA43CC4E2969198F04C5827D5D0C2B6
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 9CCC78B4D4F2C6C0F790502E6FB24256
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: E9DE5D0A955DF5A73D753DB24B16234D
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 83492E76ADB5628084C0200270039991
Requests: 1 HTTP requests in this frame

Frame: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 11DF3A56D29B86A2325EF2443F0C3A6B
Requests: 24 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTcoQIQmuqiAhjmrPmuATAB&v=APEucNVIlqLb5vhZ7BOwIKbMRYWZWI_IzfG7AlyEvFUD6ynTid46HS50ARTNkAW1Qu7Nz6rjN7XXpPaebDApTzk-jbIxmka64O4_Dnuh7Ag4EtVkve2r1jUawXEgDqKp8aRyzTmH9ydL1kwYhZp7WWnMvYHFecl08mixvXCM6faC0BI1R_hc2N0
Frame ID: EA96C8D20BE68E7FD160CFB0F9939FCD
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Frame ID: 74BC50D03CC63C372653D3A0AB10DC8F
Requests: 16 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: AA6F5E6A88A01B3D08DAF1F596C55C83
Requests: 3 HTTP requests in this frame

Frame: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A7BA0A09C8F0C2B89FF0DE6D9C514C57
Requests: 18 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
Frame ID: CC08A4783E9A075055759DE54D7FF501
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjZIRDakScY__vCqAEwAQ&v=APEucNVhx8qWnqombqszrjyNmcCjH-hHu2BmNo4E-rkrm_cLRTEce4nFb_4_CGr-Kf89CWC9JuwEkDCUrR1EM6SbOWZh7YbF1Yl-xqMCo7iilFvkewxtUtm1n1MAIy4Pio0s4lY6cWsoARwMoFSPFAaAV65mzuFhW_Ip9-nBlQgFirpVyGTdALE
Frame ID: 15DF6B2ECE8BBE90E1C3A847394BF601
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 33644DD4CB6DB4A626E4AE0E2174B8A7
Requests: 3 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://adsys.insert.bg/inslocat.php?ads=anKHiY6oqIGIimdujQ-QQQQ--QQQQ- HTTP 301
    https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • script /\/semantic(?:-([\d.]+))?(?:\.min)?\.js/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/plugins\/ua\/(?:ec|ecommerce)\.js/i

Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Overall confidence: %
Detected patterns
  • script /hit\.gemius\.pl\/xgemius\.js/i
  • script /hit\.gemius\.pl/i
  • script /xgemius\.js/i

Page Statistics

154
Requests

99 %
HTTPS

51 %
IPv6

23
Domains

35
Subdomains

38
IPs

5
Countries

2661 kB
Transfer

5242 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://adsys.insert.bg/inslocat.php?ads=anKHiY6oqIGIimdujQ-QQQQ--QQQQ- HTTP 301
    https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26
  • https://gabg.hit.gemius.pl/_1629122360956/rexdot.js?l=100&id=zU.qIWOQoxzyknwChvgmk8Pcj_6KFtugMqYqcXv5DtL.X7&et=view&hsrc=1&initsonar=1&extra=&eventid=0&fr=1&tz=-120&fv=-&href=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=SUvWkAN.KMl5HPQim.4GxO_WRjh.ZaqVI1.0cyyNArr.G7&vis=1&fpcap= HTTP 301
  • https://gabg.hit.gemius.pl/__/_1629122360956/rexdot.js?l=100&id=zU.qIWOQoxzyknwChvgmk8Pcj_6KFtugMqYqcXv5DtL.X7&et=view&hsrc=1&initsonar=1&extra=&eventid=0&fr=1&tz=-120&fv=-&href=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=SUvWkAN.KMl5HPQim.4GxO_WRjh.ZaqVI1.0cyyNArr.G7&vis=1&fpcap=
Request Chain 75
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 90
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1&C=1
Request Chain 91
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRpvPeMSt2QahLeTXAzJdwAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1
Request Chain 92
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESECcb6OMaO5nfxv2thQp1SXw&google_cver=1 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECcb6OMaO5nfxv2thQp1SXw%26google_cver%3D1
Request Chain 93
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIxNTU1NTc5NjI0MDQ2MzExNw%3D%3D
Request Chain 133
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIc--kbxyeRW-aZ0GZBymgA&google_cver=1 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIc--kbxyeRW-aZ0GZBymgA&google_cver=1
Request Chain 134
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWQzYzU5NmYtY2Q1OS0yMGEyLWQ0ZTUtZTRmNTQ4ZjZjZTJi
Request Chain 135
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
  • https://sync.teads.tv/um?eid=3&uid=CAESEMBkFKj3hVKk3KYGvI12V68&google_cver=1

154 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set %D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
media.framar.bg/
Redirect Chain
  • http://adsys.insert.bg/inslocat.php?ads=anKHiY6oqIGIimdujQ-QQQQ--QQQQ-
  • https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
106 KB
20 KB
Document
General
Full URL
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
1a796de18f0601165163596ec46445a07465299db0d7f934e29b395192c45e22
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
media.framar.bg
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate max-age=600, private, must-revalidate
Pragma
no-cache
Set-Cookie
framar_v7_2018=lk0mobk9964fan0klrpln75lu2; expires=Mon, 16-Aug-2021 15:59:20 GMT; Max-Age=7200; path=/; domain=.framar.bg
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Vary
Accept-Encoding
Content-Encoding
gzip
X-XSS-Protection
1; mode=block
X-Frame-Options
SAMEORIGIN
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Referrer-Policy
strict-origin-when-cross-origin
X-Content-Type-Options
nosniff
Permissions-Policy
microphone=(), camera=()
Content-Length
19119
Keep-Alive
timeout=2, max=800
Connection
Keep-Alive
Content-Type
text/html; charset=windows-1251

Redirect headers

Date
Mon, 16 Aug 2021 13:59:19 GMT
Server
Apache
Location
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Cache-Control
max-age=5
Expires
Mon, 16 Aug 2021 13:59:24 GMT
Content-Length
0
Keep-Alive
timeout=2, max=800
Connection
Keep-Alive
Content-Type
text/html; charset=utf-8
outline-icons.woff2
static.framar.bg/fonts/
12 KB
13 KB
Font
General
Full URL
https://static.framar.bg/fonts/outline-icons.woff2
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
4d2883443b24e424527f6a0a7aa2897b3df71f239db40373c4ff760e48147801
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://media.framar.bg
Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
12263
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 29 Nov 2018 12:19:25 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/x-font-woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
icons.woff2
static.framar.bg/fonts/
39 KB
40 KB
Font
General
Full URL
https://static.framar.bg/fonts/icons.woff2
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://media.framar.bg
Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
40138
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 29 Nov 2018 12:19:25 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/x-font-woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
brand-icons.woff2
static.framar.bg/fonts/
53 KB
54 KB
Font
General
Full URL
https://static.framar.bg/fonts/brand-icons.woff2
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
e7d4d5340bbe57a01d8f7992142e2763d438d5783890c76748306eebfa056a69
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://media.framar.bg
Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
54516
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 29 Nov 2018 12:19:25 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/x-font-woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
vendor.v10.css
static.framar.bg/
422 KB
63 KB
Stylesheet
General
Full URL
https://static.framar.bg/vendor.v10.css
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
a64226eb76cbbf7401a530208e51b4fcbc992b2e253acd10e23f9d8744cf05e7
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Fri, 23 Apr 2021 06:29:53 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/css
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
framar.v87.css
static.framar.bg/
90 KB
19 KB
Stylesheet
General
Full URL
https://static.framar.bg/framar.v87.css
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
1d9ae9c2b13f600455e7ed99ff682742e47bf5491cdf6a6a382eff1479bb96c9
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
18951
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 09 Aug 2021 06:12:18 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/css
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
lang.v7.js
media.framar.bg/
715 B
1 KB
Script
General
Full URL
https://media.framar.bg/lang.v7.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
7500dfacb8e6ee287398c0eee4bb84bf32849b808a3bf2240a5ebf3f14fb3879
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
media.framar.bg
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Cookie
framar_v7_2018=lk0mobk9964fan0klrpln75lu2
Connection
keep-alive
Referer
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
432
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 16 Aug 2021 13:13:43 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
Cache-Control
max-age=315360000, private
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Expires
Mon, 23 Aug 2021 13:59:20 GMT
jquery-2.1.3.min.js
static.framar.bg/js/vendor/
82 KB
30 KB
Script
General
Full URL
https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
29524
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 22 Aug 2018 07:57:25 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
Cache-Control
max-age=315360000, private
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Expires
Mon, 23 Aug 2021 13:59:20 GMT
semantic.js
static.framar.bg/
95 KB
27 KB
Script
General
Full URL
https://static.framar.bg/semantic.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
c7e1bce9874a76bf4e23242fbc125fa4af027a3e09830b4e643c39dbd4e589e9
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
27298
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 23 May 2019 12:31:55 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
Cache-Control
max-age=315360000, private
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Expires
Mon, 23 Aug 2021 13:59:20 GMT
vendor.js
static.framar.bg/
58 KB
17 KB
Script
General
Full URL
https://static.framar.bg/vendor.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
c3019d406dd60c5d2782bd1bbeacb33e221050797927f76e56c93229fc476996
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
16732
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 23 May 2019 13:48:01 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
Cache-Control
max-age=315360000, private
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=798
Expires
Mon, 23 Aug 2021 13:59:20 GMT
framar.v87.js
static.framar.bg/
77 KB
22 KB
Script
General
Full URL
https://static.framar.bg/framar.v87.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
ee40139e57f52990fba5c8ddc8e14020bc73696ec15eb2d4ad102dee5361953d
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
21422
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 09 Aug 2021 06:12:18 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
Cache-Control
max-age=315360000, private
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=798
Expires
Mon, 23 Aug 2021 13:59:20 GMT
framar_logo.png
static.framar.bg/images/
1 KB
2 KB
Image
General
Full URL
https://static.framar.bg/images/framar_logo.png
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
5c95b7ae9972bc9c9da2fa44ba13d8c2198a2e588e2138cf2688d594c8921eab
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1159
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 10 Jun 2019 07:00:48 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
no_image.jpg
static.framar.bg/thumbs/4/images/
2 KB
2 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/images/no_image.jpg
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
dc1956c857b8efbfd8a6e8ed94d5a57aa54dfb34305d3e79cbec2547d682d170
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1882
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 12 Jun 2019 13:05:50 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
no_image.jpg
static.framar.bg/thumbs/3/images/
1 KB
2 KB
Image
General
Full URL
https://static.framar.bg/thumbs/3/images/no_image.jpg
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
7b061d5f3a690d0cf42bfddbe6f928dd83530e5994271b2e0c9f6f210456a93f
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1120
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 12 Jun 2019 08:04:46 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
slim-10_7.css
cdn-images.mailchimp.com/embedcode/
2 KB
1 KB
Stylesheet
General
Full URL
https://cdn-images.mailchimp.com/embedcode/slim-10_7.css
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.79.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f0b7264810a4f05251ac724721a5a3a61887cff9bd30e1fbbc1bc832e94d38a

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sun, 15 Aug 2021 22:27:04 GMT
Content-Encoding
gzip
Last-Modified
Tue, 15 Dec 2015 20:19:39 GMT
Server
AmazonS3
Age
55937
ETag
W/"d67b6072a15510e2010ad947aa1213c3"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
text/css
Via
1.1 e79fcd7f3f0a842841acfca75e35ea79.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
AMS1-C1
X-Amz-Cf-Id
N0O1aEvXwBO76ZjUFt7eHnF5DodschnDgPvuxsR3vjCjpwQ1KjyLEA==
bda_small.png
static.framar.bg/images/
2 KB
3 KB
Image
General
Full URL
https://static.framar.bg/images/bda_small.png
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
6b56fc94819942f107fe8b14483f71ac822c74a8f4f06bb493ec1655c37541b0
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:20 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2310
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 10 Jun 2019 07:00:48 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Expires
Tue, 16 Aug 2022 13:59:20 GMT
dmca-badge-w100-5x1-09.png
images.dmca.com/Badges/
3 KB
3 KB
Image
General
Full URL
https://images.dmca.com/Badges/dmca-badge-w100-5x1-09.png?ID=8bf62012-87d5-42da-87dd-8d903ec79697
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.139.242.29 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
nginx / ASP.NET
Resource Hash
89ee540bbb3aca4b8db6314526f492c377b8258640c18a7615dee490e3981852

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:20 GMT
last-modified
Mon, 25 Jul 2016 19:39:16 GMT
server
nginx
x-powered-by
ASP.NET
etag
"eb97a53aace6d11:0"
x-cache
HIT
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
link
<http://dmca-images.azurewebsites.net/Badges/dmca-badge-w100-5x1-09.png>; rel="canonical"
content-length
3101
expires
Wed, 15 Sep 2021 13:58:32 GMT
DMCABadgeHelper.min.js
images.dmca.com/Badges/
465 B
633 B
Script
General
Full URL
https://images.dmca.com/Badges/DMCABadgeHelper.min.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.139.242.29 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
nginx / ASP.NET
Resource Hash
e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:20 GMT
content-encoding
gzip
last-modified
Fri, 21 Jun 2019 20:14:34 GMT
server
nginx
x-powered-by
ASP.NET
etag
"26b181f16d28d51:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
link
<http://dmca-images.azurewebsites.net/Badges/DMCABadgeHelper.min.js>; rel="canonical"
content-length
280
expires
Wed, 15 Sep 2021 13:59:12 GMT
truncated
/
1 KB
1 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7cfc4cec708b3ef2763009b293e7b21286f9e8e3e833486c9346653f3c64b4d1

Request headers

Origin
https://media.framar.bg
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/font-woff;charset=utf-8
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 13 Jul 2021 18:24:06 GMT
server
Golfe2
age
2739
date
Mon, 16 Aug 2021 13:13:41 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19672
expires
Mon, 16 Aug 2021 15:13:41 GMT
xgemius.js
gabg.hit.gemius.pl/
40 KB
11 KB
Script
General
Full URL
https://gabg.hit.gemius.pl/xgemius.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
78.128.6.34 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-34.telehouse.bg
Software
GHC /
Resource Hash
99a336d42e4e130971fac5e498ac76a43d12fd0acb56a846543dfaa37eccb67c

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:20 GMT
content-encoding
gzip
last-modified
Wed, 11 Aug 2021 15:23:22 GMT
server
GHC
vary
Accept-Encoding,Origin
p3p
CP="NOI DSP COR NID PSAo OUR IND"
cache-control
max-age=43200
cross-origin-resource-policy
cross-origin
accept-ranges
none
content-type
application/x-javascript
content-length
10838
expires
Tue, 17 Aug 2021 01:59:20 GMT
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:43:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
946
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1306
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:43:34 GMT
collect
www.google-analytics.com/j/
4 B
33 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j92&a=1289824896&t=pageview&_s=1&dl=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&dp=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&ul=en-us&de=windows-1251&dt=%D0%97%D0%B4%D1%80%D0%B0%D0%B2%D0%B5%D1%82%D0%BE%20%D0%BD%D0%B0%20%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAAEIJAAAAAC~&jid=248291795&gjid=1429243950&cid=627043016.1629122361&tid=UA-3815385-4&_gid=701776015.1629122361&_r=1&_slc=1&z=376160892
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://media.framar.bg
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
88 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-3815385-4&cid=627043016.1629122361&jid=248291795&gjid=1429243950&_gid=701776015.1629122361&_u=aGBAAEIIAAAAAC~&z=330789776
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 16 Aug 2021 13:59:20 GMT
content-type
text/plain
access-control-allow-origin
https://media.framar.bg
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-3815385-4&cid=627043016.1629122361&jid=248291795&_u=aGBAAEIIAAAAAC~&z=1103936782
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:20 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j92&tid=UA-3815385-4&cid=627043016.1629122361&jid=248291795&_u=aGBAAEIIAAAAAC~&z=1103936782
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:20 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
fpdata.js
gabg.hit.gemius.pl/
278 B
392 B
Script
General
Full URL
https://gabg.hit.gemius.pl/fpdata.js?href=media.framar.bg
Requested by
Host: gabg.hit.gemius.pl
URL: https://gabg.hit.gemius.pl/xgemius.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
78.128.6.34 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-34.telehouse.bg
Software
GHC /
Resource Hash
827cb6489a9f1ca31903ded44357bbffa902d97fb73ec5e091b37d689f8ae58f

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:20 GMT
last-modified
Mon, 16 Jul 2012 10:03:40 GMT
server
GHC
etag
PRIVATE7520710249
p3p
CP="NOI DSP COR NID PSAo OUR IND"
cache-control
private, max-age=2592000
cross-origin-resource-policy
cross-origin
accept-ranges
none
content-type
application/x-javascript
content-length
278
expires
Wed, 15 Sep 2021 13:59:20 GMT
rexdot.js
gabg.hit.gemius.pl/__/_1629122360956/
Redirect Chain
  • https://gabg.hit.gemius.pl/_1629122360956/rexdot.js?l=100&id=zU.qIWOQoxzyknwChvgmk8Pcj_6KFtugMqYqcXv5DtL.X7&et=view&hsrc=1&initsonar=1&extra=&eventid=0&fr=1&tz=-120&fv=-&href=https%3A%2F%2Fmedia.fr...
  • https://gabg.hit.gemius.pl/__/_1629122360956/rexdot.js?l=100&id=zU.qIWOQoxzyknwChvgmk8Pcj_6KFtugMqYqcXv5DtL.X7&et=view&hsrc=1&initsonar=1&extra=&eventid=0&fr=1&tz=-120&fv=-&href=https%3A%2F%2Fmedia...
169 B
477 B
Script
General
Full URL
https://gabg.hit.gemius.pl/__/_1629122360956/rexdot.js?l=100&id=zU.qIWOQoxzyknwChvgmk8Pcj_6KFtugMqYqcXv5DtL.X7&et=view&hsrc=1&initsonar=1&extra=&eventid=0&fr=1&tz=-120&fv=-&href=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=SUvWkAN.KMl5HPQim.4GxO_WRjh.ZaqVI1.0cyyNArr.G7&vis=1&fpcap=
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
78.128.6.34 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-34.telehouse.bg
Software
GHC /
Resource Hash
b959f2fbface7fc1e8968fe402772d4a3c82b930e3f6af03bda81bffcda3f859

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:21 GMT
server
GHC
p3p
CP="NOI DSP COR NID PSAo OUR IND"
cache-control
no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
accept-ranges
none
content-type
application/x-javascript
content-length
169
expires
Sun, 15 Aug 2021 13:59:21 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:20 GMT
server
GHC
p3p
CP="NOI DSP COR NID PSAo OUR IND"
location
/__/_1629122360956/rexdot.js?l=100&id=zU.qIWOQoxzyknwChvgmk8Pcj_6KFtugMqYqcXv5DtL.X7&et=view&hsrc=1&initsonar=1&extra=&eventid=0&fr=1&tz=-120&fv=-&href=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&ref=&screen=1600x1200r1000&col=24&window=1600x1200&ltime=0&lsdata=-NOTSUP&fpdata=SUvWkAN.KMl5HPQim.4GxO_WRjh.ZaqVI1.0cyyNArr.G7&vis=1&fpcap=
cache-control
no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
accept-ranges
none
content-length
0
expires
Sun, 15 Aug 2021 13:59:20 GMT
/
media.framar.bg/
838 B
1 KB
XHR
General
Full URL
https://media.framar.bg/?get_assets=1
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
85308bd0681cf8ccfcfbc231343ccd517beb8fa87ec8983b25911587def6bf8d
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
media.framar.bg
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
Cookie
framar_v7_2018=lk0mobk9964fan0klrpln75lu2; _ga=GA1.2.627043016.1629122361; _gid=GA1.2.701776015.1629122361; _gat=1; __gfp_64b=SUvWkAN.KMl5HPQim.4GxO_WRjh.ZaqVI1.0cyyNArr.G7|1629122360
Connection
keep-alive
Referer
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Accept
*/*
Referer
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
485
X-XSS-Protection
1; mode=block
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/html; charset=windows-1251
Cache-Control
no-store, no-cache, must-revalidate max-age=600, private, must-revalidate
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Keep-Alive
timeout=2, max=798
Expires
Thu, 19 Nov 1981 08:52:00 GMT
insmedia.php
adsys.insert.bg/ Frame 3BAC
3 KB
1 KB
Document
General
Full URL
https://adsys.insert.bg/insmedia.php?adsid=42
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.132.86.60 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
s2.valival.com
Software
Apache /
Resource Hash
f5a7f3ae46790934d7d73c03987d4a998c35cbdab3b32cd44b514f90fea54916

Request headers

Host
adsys.insert.bg
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://media.framar.bg/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://media.framar.bg/

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
Server
Apache
Cache-Control
max-age=5 max-age=5
Last-Modified
Mon, 16 Aug 2021 13:59:21 GMT
Vary
Accept-Encoding
Content-Encoding
gzip
Expires
Mon, 16 Aug 2021 13:59:26 GMT
Content-Length
876
Keep-Alive
timeout=2, max=800
Connection
Keep-Alive
Content-Type
text/html; charset=utf-8
dr-stoicho-katsarov-video-obrushtenie-vaccina.jpg
static.framar.bg/thumbs/4/video/
8 KB
9 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/dr-stoicho-katsarov-video-obrushtenie-vaccina.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
71e81530f4047cfe4d5dea50d7c3ef6d93efcf5d5b73aee5c71deec01b19e87d
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
8271
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 17 May 2021 23:00:08 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=797
Expires
Tue, 16 Aug 2022 13:59:21 GMT
180827151250screenshot_2.png
static.framar.bg/thumbs/4/video/
26 KB
26 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/180827151250screenshot_2.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
fe7ba6878c2a97b24c7d5e94f3a65e27b7bad627c521c461fd8b044598b31247
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
26349
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 12 Jun 2019 14:25:26 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=797
Expires
Tue, 16 Aug 2022 13:59:21 GMT
video-lekcia-prof-kantardzhiev-vaccini-covid-19.jpg
static.framar.bg/thumbs/4/video/
6 KB
6 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/video-lekcia-prof-kantardzhiev-vaccini-covid-19.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
b8f45c32872215c5067c4ee8370911aba19b8b12b9d65558c9d326ac94851e89
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
5954
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 28 Jan 2021 00:00:07 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Expires
Tue, 16 Aug 2022 13:59:21 GMT
doktor-stanislav-morfov-varna.jpg
static.framar.bg/thumbs/4/video/
12 KB
13 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/doktor-stanislav-morfov-varna.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
9bdd30986e675e3bf5f2a6224998df0f43b29456d7508b5827c26245508d1036
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
12644
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 21 Dec 2020 20:46:53 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Expires
Tue, 16 Aug 2022 13:59:21 GMT
zahranvane-bebe-kurmache-video.jpg
static.framar.bg/thumbs/4/video/
7 KB
8 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/zahranvane-bebe-kurmache-video.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
5473a1b5a3fa5443822b82f5b2fd19b1e6b8aa5f2c005f127cb524e331e2ba11
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
7583
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 21 Dec 2020 20:44:19 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Expires
Tue, 16 Aug 2022 13:59:21 GMT
kakvo-e-da-si-dobrovolec-kauza.jpg
static.framar.bg/thumbs/4/video/
8 KB
9 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/kakvo-e-da-si-dobrovolec-kauza.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
c1ef99d0be8824b94143a33208c1c30545c028ab365666d87fa109b50285a27a
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
8642
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 21 Dec 2020 20:43:01 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Expires
Tue, 16 Aug 2022 13:59:21 GMT
wallpaper_1000x1920_video-min.jpg
adsys.insert.bg/adsstore/ Frame 3BAC
129 KB
129 KB
Image
General
Full URL
https://adsys.insert.bg/adsstore/wallpaper_1000x1920_video-min.jpg
Requested by
Host: adsys.insert.bg
URL: https://adsys.insert.bg/insmedia.php?adsid=42
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.132.86.60 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
s2.valival.com
Software
Apache /
Resource Hash
baf754e587991454813c323a18df68165d30fd3dcb53c9326f3a6696e93d2f31

Request headers

Referer
https://adsys.insert.bg/insmedia.php?adsid=42
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
Last-Modified
Fri, 04 Oct 2019 10:10:27 GMT
Server
Apache
Content-Type
image/jpeg
Cache-Control
max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=799
Content-Length
132214
Expires
Mon, 23 Aug 2021 13:59:21 GMT
insert.bg_box_sign.png
adsys.insert.bg/inadsys_media_codes/ Frame 3BAC
175 B
488 B
Image
General
Full URL
https://adsys.insert.bg/inadsys_media_codes/insert.bg_box_sign.png
Requested by
Host: adsys.insert.bg
URL: https://adsys.insert.bg/insmedia.php?adsid=42
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.132.86.60 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
s2.valival.com
Software
Apache /
Resource Hash
8998caec458197a509fccf1e993ba0fd7284d36c1f7de3d6fdd549eceaf3b6ac

Request headers

Referer
https://adsys.insert.bg/insmedia.php?adsid=42
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
Last-Modified
Tue, 19 Jun 2012 10:44:14 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=800
Content-Length
175
Expires
Mon, 23 Aug 2021 13:59:21 GMT
video-lekcia-prof-kantardzhiev-vaccini-covid-19.jpg
static.framar.bg/thumbs/4/video/
6 KB
6 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/video-lekcia-prof-kantardzhiev-vaccini-covid-19.jpg
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
b8f45c32872215c5067c4ee8370911aba19b8b12b9d65558c9d326ac94851e89
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
5954
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 28 Jan 2021 00:00:07 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=798
Expires
Tue, 16 Aug 2022 13:59:21 GMT
dr-stoicho-katsarov-video-obrushtenie-vaccina.jpg
static.framar.bg/thumbs/4/video/
8 KB
9 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/dr-stoicho-katsarov-video-obrushtenie-vaccina.jpg
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
71e81530f4047cfe4d5dea50d7c3ef6d93efcf5d5b73aee5c71deec01b19e87d
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
8271
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 17 May 2021 23:00:08 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=798
Expires
Tue, 16 Aug 2022 13:59:21 GMT
zahranvane-bebe-kurmache-video.jpg
static.framar.bg/thumbs/4/video/
7 KB
8 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/zahranvane-bebe-kurmache-video.jpg
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
5473a1b5a3fa5443822b82f5b2fd19b1e6b8aa5f2c005f127cb524e331e2ba11
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
7583
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 21 Dec 2020 20:44:19 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=798
Expires
Tue, 16 Aug 2022 13:59:21 GMT
kakvo-e-da-si-dobrovolec-kauza.jpg
static.framar.bg/thumbs/4/video/
8 KB
9 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/kakvo-e-da-si-dobrovolec-kauza.jpg
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
c1ef99d0be8824b94143a33208c1c30545c028ab365666d87fa109b50285a27a
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
8642
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 21 Dec 2020 20:43:01 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=796
Expires
Tue, 16 Aug 2022 13:59:21 GMT
doktor-stanislav-morfov-varna.jpg
static.framar.bg/thumbs/4/video/
12 KB
13 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/doktor-stanislav-morfov-varna.jpg
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
9bdd30986e675e3bf5f2a6224998df0f43b29456d7508b5827c26245508d1036
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
12644
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Mon, 21 Dec 2020 20:46:53 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/jpeg
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=798
Expires
Tue, 16 Aug 2022 13:59:21 GMT
180827151250screenshot_2.png
static.framar.bg/thumbs/4/video/
26 KB
26 KB
Image
General
Full URL
https://static.framar.bg/thumbs/4/video/180827151250screenshot_2.png
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
fe7ba6878c2a97b24c7d5e94f3a65e27b7bad627c521c461fd8b044598b31247
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:21 GMT
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
26349
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Wed, 12 Jun 2019 14:25:26 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
Cache-Control
max-age=315360000, public
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=796
Expires
Tue, 16 Aug 2022 13:59:21 GMT
fbevents.js
connect.facebook.net/en_US/
98 KB
25 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c4243f7f5aa95631ca62fab376c3804859e808b66d373d07270872d23b8b081b
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25944
x-xss-protection
0
pragma
public
x-fb-debug
+9KYe5hYr71gAVQ9qEkFt3KqtMWoso2/aIlsCzCOSIiYdY+p6fO28Wtlg3pQAUFotVDE0Pe9u8zL4BkDvFyWiw==
x-fb-trip-id
2050670934
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Mon, 16 Aug 2021 13:59:23 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
186973598581191
connect.facebook.net/signals/config/
254 KB
72 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/186973598581191?v=2.9.44&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a05cc5ac54a292c6da7e975ab07ffb9a9d6a40bf16e808e8288f36ba643757b0
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
74045
x-xss-protection
0
pragma
public
x-fb-debug
yODIoK4zT6doyb1qeTHS2uJJfwNPj79vVYnuRmBoIcv8nlqebjmuZg5pmNaQaNr7xBr8AGm+8dx+ZbWsfWMGNA==
cross-origin-embedder-policy-report-only
require-corp;report-to="coop_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Mon, 16 Aug 2021 13:59:23 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/
44 B
147 B
Image
General
Full URL
https://www.facebook.com/tr/?id=186973598581191&ev=PageView&dl=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&rl=&if=false&ts=1629122363750&sw=1600&sh=1200&v=2.9.44&r=stable&ec=0&o=30&fbp=fb.1.1629122363749.1870098055&it=1629122363719&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:23 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 16 Aug 2021 13:59:23 GMT
/
media.framar.bg/
586 B
1017 B
XHR
General
Full URL
https://media.framar.bg/?get_banners=1,3,97,98,2
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
79.124.75.51 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-75-51.telehouse.bg
Software
Apache /
Resource Hash
fad57ffa341bfb8f1762f9e4c59c0cf4839b6141c11ae41b7aad142b450f0619
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
media.framar.bg
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors
Accept
application/json, text/javascript, */*; q=0.01
Cache-Control
no-cache
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
Cookie
framar_v7_2018=lk0mobk9964fan0klrpln75lu2; _ga=GA1.2.627043016.1629122361; _gid=GA1.2.701776015.1629122361; _gat=1; __gfp_64b=SUvWkAN.KMl5HPQim.4GxO_WRjh.ZaqVI1.0cyyNArr.G7|1629122360; _fbp=fb.1.1629122363749.1870098055
Connection
keep-alive
Referer
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:24 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
275
X-XSS-Protection
1; mode=block
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Server
Apache
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/html; charset=windows-1251
Cache-Control
no-store, no-cache, must-revalidate max-age=600, private, must-revalidate
Permissions-Policy
microphone=(), camera=()
Content-Security-Policy
frame-ancestors https://*.framar.bg/ 'self';
Keep-Alive
timeout=2, max=800
Expires
Thu, 19 Nov 1981 08:52:00 GMT
gpt.js
www.googletagservices.com/tag/js/
72 KB
25 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js?_=1629122360718
Requested by
Host: static.framar.bg
URL: https://static.framar.bg/js/vendor/jquery-2.1.3.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec4dc85fedc0e2bb8d0810a195eaa27a05ea3c2b518b8acf31900fef60a91b8f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"960 / 0 of 1000 / last-modified: 1629112273"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25226
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:24 GMT
pubads_impl_2021081001.js
securepubads.g.doubleclick.net/gpt/
329 KB
115 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js?_=1629122360718
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
sffe /
Resource Hash
79cc39ab51de99510d98e22dfc56bd456b3ffbb29671e3d2e61719ee50792565
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Aug 2021 08:39:05 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
117457
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:24 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/
116 B
753 B
XHR
General
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=media.framar.bg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js?_=1629122360718
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
7f3c5f63ccbd1ec90451543520be5271f6d289dc43f7888738c6d3949f519c2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 16 Aug 2021 13:59:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
96
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:24 GMT
/
www.facebook.com/tr/
0
15 B
Ping
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryjlD63rOGZbdy787i

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Mon, 16 Aug 2021 13:59:24 GMT
content-type
text/plain
access-control-allow-origin
https://media.framar.bg
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
content-length
0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
integrator.js
adservice.google.de/adsid/
107 B
853 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=media.framar.bg
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 16 Aug 2021 13:59:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
317 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=media.framar.bg
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 16 Aug 2021 13:59:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
118 KB
31 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3056001403100035&correlator=1449470939520892&output=ldjh&impl=fifs&eid=31062271%2C31062276%2C31062280%2C22316437%2C31062227%2C20211866%2C31062181%2C31062216%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=21812339056%2C300-100-list&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x100&cookie_enabled=1&bc=31&abxe=1&lmt=1629122364&dt=1629122364490&dlt=1629122360253&idt=4195&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=2579&adks=1989961604&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&vis=1&dmc=8&scr_x=0&scr_y=0&psz=617x59&msz=617x0&ga_vid=627043016.1629122361&ga_sid=1629122364&ga_hid=1289824896&ga_fc=false&fws=4&ohw=1600&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
a0d935a7299a2841d3faefd10da9bcb94b5c14f7b62f02a8c9396cface3d1a08
Security Headers
Name Value
Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKTT2N7ZtfICFYPhuwgdTqMO9g&gqi=&layout=/sadbundle/%24csp%253Der3%24/15763118691896762517/index.html
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKTT2N7ZtfICFYPhuwgdTqMO9g&gqi=&layout=/sadbundle/%24csp%253Der3%24/15763118691896762517/index.html
content-encoding
br
x-content-type-options
nosniff
google-creative-id
-1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32190
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
date
Mon, 16 Aug 2021 13:59:24 GMT
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://media.framar.bg
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 57D4
6 KB
3 KB
Document
General
Full URL
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://media.framar.bg/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://media.framar.bg/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Mon, 16 Aug 2021 13:59:24 GMT
expires
Tue, 16 Aug 2022 13:59:24 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
securepubads.g.doubleclick.net/gampad/
13 KB
7 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3056001403100035&correlator=1449470939520892&output=ldjh&impl=fifs&eid=31062271%2C31062276%2C31062280%2C22316437%2C31062227%2C20211866%2C31062181%2C31062216%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=21812339056%2C300-250-upperright&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1629122364&dt=1629122364496&dlt=1629122360253&idt=4195&frm=20&biw=1600&bih=1200&oid=3&adxs=975&adys=190&adks=583895516&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x17&msz=300x0&ga_vid=627043016.1629122361&ga_sid=1629122364&ga_hid=1289824896&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
4301cd45f98ed5527e5f7124672421b9f331172be8e928691a475d9f4a58bc77
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7589
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://media.framar.bg
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
16 KB
9 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3056001403100035&correlator=1449470939520892&output=ldjh&impl=fifs&eid=31062271%2C31062276%2C31062280%2C22316437%2C31062227%2C20211866%2C31062181%2C31062216%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=21812339056%2CBaner300600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cookie_enabled=1&bc=31&abxe=1&lmt=1629122364&dt=1629122364499&dlt=1629122360253&idt=4195&frm=20&biw=1600&bih=1200&oid=3&adxs=975&adys=1131&adks=709049632&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fmedia.framar.bg%2F%25D0%25B2%25D0%25B8%25D0%25B4%25D0%25B5%25D0%25BE&vis=1&dmc=8&scr_x=0&scr_y=0&psz=294x59&msz=294x0&ga_vid=627043016.1629122361&ga_sid=1629122364&ga_hid=1289824896&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
d7d86060c574ba0aec7350fe1cb355ab8cde4827a5ee318640292cb346e649dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8735
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://media.framar.bg
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E2E1
6 KB
3 KB
Document
General
Full URL
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://media.framar.bg/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://media.framar.bg/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Mon, 16 Aug 2021 13:59:24 GMT
expires
Tue, 16 Aug 2022 13:59:24 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/
72 KB
27 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7761979199bf20d25fe4726392f9e6c268295e5d179b2bb5a683cb10fb6ad0d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1628854342869989"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27733
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:25 GMT
sodar
pagead2.googlesyndication.com/getconfig/
11 KB
9 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021081001&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01e86200726b4e98454cfa57e339174d75ec58979f340aeac70c647c2aac2848
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8498
x-xss-protection
0
index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/ Frame DE36
14 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
836f1dfab32f0c5396a51e712bc4388ba740ec4f2158964170f3dba614d13db6
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sadbundle/$csp%3Der3$/15763118691896762517/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-type
text/html
access-control-allow-origin
*
content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3313
date
Tue, 10 Aug 2021 21:14:01 GMT
expires
Wed, 10 Aug 2022 21:14:01 GMT
last-modified
Thu, 25 Feb 2021 12:33:44 GMT
x-content-type-options
nosniff
x-dns-prefetch-control
off
content-encoding
gzip
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
492324
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
adview
securepubads.g.doubleclick.net/pagead/ Frame 6DA4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CVtqTPG8aYaTFI4PD7_UPzsa6sA-zs7esZOCR9cfDDc-v46rDIhABIPyMznJgqbC-gMwBoAGFwMbgA8gBCakCfB8N2gvEsz7gAgCoAwHIAwiqBPABT9C4dgkgQNJDAXBe0n2c9WeC3l3qkgc0uw6uG3H0h7eXELMKf4Y2-YCOpAwJQBSNE6qFBO2ViroZMYsBPuQaFtETYz7PjBUiXA96A64lLFytUq-Ey-TMliBFh8-Z1erBBUAL2Evhd2jOTDuss6Zl_IrcuHHZTsZFZ3u0MERrN793mxOdLgr61cPNqgdm4gR40t4ma3KvJs53a6EsVw5_LzwO6Hw-RlyhlCX-99m_AN0yUFs7vFxqYyKZpUKvmLH3f2NO-GSsYTEliLSE8gvwQE82EJ1bhpjHJNOZvEQ4cE5Nou7zV42fDKdjPL7wxqvZwATTvIjJEeAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAfjv7kfqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEM3SGNIICQiI4YAQEAEYHYAKAcgLAdgTDYgUAdAVAYAXAbIXHgocCAASFHB1Yi0zNTU1NTYwOTA5Nzc2MzI1GIuFcA&sigh=fE6UdEldWhY&template_id=419
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
/
Resource Hash

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/ Frame 6DA4
18 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/abg_lite_fy2019.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:57:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
109
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7614
x-xss-protection
0
server
cafe
etag
9899176843389144697
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:57:36 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame 6DA4
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/window_focus_fy2019.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:52:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
390
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1339
x-xss-protection
0
server
cafe
etag
2275704724217174249
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:52:55 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6DA4
124 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1628854326415524"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38195
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:25 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame 6DA4
14 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:57:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
89
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6204
x-xss-protection
0
server
cafe
etag
11055049251678278959
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:57:56 GMT
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:25 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 9CCC
143 B
226 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Mon, 16 Aug 2021 13:16:33 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
2572
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 6DA4
205 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6b377ab6c06360a74771ad2422411789491e1751e8e73aa113a2ef0c7809d09d

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame DE36
9 KB
3 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 15 Aug 2021 19:35:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
66215
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3271
x-xss-protection
0
server
cafe
etag
7483759447172721109
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Mon, 16 Aug 2021 19:35:50 GMT
addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame DE36
26 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 12:37:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4912
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10382
x-xss-protection
0
server
cafe
etag
12806417668659483808
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Tue, 17 Aug 2021 12:37:33 GMT
css
fonts.googleapis.com/ Frame DE36
22 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Prompt:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&cb=1614256282
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d90d26b6ea47e7fea82b6ce3eb344233db9053cb45e55f25dfb3c320ffc599ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 16 Aug 2021 13:59:25 GMT
server
ESF
date
Mon, 16 Aug 2021 13:59:25 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 16 Aug 2021 13:59:25 GMT
gsap_3.2.4_min.js
s0.2mdn.net/ads/studio/cached_libs/ Frame DE36
57 KB
23 KB
Script
General
Full URL
https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23276
x-xss-protection
0
last-modified
Thu, 05 Mar 2020 03:53:22 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 16 Aug 2021 13:59:25 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame E9DE
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/224/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://media.framar.bg/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://media.framar.bg/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5029
date
Mon, 16 Aug 2021 08:23:52 GMT
expires
Tue, 16 Aug 2022 08:23:52 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
20133
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 8349
783 B
532 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
02ce38f5b8d88c0ab23184d295bae3fe2e4b6c793efac6c20c3fc1fa186678ce
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-K23RA2T5EvwvfoLA6qokEg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://media.framar.bg/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://media.framar.bg/

Response headers

expires
Mon, 16 Aug 2021 13:59:25 GMT
date
Mon, 16 Aug 2021 13:59:25 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-K23RA2T5EvwvfoLA6qokEg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
513
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
si
googleads.g.doubleclick.net/pagead/drt/ Frame 9CCC
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUk_wtioBeFezv5d6xbzHbThm2Mx47YLteO1d-UU_574wkSYXGuBjCy-Q_ONwpI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Mon, 16 Aug 2021 13:59:25 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Mon, 16-Aug-2021 14:59:25 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Mon, 16 Aug 2021 13:59:25 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Mon, 16 Aug 2021 13:59:25 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
pagead2.googlesyndication.com/bg/ Frame E9DE
35 KB
13 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c9db938215f2ff34f7d14783a3dfeaa79c4d787d7c2db6eeb5fbb9fd48450056
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:07:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
3135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13302
x-xss-protection
0
last-modified
Tue, 03 Aug 2021 09:38:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 16 Aug 2022 13:07:10 GMT
0426a9bef2466440fe01d96ff92d2bc6.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/ Frame DE36
7 KB
7 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/0426a9bef2466440fe01d96ff92d2bc6.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08d4e132e8ad9e23f61a5202ff77a2595e11deb35718592c7b09bee6666da084
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
492323
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6762
x-xss-protection
0
last-modified
Thu, 25 Feb 2021 12:33:44 GMT
server
sffe
date
Tue, 10 Aug 2021 21:14:02 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 10 Aug 2022 21:14:02 GMT
imagesnrzkycjy9je41fextlzb.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/ Frame DE36
1 KB
1 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/imagesnrzkycjy9je41fextlzb.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15763118691896762517/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e98a1273451d9c990f69b8e455cc3119feca8af8e0f20dc0b7c4982217550458
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
492323
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1136
x-xss-protection
0
last-modified
Thu, 25 Feb 2021 12:33:44 GMT
server
sffe
date
Tue, 10 Aug 2021 21:14:02 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 10 Aug 2022 21:14:02 GMT
-W_8XJnvUD7dzB2Ck_kIaWMu.woff2
fonts.gstatic.com/s/prompt/v5/ Frame DE36
17 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/prompt/v5/-W_8XJnvUD7dzB2Ck_kIaWMu.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Prompt:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&cb=1614256282
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
797615e58c75e693b00cfe7d92ed4d478056e55c37d8429ad9332166ad3a4cd8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
null
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 10 Aug 2021 07:35:15 GMT
x-content-type-options
nosniff
age
541450
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17812
x-xss-protection
0
last-modified
Thu, 01 Apr 2021 22:08:34 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 10 Aug 2022 07:35:15 GMT
-W__XJnvUD7dzB2KYNod.woff2
fonts.gstatic.com/s/prompt/v5/ Frame DE36
17 KB
17 KB
Font
General
Full URL
https://fonts.gstatic.com/s/prompt/v5/-W__XJnvUD7dzB2KYNod.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Prompt:100,100italic,200,200italic,300,300italic,regular,italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&cb=1614256282
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e454e46db2f4864eb2414775901072f5c932fe3f7aaa3c32ad888ececf2b831
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
null
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 10 Aug 2021 01:13:14 GMT
x-content-type-options
nosniff
age
564371
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17664
x-xss-protection
0
last-modified
Thu, 01 Apr 2021 22:07:24 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 10 Aug 2022 01:13:14 GMT
gen_204
pagead2.googlesyndication.com/pagead/
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021081001&jk=3056001403100035&bg=!Li2lLWnNAAbOj6irzo87ACkAdvg8WpMIUQ3T5SuGcOT_BCYA7dOaAvt2rgkk1SZ7JIBptAhMnTrvCAIAAAC8UgAAAAdoAQeZAnz0Q7m7KsBkI1ColesvAG3nhsXdUC8P7-h95I-0NXAX0IYz0-xZzIhA96CFP-uObM9U7r_Y5t0P3A6ei-dqmsFPe83lGJg5iQSZWjx_quyQxX0wjBd7wOxph2-jY2mjsc6ee8A8BDLibHZt94rGe-yWx8q8FhlDxOdy0ThWSmPzOZOmDVBUUfhqyEUo0epH4YUyRIlYqsreX22G8sEFZ218xXMw8lMgZxA2lWbydteODLe9GQjY10S3r5ew6WtPGiRNHtO2bv7hEhNLyjHpIcbcTrW5Ovtb1k-ABgwqhqLzvcn0ueG-Z0GaSU_CwqObVhLBsayxnDTx-SxZKyjbDgb8UuQDKXCw4nP7IKiKdsEXZnmCjRkTmCgS-HAKl3Ykes3pL9JAYcixkj-lR-rEwHLKHnyU1a0kIWPsC4inQhhEXReC6nwFq26wimD-K4x8wewPZs_aOEbVcnujt2QO9YqU8KhngiFg1317JlSIzlR2Oo5MXaEL3eSXloypkrPaCElAHT6PY4gD4vT-R6WTBpejAyrZy3idO3cF0leZZXBLKxTsXh3Wz1bAmXFo4fQJc5McSXgoORxdFfc2J4CGmh8e_aO5y5WLO2Aq8-IBxTYunDGXmunwiy9DEZrt6XzCBS3zDgJsNuqVPnFCG2X3vl545lGpbkmi0pXXg9CtMEuhbiYANtWrt9kGmTjr-sCFLqU-_7Lf8GLSgvISliulcyw2abM-VNYTJ_-KK5q8gW-Fjnu7qDcQ-f2RUIiMmEBIqSa0PRj_Mi2_BC27-DoW3S0PCTVE1UMYo2djxRVMgr6x6AZ8BA41PTyRrwPOm34n3K7OOdrahhqFEOoYzNw
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://media.framar.bg/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 11DF
6 KB
3 KB
Document
General
Full URL
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://media.framar.bg/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://media.framar.bg/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Mon, 16 Aug 2021 13:59:24 GMT
expires
Tue, 16 Aug 2022 13:59:24 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pixel
googleads.g.doubleclick.net/xbbe/ Frame EA96
624 B
299 B
Document
General
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTcoQIQmuqiAhjmrPmuATAB&v=APEucNVIlqLb5vhZ7BOwIKbMRYWZWI_IzfG7AlyEvFUD6ynTid46HS50ARTNkAW1Qu7Nz6rjN7XXpPaebDApTzk-jbIxmka64O4_Dnuh7Ag4EtVkve2r1jUawXEgDqKp8aRyzTmH9ydL1kwYhZp7WWnMvYHFecl08mixvXCM6faC0BI1R_hc2N0
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=CNTcoQIQmuqiAhjmrPmuATAB&v=APEucNVIlqLb5vhZ7BOwIKbMRYWZWI_IzfG7AlyEvFUD6ynTid46HS50ARTNkAW1Qu7Nz6rjN7XXpPaebDApTzk-jbIxmka64O4_Dnuh7Ag4EtVkve2r1jUawXEgDqKp8aRyzTmH9ydL1kwYhZp7WWnMvYHFecl08mixvXCM6faC0BI1R_hc2N0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUk_wtioBeFezv5d6xbzHbThm2Mx47YLteO1d-UU_574wkSYXGuBjCy-Q_ONwpI; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Mon, 16 Aug 2021 13:59:25 GMT
server
cafe
cache-control
private
content-length
276
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Mon, 16 Aug 2021 13:59:25 GMT
ad
googleads.g.doubleclick.net/dbm/ Frame 11DF
61 KB
25 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CMRbpS7RwrDeLg56QL7-tQ38QsZvOMz4m3S9aUSjkg7qxGntn01eRIm7ySfscwXgO4FG-FIbSsml_kTxtnI7YaUyA3a04cMr4vJMxo1RcfN2yzUbvyKYwtPI1aIuagy8-O9CeydfXnTJCj6C4keyJpxrYydQ&dbm_d=AKAmf-BjRnFrKNxSIcJ2Y12_6YaX31DfSZ4Rn84oi6ydmLODSZiRaYPp_bAXpxv1mo48G2dgCqXPUkF3js-qoLKYfw1kgFgycKFo3dydVRxmK62b2Y2Qa62YZN6e90ZKc_aYu9twAPAaAE7UoY3Agl3I6gw0J1iV9jBY696vjbNBEoSBE8S7izbZKy1ABHtP59BESNHI3-rPTsBcwbNlk4EnWH1i3wHGVxXgFdMRaKBa8vlu25FCigFZ9m1sITNCZ_Nae5__Fi3yRkJI-WfEwdRx7KVIxf35nFTscMEKD_e7Vru0fgA-qJqMboH_C-kiSg2ycsn5PHzWHZYzPV-g1q46nOQvYjix1lnFvErC5Fdy5zFW5uySyKmnJnRs9yRHdGmxujKZVvttBOQCgdQUxx1f0Xy11-FFu8BNLkBZeFVIOdPA7PCHq1806ZIFGKHDQZR176avF33djnmdY7MZzKJDsmgXoGMr2CcUA-jrGwQK7VWSLGMqaQoey05Oc6W7n-6p2Rlj3PwuVvuSgk1PEx_ouDTUe3C7B4d14CdZQgBBwOMN3c3sFq0N5C03f6sZuGXjBU5-C9VuGHJo0EM5y_ytVw8gnWRyaTMiOiejMsLY_RwZyrafhsNGhAHkI9IyOr5aoaGyGc6fWiOUKu19L9c4Bj-BTDxbz4zgqMdRn-6dTP8XRNDi4OS0QzARWqv72vAKFyyRhErzHVo-J1epkMR1E-foyTUmNN8s4NQFyABqLch6VNcTEqRy8PZJtRrWA7he-mPUdANTCv9JQqHJFccsGgFBNpqiuSzUNw-nA0AXE6-mxEJqsZIBhqdoonpcyxfVlnqt830aBYdC0p3ksm-cHQmHSlGJ2C2vPdrKle4d24RFRA3NaLYk1_qeWt8YS5w9KS60s4UNtJJ2mQ0DcGbS8C9mNU4MVxbjhaclUvnVA8YLnhSbdjtDEmNpRxPiw2WJsH8UAJHahzatjhrF_5ekuvcIR4bvpJmLtvGrVndikybDdAqzMXR0ChfmIyZBtFi9Tx9cSL1jURMQ9Ra9bA6tbuyrhM5d2YyFfYddV9TvMd0lM7C9yD8pPIRirQ8nb5DsB_hOkVt1_QXUxX18sLM1VXYEK4HB2EtSh52DiXVPnxc74uMsidpKJCxJR7G1c-ZDSPw5E37x1rFoL0ISaRiu3-4aaXEHu--6L5jgufG8-iYQHJ87kY4g80sysPMmdR0upjhRa4LjPmcy564gtYX5G4sfa-ho_LzcjDlCwIchA7p0pIa4wyS2BqFtIw-3ZNwE9hQdISS0DOGZlkvjPQLCN9FqXD4W-483mUwF8r1Szscvo1v_IInsUZ-klYDA2O3IpA42YDEOHAYGt-t0rE2VblNkNwNDYq4GJcZOA9fTbjFivonb0xB0BHzXx1XuSGArTQyskqLxGLIqwRGt5IJRBKaEb82cIPygIrszt4Rw9hTb260nZ1HHlu1Fs6gL2wXpN4hc5Kio_QD9vI_JNEpmTnQh8dPoiWkne9uhsdcL5f3vUuN0cszyNI0tZCRceuMzk3Wg21E7wW0nm0FaDUEBWgUskKBWZ2Yq1iV7WInVhejRbIBUah8_k-T-bP93rogoFJ5eN-cNDh1HCiavg_ck02kSfYVp9YYLhJp_xJOnyCMvkzjQIEY0lXGmOtdXLP3ysYQwxNFvJ7lyH7QAYOfNQEBtLI5Ps6JGd8xjlTvR_vtxyA7xsrG5zpQx5VLZSdvLlcs1uEr-QRQu0l1Eht3TQy1XvI1R97vlwmZc0OpSdv_J-LJ1XUQdi9rTHwjIOEcS_ldSJ2EpU1W4RK5q1WiyzUp6kiNomiOTnLKavJBfFnqx-vWO6Jz8xxuWSaxQ7ufpR3gAKr6WKFyjMn6kCQ_kmcZ2hk8_6n3Jy9-4hkqdCGm6LuayNeFc3Dpi9lJrTGnmk-PPI9SfzQELbnkM8dbiSMy59RZPQyNV7NGjQ7tvUr8kn11SdopncXQSECtgLudSNejcIcGgg92E2oQ-fQY5z8Hid7xeKvm6JqSarSMiJTiBoX9gLEEchohov8sBpQdA_jdKqM5SDp_FFdVboBEBExqIV2ERbjMkk_XuY7F60DRQW5jkOoe_5Y54w3LJtAH78zOgVBpdbSCC4nPWxo7sGMNMuzRZyu3hHG1uyH5AXjnb5FbRAjkSaafuEXDBr4WITYWWjFbLHPm8JNXHVvwKGdIOwnqAuQyvnECb6Xpqmib4jqdybaSslUQYOvRm_eGaMyaAjIuPKOOR5eWH9n4HWhhn4vpOMXbrBLXlCL2fTDsEGcRPGRxofoYX-qvDL45-_aQ3QMhsAXjZBIGdh8umbdXc_wxNqmUM7MfePA3j21n7_wOOxbyvqFzYRmHiwptoIdZsRHGzg4j356q444PaQDwLJDDpFWuxrQO70b7fQ8dAe0uL8PolgoTHY3pJ-kd2kNSiFEhP5augi1llYxlzm2ppt1iFtczQEtxLw-4_hg26iSAOXv2LQbDh8SgLdW28NyPCgO2L0KGjt0Tiyz9KTiYMqdD7FxzleZ5Dh_xmHboRwQAkBoQgvQe-zwEIgl4C7n1d2DFJwXNBDW0Yl-3vOCHDhDPDNnW1J7I3DHhEIjx092yV5WU74Whznw8IlB3fj2DE0jIzNmq4WXrUB7BhsgHFdXMcrwnVDkWqtYrGYM3NvHsDbEw_ZXHfiF0gFVtDLjt83_Y0gAzxmOyvXBk3WLuh0WGUtWPUTQPWpGqEFHuzze4Rdgsr-H_4mTqe0Mr33t1gpWNrxqRoTNp-nMeLDj0Vc5u99smVtZ2tGfulihmTbdUodf9c6_hQzt4AMbaPkvln3juqkENNqWJ5Bg26PyCpm5FRQ62nyHeZoh3TQikC82BwUifwMOfsqe_R50vzK7-9FdzD7GdJZiB50xDusrB2y3qEue5yBcEYQMpGX-o25foKCST58Dv-bJB-YGDlNxmfPYVzT1cnr9GihNVvNjHDSHu4YekMklM3oMtsKBVvglZtWxWmlC0_5qCmOuVJCWOrKJYryZCoFUmOcS8kHGJ9-EEsRhRSYqVCmrxletMu04YLRca1iFdpqiDnyKqGM-_3_w0_ePM3UueFQSBfgA-SKedsIxEorlk-Bmd58hp5KqqxfH92LtNTgMMNjMZ7XXztyyZ8sGfcZv8kD0ApQx-tCRRlGlNLlqUEHasNBCSa9VwCchcxKL8mZK0xQ7ArhhlBX9c1rHzHK3mf8Zk5JS6gZ9IMXSuIWBdW-MPALqU9cR5gwlHUzo25kTz16OeaMHPTqYSzAz_PQHPK9g4ZH8A0ko0pjlKbz2geVxnXRI1pIm5re1z16dayMdUSu2VupD9Ebmf0yLmuHaK47iJJxdmBHwKzJuP7HEG0rBcXYrAahJlhUBPH8gvqXX1POn7FeauktBlMrWTsILi1JPsm-gB89-RkuTZTlNYTPPdG5q7dyP17u-I&cid=CAASFeRo7rrrztcpFhn_iNEc3cku2sMz7A&rfl=1%2Chttps%253A%252F%252Fmedia.framar.bg%252F%240
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a8b2cd57c0602b17629ec21097850f362133ab46298e49f34e95d3bb3b4d6d99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25833
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 11DF
42 B
63 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DiVIinYVPDYP70tlTi5T2GJ6G0u2y6nu-0pVIxfh7ZXZuYs0VfrkrnLvZjkLYFqGQd-QMi89fpGN0TXcmkQTpunL9ZwDUdXwEPk5tDz-ZdsBGyDlM
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame 11DF
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/window_focus_fy2019.js
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:52:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
390
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1339
x-xss-protection
0
server
cafe
etag
2275704724217174249
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:52:55 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 11DF
124 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1628854326415524"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38195
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:25 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame 11DF
14 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:57:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
89
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6204
x-xss-protection
0
server
cafe
etag
11055049251678278959
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:57:56 GMT
l
www.google.com/ads/measurement/ Frame 11DF
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ7_5Y0YXJf5blksGE3fKRwEma7xfspv4V7isg2DuUtg5lzT7FbU_Ri-lZ-luSbyAfGxAEOrTqJl3hEe_-odt6xEaCCNA
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

rum
dsum-sec.casalemedia.com/ Frame EA96
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1&C=1
43 B
1014 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1&C=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTcoQIQmuqiAhjmrPmuATAB&v=APEucNVIlqLb5vhZ7BOwIKbMRYWZWI_IzfG7AlyEvFUD6ynTid46HS50ARTNkAW1Qu7Nz6rjN7XXpPaebDApTzk-jbIxmka64O4_Dnuh7Ag4EtVkve2r1jUawXEgDqKp8aRyzTmH9ydL1kwYhZp7WWnMvYHFecl08mixvXCM6faC0BI1R_hc2N0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:25 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 16 Aug 2021 13:59:25 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:25 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
308
Expires
Mon, 16 Aug 2021 13:59:25 GMT
rum
dsum-sec.casalemedia.com/ Frame EA96
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRpvPeMSt2QahLeTXAzJdwAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1
43 B
894 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTcoQIQmuqiAhjmrPmuATAB&v=APEucNVIlqLb5vhZ7BOwIKbMRYWZWI_IzfG7AlyEvFUD6ynTid46HS50ARTNkAW1Qu7Nz6rjN7XXpPaebDApTzk-jbIxmka64O4_Dnuh7Ag4EtVkve2r1jUawXEgDqKp8aRyzTmH9ydL1kwYhZp7WWnMvYHFecl08mixvXCM6faC0BI1R_hc2N0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:25 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 16 Aug 2021 13:59:25 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:25 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDHS3YLIJ02C7U4Umayu32o&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bounce
ib.adnxs.com/ Frame EA96
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESECcb6OMaO5nfxv2thQp1SXw&google_cver=1
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECcb6OMaO5nfxv2thQp1SXw%26google_cver%3D1
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECcb6OMaO5nfxv2thQp1SXw%26google_cver%3D1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTcoQIQmuqiAhjmrPmuATAB&v=APEucNVIlqLb5vhZ7BOwIKbMRYWZWI_IzfG7AlyEvFUD6ynTid46HS50ARTNkAW1Qu7Nz6rjN7XXpPaebDApTzk-jbIxmka64O4_Dnuh7Ag4EtVkve2r1jUawXEgDqKp8aRyzTmH9ydL1kwYhZp7WWnMvYHFecl08mixvXCM6faC0BI1R_hc2N0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.15 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:25 GMT
X-Proxy-Origin
185.216.34.99; 185.216.34.99; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
6a3c1a30-10b6-44fd-ae98-999cb148a5d6
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:25 GMT
X-Proxy-Origin
185.216.34.99; 185.216.34.99; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
9e36cc5d-1c03-4fcb-a9cc-858c4d8b1d0f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECcb6OMaO5nfxv2thQp1SXw%26google_cver%3D1
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame EA96
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIxNTU1NTc5NjI0MDQ2MzExNw%3D%3D
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIxNTU1NTc5NjI0MDQ2MzExNw%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTcoQIQmuqiAhjmrPmuATAB&v=APEucNVIlqLb5vhZ7BOwIKbMRYWZWI_IzfG7AlyEvFUD6ynTid46HS50ARTNkAW1Qu7Nz6rjN7XXpPaebDApTzk-jbIxmka64O4_Dnuh7Ag4EtVkve2r1jUawXEgDqKp8aRyzTmH9ydL1kwYhZp7WWnMvYHFecl08mixvXCM6faC0BI1R_hc2N0
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:25 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:25 GMT
X-Proxy-Origin
185.216.34.99; 185.216.34.99; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
7683ee9b-9acd-4c0d-aea7-18d1b1176926
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDIxNTU1NTc5NjI0MDQ2MzExNw%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
html_inpage_rendering_lib_200_273.js
s0.2mdn.net/879366/ Frame 11DF
169 KB
58 KB
Script
General
Full URL
https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 09:43:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
15334
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59842
x-xss-protection
0
last-modified
Wed, 30 Jun 2021 20:54:49 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 17 Aug 2021 09:43:51 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20210809/r20110914/elements/html/ Frame 11DF
8 KB
3 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210809/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CMRbpS7RwrDeLg56QL7-tQ38QsZvOMz4m3S9aUSjkg7qxGntn01eRIm7ySfscwXgO4FG-FIbSsml_kTxtnI7YaUyA3a04cMr4vJMxo1RcfN2yzUbvyKYwtPI1aIuagy8-O9CeydfXnTJCj6C4keyJpxrYydQ&dbm_d=AKAmf-BjRnFrKNxSIcJ2Y12_6YaX31DfSZ4Rn84oi6ydmLODSZiRaYPp_bAXpxv1mo48G2dgCqXPUkF3js-qoLKYfw1kgFgycKFo3dydVRxmK62b2Y2Qa62YZN6e90ZKc_aYu9twAPAaAE7UoY3Agl3I6gw0J1iV9jBY696vjbNBEoSBE8S7izbZKy1ABHtP59BESNHI3-rPTsBcwbNlk4EnWH1i3wHGVxXgFdMRaKBa8vlu25FCigFZ9m1sITNCZ_Nae5__Fi3yRkJI-WfEwdRx7KVIxf35nFTscMEKD_e7Vru0fgA-qJqMboH_C-kiSg2ycsn5PHzWHZYzPV-g1q46nOQvYjix1lnFvErC5Fdy5zFW5uySyKmnJnRs9yRHdGmxujKZVvttBOQCgdQUxx1f0Xy11-FFu8BNLkBZeFVIOdPA7PCHq1806ZIFGKHDQZR176avF33djnmdY7MZzKJDsmgXoGMr2CcUA-jrGwQK7VWSLGMqaQoey05Oc6W7n-6p2Rlj3PwuVvuSgk1PEx_ouDTUe3C7B4d14CdZQgBBwOMN3c3sFq0N5C03f6sZuGXjBU5-C9VuGHJo0EM5y_ytVw8gnWRyaTMiOiejMsLY_RwZyrafhsNGhAHkI9IyOr5aoaGyGc6fWiOUKu19L9c4Bj-BTDxbz4zgqMdRn-6dTP8XRNDi4OS0QzARWqv72vAKFyyRhErzHVo-J1epkMR1E-foyTUmNN8s4NQFyABqLch6VNcTEqRy8PZJtRrWA7he-mPUdANTCv9JQqHJFccsGgFBNpqiuSzUNw-nA0AXE6-mxEJqsZIBhqdoonpcyxfVlnqt830aBYdC0p3ksm-cHQmHSlGJ2C2vPdrKle4d24RFRA3NaLYk1_qeWt8YS5w9KS60s4UNtJJ2mQ0DcGbS8C9mNU4MVxbjhaclUvnVA8YLnhSbdjtDEmNpRxPiw2WJsH8UAJHahzatjhrF_5ekuvcIR4bvpJmLtvGrVndikybDdAqzMXR0ChfmIyZBtFi9Tx9cSL1jURMQ9Ra9bA6tbuyrhM5d2YyFfYddV9TvMd0lM7C9yD8pPIRirQ8nb5DsB_hOkVt1_QXUxX18sLM1VXYEK4HB2EtSh52DiXVPnxc74uMsidpKJCxJR7G1c-ZDSPw5E37x1rFoL0ISaRiu3-4aaXEHu--6L5jgufG8-iYQHJ87kY4g80sysPMmdR0upjhRa4LjPmcy564gtYX5G4sfa-ho_LzcjDlCwIchA7p0pIa4wyS2BqFtIw-3ZNwE9hQdISS0DOGZlkvjPQLCN9FqXD4W-483mUwF8r1Szscvo1v_IInsUZ-klYDA2O3IpA42YDEOHAYGt-t0rE2VblNkNwNDYq4GJcZOA9fTbjFivonb0xB0BHzXx1XuSGArTQyskqLxGLIqwRGt5IJRBKaEb82cIPygIrszt4Rw9hTb260nZ1HHlu1Fs6gL2wXpN4hc5Kio_QD9vI_JNEpmTnQh8dPoiWkne9uhsdcL5f3vUuN0cszyNI0tZCRceuMzk3Wg21E7wW0nm0FaDUEBWgUskKBWZ2Yq1iV7WInVhejRbIBUah8_k-T-bP93rogoFJ5eN-cNDh1HCiavg_ck02kSfYVp9YYLhJp_xJOnyCMvkzjQIEY0lXGmOtdXLP3ysYQwxNFvJ7lyH7QAYOfNQEBtLI5Ps6JGd8xjlTvR_vtxyA7xsrG5zpQx5VLZSdvLlcs1uEr-QRQu0l1Eht3TQy1XvI1R97vlwmZc0OpSdv_J-LJ1XUQdi9rTHwjIOEcS_ldSJ2EpU1W4RK5q1WiyzUp6kiNomiOTnLKavJBfFnqx-vWO6Jz8xxuWSaxQ7ufpR3gAKr6WKFyjMn6kCQ_kmcZ2hk8_6n3Jy9-4hkqdCGm6LuayNeFc3Dpi9lJrTGnmk-PPI9SfzQELbnkM8dbiSMy59RZPQyNV7NGjQ7tvUr8kn11SdopncXQSECtgLudSNejcIcGgg92E2oQ-fQY5z8Hid7xeKvm6JqSarSMiJTiBoX9gLEEchohov8sBpQdA_jdKqM5SDp_FFdVboBEBExqIV2ERbjMkk_XuY7F60DRQW5jkOoe_5Y54w3LJtAH78zOgVBpdbSCC4nPWxo7sGMNMuzRZyu3hHG1uyH5AXjnb5FbRAjkSaafuEXDBr4WITYWWjFbLHPm8JNXHVvwKGdIOwnqAuQyvnECb6Xpqmib4jqdybaSslUQYOvRm_eGaMyaAjIuPKOOR5eWH9n4HWhhn4vpOMXbrBLXlCL2fTDsEGcRPGRxofoYX-qvDL45-_aQ3QMhsAXjZBIGdh8umbdXc_wxNqmUM7MfePA3j21n7_wOOxbyvqFzYRmHiwptoIdZsRHGzg4j356q444PaQDwLJDDpFWuxrQO70b7fQ8dAe0uL8PolgoTHY3pJ-kd2kNSiFEhP5augi1llYxlzm2ppt1iFtczQEtxLw-4_hg26iSAOXv2LQbDh8SgLdW28NyPCgO2L0KGjt0Tiyz9KTiYMqdD7FxzleZ5Dh_xmHboRwQAkBoQgvQe-zwEIgl4C7n1d2DFJwXNBDW0Yl-3vOCHDhDPDNnW1J7I3DHhEIjx092yV5WU74Whznw8IlB3fj2DE0jIzNmq4WXrUB7BhsgHFdXMcrwnVDkWqtYrGYM3NvHsDbEw_ZXHfiF0gFVtDLjt83_Y0gAzxmOyvXBk3WLuh0WGUtWPUTQPWpGqEFHuzze4Rdgsr-H_4mTqe0Mr33t1gpWNrxqRoTNp-nMeLDj0Vc5u99smVtZ2tGfulihmTbdUodf9c6_hQzt4AMbaPkvln3juqkENNqWJ5Bg26PyCpm5FRQ62nyHeZoh3TQikC82BwUifwMOfsqe_R50vzK7-9FdzD7GdJZiB50xDusrB2y3qEue5yBcEYQMpGX-o25foKCST58Dv-bJB-YGDlNxmfPYVzT1cnr9GihNVvNjHDSHu4YekMklM3oMtsKBVvglZtWxWmlC0_5qCmOuVJCWOrKJYryZCoFUmOcS8kHGJ9-EEsRhRSYqVCmrxletMu04YLRca1iFdpqiDnyKqGM-_3_w0_ePM3UueFQSBfgA-SKedsIxEorlk-Bmd58hp5KqqxfH92LtNTgMMNjMZ7XXztyyZ8sGfcZv8kD0ApQx-tCRRlGlNLlqUEHasNBCSa9VwCchcxKL8mZK0xQ7ArhhlBX9c1rHzHK3mf8Zk5JS6gZ9IMXSuIWBdW-MPALqU9cR5gwlHUzo25kTz16OeaMHPTqYSzAz_PQHPK9g4ZH8A0ko0pjlKbz2geVxnXRI1pIm5re1z16dayMdUSu2VupD9Ebmf0yLmuHaK47iJJxdmBHwKzJuP7HEG0rBcXYrAahJlhUBPH8gvqXX1POn7FeauktBlMrWTsILi1JPsm-gB89-RkuTZTlNYTPPdG5q7dyP17u-I&cid=CAASFeRo7rrrztcpFhn_iNEc3cku2sMz7A&rfl=1%2Chttps%253A%252F%252Fmedia.framar.bg%252F%240
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:58:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
31
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3124
x-xss-protection
0
server
cafe
etag
4537136162986801320
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:58:54 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20210809/r20110914/ Frame 11DF
24 KB
9 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210809/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CMRbpS7RwrDeLg56QL7-tQ38QsZvOMz4m3S9aUSjkg7qxGntn01eRIm7ySfscwXgO4FG-FIbSsml_kTxtnI7YaUyA3a04cMr4vJMxo1RcfN2yzUbvyKYwtPI1aIuagy8-O9CeydfXnTJCj6C4keyJpxrYydQ&dbm_d=AKAmf-BjRnFrKNxSIcJ2Y12_6YaX31DfSZ4Rn84oi6ydmLODSZiRaYPp_bAXpxv1mo48G2dgCqXPUkF3js-qoLKYfw1kgFgycKFo3dydVRxmK62b2Y2Qa62YZN6e90ZKc_aYu9twAPAaAE7UoY3Agl3I6gw0J1iV9jBY696vjbNBEoSBE8S7izbZKy1ABHtP59BESNHI3-rPTsBcwbNlk4EnWH1i3wHGVxXgFdMRaKBa8vlu25FCigFZ9m1sITNCZ_Nae5__Fi3yRkJI-WfEwdRx7KVIxf35nFTscMEKD_e7Vru0fgA-qJqMboH_C-kiSg2ycsn5PHzWHZYzPV-g1q46nOQvYjix1lnFvErC5Fdy5zFW5uySyKmnJnRs9yRHdGmxujKZVvttBOQCgdQUxx1f0Xy11-FFu8BNLkBZeFVIOdPA7PCHq1806ZIFGKHDQZR176avF33djnmdY7MZzKJDsmgXoGMr2CcUA-jrGwQK7VWSLGMqaQoey05Oc6W7n-6p2Rlj3PwuVvuSgk1PEx_ouDTUe3C7B4d14CdZQgBBwOMN3c3sFq0N5C03f6sZuGXjBU5-C9VuGHJo0EM5y_ytVw8gnWRyaTMiOiejMsLY_RwZyrafhsNGhAHkI9IyOr5aoaGyGc6fWiOUKu19L9c4Bj-BTDxbz4zgqMdRn-6dTP8XRNDi4OS0QzARWqv72vAKFyyRhErzHVo-J1epkMR1E-foyTUmNN8s4NQFyABqLch6VNcTEqRy8PZJtRrWA7he-mPUdANTCv9JQqHJFccsGgFBNpqiuSzUNw-nA0AXE6-mxEJqsZIBhqdoonpcyxfVlnqt830aBYdC0p3ksm-cHQmHSlGJ2C2vPdrKle4d24RFRA3NaLYk1_qeWt8YS5w9KS60s4UNtJJ2mQ0DcGbS8C9mNU4MVxbjhaclUvnVA8YLnhSbdjtDEmNpRxPiw2WJsH8UAJHahzatjhrF_5ekuvcIR4bvpJmLtvGrVndikybDdAqzMXR0ChfmIyZBtFi9Tx9cSL1jURMQ9Ra9bA6tbuyrhM5d2YyFfYddV9TvMd0lM7C9yD8pPIRirQ8nb5DsB_hOkVt1_QXUxX18sLM1VXYEK4HB2EtSh52DiXVPnxc74uMsidpKJCxJR7G1c-ZDSPw5E37x1rFoL0ISaRiu3-4aaXEHu--6L5jgufG8-iYQHJ87kY4g80sysPMmdR0upjhRa4LjPmcy564gtYX5G4sfa-ho_LzcjDlCwIchA7p0pIa4wyS2BqFtIw-3ZNwE9hQdISS0DOGZlkvjPQLCN9FqXD4W-483mUwF8r1Szscvo1v_IInsUZ-klYDA2O3IpA42YDEOHAYGt-t0rE2VblNkNwNDYq4GJcZOA9fTbjFivonb0xB0BHzXx1XuSGArTQyskqLxGLIqwRGt5IJRBKaEb82cIPygIrszt4Rw9hTb260nZ1HHlu1Fs6gL2wXpN4hc5Kio_QD9vI_JNEpmTnQh8dPoiWkne9uhsdcL5f3vUuN0cszyNI0tZCRceuMzk3Wg21E7wW0nm0FaDUEBWgUskKBWZ2Yq1iV7WInVhejRbIBUah8_k-T-bP93rogoFJ5eN-cNDh1HCiavg_ck02kSfYVp9YYLhJp_xJOnyCMvkzjQIEY0lXGmOtdXLP3ysYQwxNFvJ7lyH7QAYOfNQEBtLI5Ps6JGd8xjlTvR_vtxyA7xsrG5zpQx5VLZSdvLlcs1uEr-QRQu0l1Eht3TQy1XvI1R97vlwmZc0OpSdv_J-LJ1XUQdi9rTHwjIOEcS_ldSJ2EpU1W4RK5q1WiyzUp6kiNomiOTnLKavJBfFnqx-vWO6Jz8xxuWSaxQ7ufpR3gAKr6WKFyjMn6kCQ_kmcZ2hk8_6n3Jy9-4hkqdCGm6LuayNeFc3Dpi9lJrTGnmk-PPI9SfzQELbnkM8dbiSMy59RZPQyNV7NGjQ7tvUr8kn11SdopncXQSECtgLudSNejcIcGgg92E2oQ-fQY5z8Hid7xeKvm6JqSarSMiJTiBoX9gLEEchohov8sBpQdA_jdKqM5SDp_FFdVboBEBExqIV2ERbjMkk_XuY7F60DRQW5jkOoe_5Y54w3LJtAH78zOgVBpdbSCC4nPWxo7sGMNMuzRZyu3hHG1uyH5AXjnb5FbRAjkSaafuEXDBr4WITYWWjFbLHPm8JNXHVvwKGdIOwnqAuQyvnECb6Xpqmib4jqdybaSslUQYOvRm_eGaMyaAjIuPKOOR5eWH9n4HWhhn4vpOMXbrBLXlCL2fTDsEGcRPGRxofoYX-qvDL45-_aQ3QMhsAXjZBIGdh8umbdXc_wxNqmUM7MfePA3j21n7_wOOxbyvqFzYRmHiwptoIdZsRHGzg4j356q444PaQDwLJDDpFWuxrQO70b7fQ8dAe0uL8PolgoTHY3pJ-kd2kNSiFEhP5augi1llYxlzm2ppt1iFtczQEtxLw-4_hg26iSAOXv2LQbDh8SgLdW28NyPCgO2L0KGjt0Tiyz9KTiYMqdD7FxzleZ5Dh_xmHboRwQAkBoQgvQe-zwEIgl4C7n1d2DFJwXNBDW0Yl-3vOCHDhDPDNnW1J7I3DHhEIjx092yV5WU74Whznw8IlB3fj2DE0jIzNmq4WXrUB7BhsgHFdXMcrwnVDkWqtYrGYM3NvHsDbEw_ZXHfiF0gFVtDLjt83_Y0gAzxmOyvXBk3WLuh0WGUtWPUTQPWpGqEFHuzze4Rdgsr-H_4mTqe0Mr33t1gpWNrxqRoTNp-nMeLDj0Vc5u99smVtZ2tGfulihmTbdUodf9c6_hQzt4AMbaPkvln3juqkENNqWJ5Bg26PyCpm5FRQ62nyHeZoh3TQikC82BwUifwMOfsqe_R50vzK7-9FdzD7GdJZiB50xDusrB2y3qEue5yBcEYQMpGX-o25foKCST58Dv-bJB-YGDlNxmfPYVzT1cnr9GihNVvNjHDSHu4YekMklM3oMtsKBVvglZtWxWmlC0_5qCmOuVJCWOrKJYryZCoFUmOcS8kHGJ9-EEsRhRSYqVCmrxletMu04YLRca1iFdpqiDnyKqGM-_3_w0_ePM3UueFQSBfgA-SKedsIxEorlk-Bmd58hp5KqqxfH92LtNTgMMNjMZ7XXztyyZ8sGfcZv8kD0ApQx-tCRRlGlNLlqUEHasNBCSa9VwCchcxKL8mZK0xQ7ArhhlBX9c1rHzHK3mf8Zk5JS6gZ9IMXSuIWBdW-MPALqU9cR5gwlHUzo25kTz16OeaMHPTqYSzAz_PQHPK9g4ZH8A0ko0pjlKbz2geVxnXRI1pIm5re1z16dayMdUSu2VupD9Ebmf0yLmuHaK47iJJxdmBHwKzJuP7HEG0rBcXYrAahJlhUBPH8gvqXX1POn7FeauktBlMrWTsILi1JPsm-gB89-RkuTZTlNYTPPdG5q7dyP17u-I&cid=CAASFeRo7rrrztcpFhn_iNEc3cku2sMz7A&rfl=1%2Chttps%253A%252F%252Fmedia.framar.bg%252F%240
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f9da31cabd7ad9f32c9a2c18ce1838a6eaeeca9fbf55995a3e5a2abb2aface6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:56:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
169
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9343
x-xss-protection
0
server
cafe
etag
12459758733850244510
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:56:36 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 11DF
41 KB
15 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 13 Aug 2021 17:07:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
247894
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Aug 2022 17:07:51 GMT
truncated
/ Frame 11DF
218 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
66464d5b19daa9f0aa57283f2b8671327fc289e164c0a67c8456eb5a71f6d814

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
mtrcs_791356.js
s248.mxcdn.net/bb-mx/serve/ Frame 11DF
156 KB
59 KB
Script
General
Full URL
https://s248.mxcdn.net/bb-mx/serve/mtrcs_791356.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-67.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c475336cb0ff67b379c301938f81e4cdafd871a2a73e32afec2ce5c02416be1f

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Jul 2021 13:12:44 GMT
Server
nginx
ETag
"\W00000604601627564364776"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control
public, max-age=78323
Connection
keep-alive
Content-Type
text/javascript
Content-Length
60460
Expires
Tue, 17 Aug 2021 11:44:48 GMT
index.html
s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/ Frame 74BC
2 KB
1020 B
Document
General
Full URL
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d4deb3935b0b32858e4233eeaf8c196244f17555d2beb90be70cd2b6cff543c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
s0.2mdn.net
:scheme
https
:path
/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
access-control-allow-origin
*
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
995
date
Mon, 16 Aug 2021 13:59:25 GMT
expires
Tue, 17 Aug 2021 13:59:25 GMT
cache-control
public, max-age=86400
last-modified
Tue, 02 Feb 2021 22:31:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
view
googleads4.g.doubleclick.net/pcs/ Frame 11DF
0
107 B
Ping
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstpY9aEpzU0zrlhXUiYHga5fSQ5CZy-_hkWtw26CBNTPtnpCAs2bQwu_mlDnuWs1ZtkxpARQhHsg4iOIILXJUamK3nGGTPlxkhqn_R0tBCgbDhVsYIO1nLwyzbUxa8h3M0AAuoGlWMxJnsjbYmlG08V-1pMcAQTVBlJb6YpQOj-QckyJ3GR8G33JFlC_pL3hs_ro7AYkBPF1WvdUnKS9sYwanLT7XCrCozZkhM_csIr3mXuH9s6JT21VI3PkcvtNiQtOvkFLX7sF0QgcA0cECoXebxaIrFdysT0T0KVpDLzoJXGxydoFXbT00ezQvLlkBZnMUD4tGF9BVU5cw0xMstg6fVq0llCsUNGddG6Hr0a8kWQ7Tw0tGkphbbUXHScIB1LAFa5-5ZX42Jew5yW9qcQ2h0RE_D5a2RGmANcjdM1Ym40KQbGFWxCWQaUP8YLn_PUxZQgAl_-mydLJ-vkVrZbQaWGBNmKkDBe8PLc5ubqI4WIdbz-uHJS1W4cGynKIaRnBDkTsJTsPECdhiRHevk8Gz8hMR6aUICYHSowIxRQAtmw1hblcpaQpbYppdLEmS1pSPqNmYRH_udiGwxg6neNnKKOTfUFTnq3-zl8NZgatmOMyfnif3fFXyl240FGYQ__kvkdFvYP797X5pdbqYcjKycyTyr4r9Y0tRGjEA3_U_WzYLZsmEsTtWCFqc3x4vyDxSZgBEnyEsn94ItMoRcZIElex8JOnqbd7Gcv8iISE8RHvVUnD6B3WhQeG7idxzgPruQueWacEpLNPqL96i5H8ooA61noO48QyFvr90XGzNcRINnzscdNZ34yIaoMOtsbIUnPcnDp_XkJ34YQmWPPypC1el7-fNIznrf73iGOwsBq_j8F4ZTaHFZjkx5xzkp_4zCIQncfA4vps4U6vascFntBiD3cn4O5s6FIB-dw8qu_xdm-dWUZzEoWaR7ym41BRYijcm-AolGnpwD_7SjNez3BpO531UKQpxcmCQ8o6pYlBzbHjrSJ71DO-ezHXUXrpCEWE-KRg-_0PGO22t6oR4huOfoitHu5Lz06cpolc-0bYGW508_70bkcLE5VdkzMBkvEe1t9R2-Jonm8iY80EzTK8bWsLPsQcbQ6QjVU5JQdgS1GCLp2WD7QYbORYUcKjf_3wYzODn7sjKhru24kKsJlhXU-Fn2R02fo&sai=AMfl-YRu14StQWXUBtWhl6RW7nIcqIOKPpiieozbk6Zx5oXfuQX8AIkngxAalxG_4A_kcAwmuWM5qf10uu4Mtd6owSAfhP8FChOd3cWi6-cT66KdrE1WU9VSNJelygvJWy5gD9EVT-kIUNIEiZixncbpjfZF_JPCUYWg6K39sg0&sig=Cg0ArKJSzGTgxWASLaWMEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=111&cbvp=1&cstd=103&cisv=r20210809.59345&adurl=
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Mon, 16 Aug 2021 13:59:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame AA6F
22 KB
8 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/Enqz_20U.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
8395
date
Mon, 16 Aug 2021 00:46:47 GMT
expires
Tue, 16 Aug 2022 00:46:47 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
47558
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/ Frame 74BC
441 B
283 B
Stylesheet
General
Full URL
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/style.css
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e941f1bbc1d2944a5736ddb7ac07622a19eb578bd535e5ac4785d3f2662fe4a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 10:53:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11170
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
257
x-xss-protection
0
last-modified
Tue, 02 Feb 2021 22:31:15 GMT
server
sffe
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 17 Aug 2021 10:53:15 GMT
Enabler_01_245.js
s0.2mdn.net/879366/ Frame 74BC
110 KB
38 KB
Script
General
Full URL
https://s0.2mdn.net/879366/Enabler_01_245.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 09:43:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
15330
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38568
x-xss-protection
0
last-modified
Wed, 14 Oct 2020 19:32:54 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 17 Aug 2021 09:43:55 GMT
dynamicBuilder.min.js
s0.2mdn.net/creatives/assets/1951882/ Frame 74BC
9 KB
1 KB
Script
General
Full URL
https://s0.2mdn.net/creatives/assets/1951882/dynamicBuilder.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d585510ebf6dccd5790b2083b5e4425473fa2277aef2dc2be1fcba2d04f47e33
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:45:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
829
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1400
x-xss-protection
0
last-modified
Wed, 04 Apr 2018 17:00:48 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 16 Aug 2021 14:00:36 GMT
logic.js
s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/ Frame 74BC
2 KB
892 B
Script
General
Full URL
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/logic.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c5239ff1a3bb2d94df21411a1d60de9590fb061b5dd8dfca89155993cc1ff44f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 10:53:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11170
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
866
x-xss-protection
0
last-modified
Tue, 02 Feb 2021 22:31:15 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 17 Aug 2021 10:53:15 GMT
yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
pagead2.googlesyndication.com/bg/ Frame AA6F
35 KB
13 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c9db938215f2ff34f7d14783a3dfeaa79c4d787d7c2db6eeb5fbb9fd48450056
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:07:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
3135
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13302
x-xss-protection
0
last-modified
Tue, 03 Aug 2021 09:38:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 16 Aug 2022 13:07:10 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 11DF
0
545 B
Ping
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstpY9aEpzU0zrlhXUiYHga5fSQ5CZy-_hkWtw26CBNTPtnpCAs2bQwu_mlDnuWs1ZtkxpARQhHsg4iOIILXJUamK3nGGTPlxkhqn_R0tBCgbDhVsYIO1nLwyzbUxa8h3M0AAuoGlWMxJnsjbYmlG08V-1pMcAQTVBlJb6YpQOj-QckyJ3GR8G33JFlC_pL3hs_ro7AYkBPF1WvdUnKS9sYwanLT7XCrCozZkhM_csIr3mXuH9s6JT21VI3PkcvtNiQtOvkFLX7sF0QgcA0cECoXebxaIrFdysT0T0KVpDLzoJXGxydoFXbT00ezQvLlkBZnMUD4tGF9BVU5cw0xMstg6fVq0llCsUNGddG6Hr0a8kWQ7Tw0tGkphbbUXHScIB1LAFa5-5ZX42Jew5yW9qcQ2h0RE_D5a2RGmANcjdM1Ym40KQbGFWxCWQaUP8YLn_PUxZQgAl_-mydLJ-vkVrZbQaWGBNmKkDBe8PLc5ubqI4WIdbz-uHJS1W4cGynKIaRnBDkTsJTsPECdhiRHevk8Gz8hMR6aUICYHSowIxRQAtmw1hblcpaQpbYppdLEmS1pSPqNmYRH_udiGwxg6neNnKKOTfUFTnq3-zl8NZgatmOMyfnif3fFXyl240FGYQ__kvkdFvYP797X5pdbqYcjKycyTyr4r9Y0tRGjEA3_U_WzYLZsmEsTtWCFqc3x4vyDxSZgBEnyEsn94ItMoRcZIElex8JOnqbd7Gcv8iISE8RHvVUnD6B3WhQeG7idxzgPruQueWacEpLNPqL96i5H8ooA61noO48QyFvr90XGzNcRINnzscdNZ34yIaoMOtsbIUnPcnDp_XkJ34YQmWPPypC1el7-fNIznrf73iGOwsBq_j8F4ZTaHFZjkx5xzkp_4zCIQncfA4vps4U6vascFntBiD3cn4O5s6FIB-dw8qu_xdm-dWUZzEoWaR7ym41BRYijcm-AolGnpwD_7SjNez3BpO531UKQpxcmCQ8o6pYlBzbHjrSJ71DO-ezHXUXrpCEWE-KRg-_0PGO22t6oR4huOfoitHu5Lz06cpolc-0bYGW508_70bkcLE5VdkzMBkvEe1t9R2-Jonm8iY80EzTK8bWsLPsQcbQ6QjVU5JQdgS1GCLp2WD7QYbORYUcKjf_3wYzODn7sjKhru24kKsJlhXU-Fn2R02fo&sai=AMfl-YRu14StQWXUBtWhl6RW7nIcqIOKPpiieozbk6Zx5oXfuQX8AIkngxAalxG_4A_kcAwmuWM5qf10uu4Mtd6owSAfhP8FChOd3cWi6-cT66KdrE1WU9VSNJelygvJWy5gD9EVT-kIUNIEiZixncbpjfZF_JPCUYWg6K39sg0&sig=Cg0ArKJSzGTgxWASLaWMEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=183&vt=11&dtpt=72&dett=3&cstd=103&cisv=r20210809.59345&adurl=
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Mon, 16 Aug 2021 13:59:25 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
6532277064238221026.json
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
18 KB
4 KB
XHR
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/6532277064238221026.json
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/logic.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
828a463f63d56e8f1adbeada715664a8aa5ed4a8d2c1361967f5a0db822135f0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:46:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
774
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3945
x-xss-protection
0
last-modified
Thu, 29 Jul 2021 16:09:34 GMT
server
sffe
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 16 Aug 2021 14:01:31 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 74BC
6 KB
4 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
020173820807c9ef2d38e74ddb3a22093ff7c27326f1f7348e1ec6f5c3aa1501
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 16 Aug 2021 13:59:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4441
x-xss-protection
0
close.png
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
6 KB
6 KB
Image
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/close.png
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
437d2a6994f6efd0312bcffac4c16b05a60b9d9b6b595cedaa6c6a23b32a2d68
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:44:44 GMT
x-content-type-options
nosniff
age
881
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-doubleclick-media
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5798
x-xss-protection
0
last-modified
Tue, 02 Feb 2021 20:28:56 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 16 Aug 2021 13:59:44 GMT
fa8a9580fd08931a5b14a3f85d075549.jpg
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
191 KB
191 KB
Image
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/fa8a9580fd08931a5b14a3f85d075549.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1c038fbd88fc69d675a8988d322fcf669c4ce57170192b0aa34c439106e4eb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:52:16 GMT
x-content-type-options
nosniff
last-modified
Thu, 29 Jul 2021 10:43:27 GMT
server
sffe
age
429
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
195638
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:07:16 GMT
dacia_logo_white.png
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
30 KB
30 KB
Image
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/dacia_logo_white.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a7be06bf8a03f9a03723900253cdf86beda08012f06fc5b52de0bbed24e6503
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:49:18 GMT
x-content-type-options
nosniff
last-modified
Thu, 29 Jul 2021 10:43:27 GMT
server
sffe
age
607
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30785
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:04:18 GMT
DaciaBlockExtended-Regular.woff2
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
91 KB
91 KB
Font
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/DaciaBlockExtended-Regular.woff2
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
408106c87372c56322eba467db72a14582b2081f72274f81050b52058875ea0d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://s0.2mdn.net
Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:49:02 GMT
x-content-type-options
nosniff
last-modified
Thu, 29 Jul 2021 10:43:27 GMT
server
sffe
age
623
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
93316
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:04:02 GMT
DaciaBlockExtended-Bold.woff2
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
79 KB
79 KB
Font
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/DaciaBlockExtended-Bold.woff2
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
683c17912c216bfddb8a7c1f52a1e5394940b2788028262807993a65fcf9b954
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://s0.2mdn.net
Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:48:34 GMT
x-content-type-options
nosniff
last-modified
Thu, 29 Jul 2021 10:43:27 GMT
server
sffe
age
651
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
81192
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:03:34 GMT
gettag
s248.meetrics.net/bb-mxad/ Frame 11DF
0
208 B
Script
General
Full URL
https://s248.meetrics.net/bb-mxad/gettag
Requested by
Host: s248.mxcdn.net
URL: https://s248.mxcdn.net/bb-mx/serve/mtrcs_791356.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
88.198.52.202 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h530.meetrics.de
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 16 Aug 2021 13:59:26 GMT
Cache-control
private,must-revalidate
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
application/octet-stream
submit
b141.s248.meetrics.net/bb-mx/ Frame 11DF
43 B
291 B
Image
General
Full URL
https://b141.s248.meetrics.net/bb-mx/submit?/eG0iBrAAA/whFtBo0F0wFz6BvvA5jEmhFykE3yA3wA5zAk5BhyBlmF4lEhwBhjFjlF33A4hEiiFuzEhmFlmFyhFtlFunEvvFnsFlzF5uFkpFjhF0pFvuFujEvtFvzEhmFlmFyhFtlFvxAtwAtzA4vAo0FtsFvjEvuF0hFpuFlyFuoE0tFsBF3pyFo0F0wFz6BvvAtlFkpFhuBmyFhtFhyFuiEnvB+k2FoywAyxAtwA3tAy5AtxAz6AxyAt3A5xAz1A2tAyuAxyAyuAztAllFy1Aw4Ai3Bjp6FtxAywAsp3Fx2Ay5AxyAyzA21A14A1BEjwtFuvFulFkqnFluFtVETBFL2wFBLl1FC92iFuhF2pFnhF0vFyfF3lFikFypF2lFygBuvFfwFs1FnpFuzF/2xFsCylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgB3pFukFv3Ff3FliFrpF0zF0vFyhFnlFpuFmvFg3EpuFkvF3fF3lFirFp0FjhFujFlsFhuFptFh0FpvFumFyhFtlFg3EpuFkvF3fF3lFirFp0FylFx1FlzF0hFupFthF0pFvuFmyFhtFlgBjzFzfF3lFirFp0FgjEw1FfxB2gAyhFtfF4gAthF4fFluFnpFulFf1FurFuvF3uFLlnFB/k0FBCxgAwqFpkF93A5xAz1A2mAhkF29B50Ax5A00AxmAjwFpkF9yA2xA03A4yAwmAwsFhjFl9BzwA33A23AwyA3mAzpF0lF91A11Ax2Ay2AmjEpkF9xAx4A31AzwAxyAmzEp6Fl9BzwAw4Ey1AwmAjiF9xAz1A3wA54A21A3lAyyAhzF5uFj9BlyAyhEz5FujFlyAyBEUkzFpBFAAAAAAsE6D6DAPAAAAAAAAAOAAAAGBAAAAAsE6D6DABPaAAAAAAAABUYMAZNAAFAx8Ez8ExBEFA1wA3wA4BErCLxAPAAAFAAUYMTCLxASksFQGeAAAAAAAAAAAAEAAAUYMAAAAAAAIAy2Ax0A34AywAJAzwA33A23AwyA3BEHA11A1xA2yA2BEHAzwAw4Ey1AwBEJAxxA43A1zAwxAyBEAAAAAAHA50Ax5A00AxBEdAAAAAAsEA6DAFAAACLxAAARCo0F0wFz6BvvAzwBuyAtkFuuBulF0vBhkFzvBypFjoFtlFkpFhvBz0F1kFpvFvwE2yBv2AxxA3xA5xA5vAywAyxAwyAwyAx0AzxAx1A4yA2vApuFklF4uBo0FtsF/lE92A5mAslFm0FPmFmzFl0F9wAm0EvwFPmFmzFl0F9wAmjE93EITFhBFx0B1VEvmB09BxmAylFukFlyFpuFnUF5wFl9ByBEDANSFxBEAAAAAAAAAAAAAAGAJGFSBFNFFQtjFb459WA
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.3.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h222.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:26 GMT
Server
nginx
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Mon, 16 Aug 2021 13:59:25 GMT
data
b141.s248.meetrics.net/ Frame 11DF
43 B
308 B
Image
General
Full URL
https://b141.s248.meetrics.net/data?/eG0iCwAAAl2yFuvFfhFwpFLktFDTkzFARksFAQtjF3gVNSA
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.3.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h222.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:26 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Mon, 16-Aug-21 13:59:25 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 74BC
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:26 GMT
fa8a9580fd08931a5b14a3f85d075549.jpg
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
191 KB
191 KB
Image
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/fa8a9580fd08931a5b14a3f85d075549.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1c038fbd88fc69d675a8988d322fcf669c4ce57170192b0aa34c439106e4eb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:52:16 GMT
x-content-type-options
nosniff
last-modified
Thu, 29 Jul 2021 10:43:27 GMT
server
sffe
age
430
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
195638
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:07:16 GMT
container.html
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A7BA
6 KB
3 KB
Document
General
Full URL
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://media.framar.bg/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://media.framar.bg/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Mon, 16 Aug 2021 13:59:24 GMT
expires
Tue, 16 Aug 2022 13:59:24 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
pagead2.googlesyndication.com/bg/ Frame CC08
35 KB
13 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c9db938215f2ff34f7d14783a3dfeaa79c4d787d7c2db6eeb5fbb9fd48450056
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:07:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
3136
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13302
x-xss-protection
0
last-modified
Tue, 03 Aug 2021 09:38:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 16 Aug 2022 13:07:10 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 15DF
640 B
318 B
Document
General
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=COjZIRDakScY__vCqAEwAQ&v=APEucNVhx8qWnqombqszrjyNmcCjH-hHu2BmNo4E-rkrm_cLRTEce4nFb_4_CGr-Kf89CWC9JuwEkDCUrR1EM6SbOWZh7YbF1Yl-xqMCo7iilFvkewxtUtm1n1MAIy4Pio0s4lY6cWsoARwMoFSPFAaAV65mzuFhW_Ip9-nBlQgFirpVyGTdALE
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=COjZIRDakScY__vCqAEwAQ&v=APEucNVhx8qWnqombqszrjyNmcCjH-hHu2BmNo4E-rkrm_cLRTEce4nFb_4_CGr-Kf89CWC9JuwEkDCUrR1EM6SbOWZh7YbF1Yl-xqMCo7iilFvkewxtUtm1n1MAIy4Pio0s4lY6cWsoARwMoFSPFAaAV65mzuFhW_Ip9-nBlQgFirpVyGTdALE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUk_wtioBeFezv5d6xbzHbThm2Mx47YLteO1d-UU_574wkSYXGuBjCy-Q_ONwpI; DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Mon, 16 Aug 2021 13:59:26 GMT
server
cafe
cache-control
private
content-length
295
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Mon, 16 Aug 2021 13:59:26 GMT
ad
googleads.g.doubleclick.net/dbm/ Frame A7BA
25 KB
13 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATSTAc-QZbCA956yL-izf4u_1KxFUbCbaUeq1tbZz72fOumsTcj__ajeVnjVl99DpsA9QMD6cfVWgznXpOw9WTZVzj3HDLUL6PCw0Wbt0rcYqY0eu8Wf6mV4676dQaRXlcg2eYhojwA2v1nHEW7MB3yEETNw&cry=1&dbm_d=AKAmf-Bqi6uwN4xMHWCqwLsC6cgQ9VJQS3lTgU7VHvcC07pWa23fE-fhwHuxfJslgVDlvYhxjlahV8-X495ms_pNLikHRlz6urX2tfAedkkYMlPhG_SJNaB4s6KGVmm0a7TuMDUIF_-GOjfN0GKhAFICPomVD7fpO_C6vhdCw886_BMCoyUYS-AhJ6aA6HrCUIWCguV-NuSGuFOoP-8gQzSl3kXMDDYO6KKdKBvOEGYdxEkNAs-CgY2KxZ8R9T1gvEOpF2QICUcJc6zhAx8Q8SIjAPQJsFDkLPiJBRex8cmPi-b4bH_NQQTVB-LxbL72tzg6Sv_mXU4u_YFdbekQGT_ng1_k-b4l1HiaSyc3T1P-uL-qVHlHJOor9tE-Vut5OcVrHjIR0pCj0bszCcgIHe5kEpC5U_AhRB8yS-eSSajeN8UvCJWHiIuPkuP4oQby_UI3BKk9lFUyWa32F4CyVnIcgtKohIMuBINNbKaStrNt9-Q792FjduRmu7bHNUGHYCt0-NUPd91XF8MdMTc4E3PaNsHfJ_1ko-0nKTdea49PkC7xxSnIpk875deqT9zf5Gyf33LNGTefifve9vVzvglxERJpnlbT-x3hVRvSjPvRCUAl1qZuKEB6NHUHkdZvR1S5Qh2igSaBC9X8vGcsKRmi067P3Jm_Isz4nkBfCTn5w0daMAaAd7CW-XmvxGQgORDQSxBZId93Ds0KDX55A55rHeO1iJ73fmFVF78VzvgcVCqfRlR-EgvejMK8zoUwA9ycnFj3rJi9odbxI_vai-LumxKqxfoKSybPeD-s3YS2zBmiv31ADdV8lEEJsx4L72viFK5TSoTNY7jJSzkhvoRm4UztrrHxmAlTiw73a71rdkfdADNFDFYrkcEe1icQXytJdDpjOM4ExjOQG7NXcckv7a_4RM1VyxTTA3_y2Eh2H-JZcKItBchVRQ26VUmJmqFVDVWfejG_QgJCXJafivQzcVlesp1bLWPOaQCi9Vs73jcYy4jS-McncUG0cL5Tvp1a3MV7JKXRKwKwuUGiC1Tw7bJ98GYDbCIfXivaOs0_eEAZlg3dHy9Cy3kunBxbH2s-i7rdhogrbXqmmm4VXoIaoQM5xmZpb2mzBE8NyHc0D35JnTAFhyEgX0Ctlq6Yp1p5f96KhB1e8e1vP5KIohxIEs4sVD6ETLP6qbcEd172MATaSETiKqJ6dYeGRn4RaQTZrA1xWEmWV3APqRKlDgJl0Qp4wPRuTXxc3JD-Z461qMv26KalK8_Q32cUqIhtCK9bjAnmJjip5EmWkL19aN5veE5CQ85oSaSmVuMBCO9oCtawHZey7SiCR3TXfnUlmbSlg8zIxx3R_JrMht2ME5Q-1MPYlHR1PlH9Igeg_Vxc1y8Vb5IebAf3pUuxgOR3tqgGfTrugG67q4mWt11Uc4OVBm-7THXPVf5A_xSzUwX0ZysHQFbRIcG8XWR7pT-7kXf0J8K3URv-I6Xm5p9H3lWQoPlBjiDlmuLsIz1sVOZubdWWRB2OrYxDQicM3DBEcueqNCdQJEZ9LzlGQWwvUThsDbazgkf6eSlUxAWylmmFPPg91tvuzPy4uFosjFSKV6SD1xRsrlXAhKUzNc7_rBGpzbrXdAmS0NXnRlN6_G0E7SD5hPh-iGmq5vcCt3Varw0fLZcYvnfZ1E-86h4xLlgPgXEF12_Kyr4hAlpoZv7Yam2adLkZtaq5MQva8Hpj3I00ZQopzMkzKrK4-bMabDSdblFmanPAafGmjzwJyJ3fIFV7B9UDTMnToQUsKxd_EvTMFQ2WLokGuxxC2HdLqkPqg-21J8tuHrzXCvaMHPKu4B5LQDERt5zvRKMO3eXr3RGvk_ZB3IaBYKeEF9ZEoWheA0XomZEHw_8VtUwHv96lbbaZa5sa_69LDuIfeGaRP5KvfwLVJ0dVqLOeVoLfEPOsuorUGj9vUZfH4FoN_ucadm1kjMtzzCOOCwy9fD9N39J9XMHtkMxgJTnkI80JWCkwRjmBv5dSuiyqmwJFjWw4_byYwBCXBBYdpgz-I-feQYmBzbzM74yCZH6OlK6W1Z8gYPQXs0RybwlDT5r_GiAJCNyA8Mx1dQN1AspZPUgErGbzSBhTFsLKle8a7j7A6eiXfKVOrHd2Kix-kgE6BzFuSMhlG8uT1Zw04e5GWePmfu7BBoKc7sXAZY0AicDFI19sZ7m7cdnAcfCvkJ0iYGos2SISLBjodh1g1GZ6j2spRoBURecbpnWaidzkRIK8yRxVaXoOpJoL0Red50hBYFL_EHfWui16ADKeC8eyWOgAy2AVh_njqhVK7Ponb67STLj9TVUnQahN0jqFQ84DjOOGqJYDmmwAkZPZ8NlrnJchutTZy-GZgdC8c1PotT5ncaDci-QHYBe6DBzXt39zDe6yOqiWutZRbcfycBzC80gYbZ69whxIc4xJkj981DQ0HyO01uyZGtT185PRhG_xqhUh-HlAQ04OjWnPZx-0MUrfPA1X6vEBgRZf1zxq9WiweTx6GrcPTq1yMUMIZXyBNbHhqhXsHihXonRl_UY9jeJP0TyJaQIS8uTAJqhWyPta1VkhZvBI8rZ61jGjuhUBAgnictnXyi6UwgC2s5n41YCsMpgxQ_EOanP3i-80ZayVJBISUjR04GJ62rvzXUhzSnn7oAd18LK8xq0ed_EdKdwZf1M8-IORb2AHGlhzpoQ9Xvq37kXEEb7-pF9d967YhpcbDY9c56Urh5o62e7vr5xC0AtOYkqYOYZVIOJSwRAM0RtLpuF6-U-CHbQciLTj1pRZG_P_CY8ZGn8JqOMVApSjhEloUID3xYt8KQhyYzXPtlFGQVgZ7dI0EnlMFyrl0qk6RYZCiwKjRHKq1beDNwmxkZGc3LI0XgrsVa6HLe8O_n6meGBjRhJ-8ppWB4tScgBsGp8EJ0cKvKW9_EAy3gkhOKLRFm7IMMPAw3OKZkkO2QpYUtO1qVxSnPen3tGsQjYWNFoZhO_sdZMgsvi1wOGQpI9jdqk8P6TVUhGDsA0utgTQE-BmWPMzhYgg-tvB_4YmlLYVs6u9A-6Bg1YREJ50FSpPpHCldPqludGrXv4xycsmylDsD05bR_d5huuay9Ycjb2ALxmOjCywzhNPtA38znoEkZDeD04Zzd6Xm83BGN6Airklmsrqrxn4jVdYm1VSJ7inE3XAby5odNxx_ZbAvWH--IOfozviD7bmC-YyC5z1_MeXkQmLdTATifoL4tgeYlKJKEvENkkfKTATA3pb39m-TjBzRQdw2HTUjRY4f8nG_8lXl_xuxX8pU3h3IYMy_xsDw9_jacxAFLZ1Py6BQzI8-WQrH85KCwP58QsDgClJ4KA6f489sLc6Z9ZAPyoicCbjWCffmBoZweuKEDn0T87Zf8XEm-Nf3zGtTtVff3LJ75dYJFII8dPj01aQsRZG4KxF7w1c2SsUg-m8zU4N9D4X6A2EwSNau7wDKIn3Cjg92YONOamLRMZdZILzFTeRSdNrBn-7KpltUHMmpbJfnTh9pl67eSq2jXyHViHtYlgPz7JW8PoL9qnmuCZE5t5OidQGvfWSEZG53rek4ymnzMXOlcM8dVoxiBxe2q2D8XKJKMe735n1stlaWS855-q_2R0DvgzjMYS4JTtuQdxRhvHjTqavoiUmFj82NGEaK-Vtt8nDCrDlO79xRLlY5UudEG0ebspRCK0E4cyGzbBOmWE_7kiXFqKMFI8cBWB7BEAbMwMMpAv8JPSGREvCZg0qwo_O03ImJjZwlsAj8LA98v1HeMkYXQCFK24fuN0mZx_Kr1LIovb98fLn2TiJUUUKXjOjM6fUQByKVUyH-rsd6aiNRQI69DaMtGeMWc_n5xRcnV6DnTpOXK24WJ2Tt_tyqDn3KGS5lKdGJspAFmn3iY575oHJ4aO_&cid=CAASFeRox-4KtHsyccK8CEBoESnf6y77Mw&rfl=1%2Chttps%253A%252F%252Fmedia.framar.bg%252F%240
Requested by
Host: media.framar.bg
URL: https://media.framar.bg/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
deb605e510e9a1e2612812d7d2fb0d8a6dbbaeb840344b27d754dc504e841608
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13229
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame A7BA
42 B
63 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bh2jTVs6gPkhoNQ8keJaETsEj1ZB3NcgUlv5d9qSiRZ7S2eSviggxWEmUnfB7osQUIyXCXhSGS3eU5YzIfujyYLnPXkP2cYmJSjbZFpkG6D5Pq1-c
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adServer.bs
bs.serving-sys.com/Serving/ Frame A7BA
14 KB
6 KB
Script
General
Full URL
https://bs.serving-sys.com/Serving/adServer.bs?c=28&cn=display&pli=1076593214&gdpr=&gdpr_consent=&w=300&h=600&ncu=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC4sJiPW8aYaeZIdSA7_UP15Gr-AHI95nLYqywgsO0Df2B5LbrAhABIPyMznJgqbC-gMwBoAG-jdfCA8gBCakCeG5--LrGsz6oAwGqBMkBT9AXjClr5ZBSFj96BfgUHXIUuDuamnbUBGSDMrkR131OnkDQbra04v22rmxS-UvfrX5rheTNQCVndTK85DUgGK0Q7BU3VRxaQHaY-qGsbN3oOemmSyuFHIgbCX3dltODmXW5c1Wucqw0dV-RP7nGDShz8GWkykwNrl7D7NYqcwUnKSqDcUxSszkTi3qTJo6tDPWoGp_hWiSingVT9ZYjyVScoK3uJqyR6KSqNMAh3QewP5swiDRFkfbXKJsdiBanmQc1Clyue69uwAS8u8qc2QPgBAOQBgGgBk2AB6ryqD2oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE7OrtgvQEwDYEwqIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRox-4KtHsyccK8CEBoESnf6y77Mw%26sig%3DAOD64_1_TIJsz2PH7kuqOnfh957ioRyFtA%26client%3Dca-pub-3555560909776325%26dbm_c%3DAKAmf-CpR_bFnJ4je1-mgO2-hyFbQZftxWZTqJnJtcXAZNN0p9AkdcfrNRd6vJcuPW91FfKmIg28aZIfuxzXOIMlb9CSehWYrQK5b48hSOsSZj2FaQZz6j95uKAgKCQYA1bXH9SAt-u6N6VO83OLCgbTUXgs42uATg%26cry%3D1%26dbm_d%3DAKAmf-C9kxv7QPNlr-b2KXIoFm-A7iW7qSkZ_aiIOckzOxubPHIO7x00_AXOIXrIidI56VNcB1K1qpvOxHfBSv8TegObx15iHz9DGU7tRTI2m-scuMAA9OJdZ04YQeKmzFlh4o5dCl-5uDBKVdOqZjrke8kTYYnNELVxWYYB16sZ0sI26xsXd6FvsK70JSwVe2Eb_ZQY2W9RWnLvoRJHXt_EZKkBOBXSli0oiHyfTON8Ocl9HmJV5YoKiVCbCBPKsYeXga2geW49jQgXJAOnC-1tJwD1C0YTaKfM3Dg1242gB2dxTZ7DG7fZnHEGbsSdeXwW0WEIgrj8TAw-uwq5i2Pl-cCUL-0aXuUdVtOUyEhG0IK9t12PUo10fWFMNbY8nlhgqg3yasCBUd6lw3y_yijM9LfnzU5eQWDXmGDsOQFJI78rvvjDJQz-Ei16F1K9IE1tJFKKRNjPcCBb9DkBOkWT9cS9yCQrMMfTt2AGIcZ2n7KNjPIMl1M%26adurl%3D&e=0&ord=1629122365543911&z=0
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.158.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-158-246.eu-central-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
04a7aa95c9475a51804e12ce60ea7ccd16cc5311b5f5800dab56a586c937a947

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
gzip
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
p3p
CP="NOI DEVa OUR BUS UNI"
access-control-allow-origin
*
cache-control
no-cache, no-store
content-type
text/html; charset=UTF-8
content-length
6221
expires
Sun, 05-Jun-2005 22:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame A7BA
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/window_focus_fy2019.js
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:52:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
391
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1339
x-xss-protection
0
server
cafe
etag
2275704724217174249
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:52:55 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame A7BA
124 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1628854326415524"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38195
x-xss-protection
0
expires
Mon, 16 Aug 2021 13:59:26 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame A7BA
14 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:57:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
90
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6204
x-xss-protection
0
server
cafe
etag
11055049251678278959
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:57:56 GMT
data
b141.s248.meetrics.net/ Frame 11DF
43 B
308 B
Image
General
Full URL
https://b141.s248.meetrics.net/data?/eG0iDNEAA2rvFo0F0wFz6BvvAtlFkpFhuBmyFhtFhyFuiEnBFLruFBLkqFFlqwF35AxzA12ALl1FDLkqFKtkyB35AxzA12A6wEylF0pFtlF2qoFx2Ay5AxyAyzA21A14A1xEvtFquF6nF2wAuBFOprF8MBDOqwF8MBDlqwF35AxzA12ALkmFBTkzFzQUBAAAAAAAYAAAA8BAQAAAAAAAAAXAAAA8BAPfBAAZAwSAcAAAARksFAQtjF4NDWSA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.3.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h222.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:26 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Mon, 16-Aug-21 13:59:25 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20210809/r20110914/ Frame A7BA
24 KB
9 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210809/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATSTAc-QZbCA956yL-izf4u_1KxFUbCbaUeq1tbZz72fOumsTcj__ajeVnjVl99DpsA9QMD6cfVWgznXpOw9WTZVzj3HDLUL6PCw0Wbt0rcYqY0eu8Wf6mV4676dQaRXlcg2eYhojwA2v1nHEW7MB3yEETNw&cry=1&dbm_d=AKAmf-Bqi6uwN4xMHWCqwLsC6cgQ9VJQS3lTgU7VHvcC07pWa23fE-fhwHuxfJslgVDlvYhxjlahV8-X495ms_pNLikHRlz6urX2tfAedkkYMlPhG_SJNaB4s6KGVmm0a7TuMDUIF_-GOjfN0GKhAFICPomVD7fpO_C6vhdCw886_BMCoyUYS-AhJ6aA6HrCUIWCguV-NuSGuFOoP-8gQzSl3kXMDDYO6KKdKBvOEGYdxEkNAs-CgY2KxZ8R9T1gvEOpF2QICUcJc6zhAx8Q8SIjAPQJsFDkLPiJBRex8cmPi-b4bH_NQQTVB-LxbL72tzg6Sv_mXU4u_YFdbekQGT_ng1_k-b4l1HiaSyc3T1P-uL-qVHlHJOor9tE-Vut5OcVrHjIR0pCj0bszCcgIHe5kEpC5U_AhRB8yS-eSSajeN8UvCJWHiIuPkuP4oQby_UI3BKk9lFUyWa32F4CyVnIcgtKohIMuBINNbKaStrNt9-Q792FjduRmu7bHNUGHYCt0-NUPd91XF8MdMTc4E3PaNsHfJ_1ko-0nKTdea49PkC7xxSnIpk875deqT9zf5Gyf33LNGTefifve9vVzvglxERJpnlbT-x3hVRvSjPvRCUAl1qZuKEB6NHUHkdZvR1S5Qh2igSaBC9X8vGcsKRmi067P3Jm_Isz4nkBfCTn5w0daMAaAd7CW-XmvxGQgORDQSxBZId93Ds0KDX55A55rHeO1iJ73fmFVF78VzvgcVCqfRlR-EgvejMK8zoUwA9ycnFj3rJi9odbxI_vai-LumxKqxfoKSybPeD-s3YS2zBmiv31ADdV8lEEJsx4L72viFK5TSoTNY7jJSzkhvoRm4UztrrHxmAlTiw73a71rdkfdADNFDFYrkcEe1icQXytJdDpjOM4ExjOQG7NXcckv7a_4RM1VyxTTA3_y2Eh2H-JZcKItBchVRQ26VUmJmqFVDVWfejG_QgJCXJafivQzcVlesp1bLWPOaQCi9Vs73jcYy4jS-McncUG0cL5Tvp1a3MV7JKXRKwKwuUGiC1Tw7bJ98GYDbCIfXivaOs0_eEAZlg3dHy9Cy3kunBxbH2s-i7rdhogrbXqmmm4VXoIaoQM5xmZpb2mzBE8NyHc0D35JnTAFhyEgX0Ctlq6Yp1p5f96KhB1e8e1vP5KIohxIEs4sVD6ETLP6qbcEd172MATaSETiKqJ6dYeGRn4RaQTZrA1xWEmWV3APqRKlDgJl0Qp4wPRuTXxc3JD-Z461qMv26KalK8_Q32cUqIhtCK9bjAnmJjip5EmWkL19aN5veE5CQ85oSaSmVuMBCO9oCtawHZey7SiCR3TXfnUlmbSlg8zIxx3R_JrMht2ME5Q-1MPYlHR1PlH9Igeg_Vxc1y8Vb5IebAf3pUuxgOR3tqgGfTrugG67q4mWt11Uc4OVBm-7THXPVf5A_xSzUwX0ZysHQFbRIcG8XWR7pT-7kXf0J8K3URv-I6Xm5p9H3lWQoPlBjiDlmuLsIz1sVOZubdWWRB2OrYxDQicM3DBEcueqNCdQJEZ9LzlGQWwvUThsDbazgkf6eSlUxAWylmmFPPg91tvuzPy4uFosjFSKV6SD1xRsrlXAhKUzNc7_rBGpzbrXdAmS0NXnRlN6_G0E7SD5hPh-iGmq5vcCt3Varw0fLZcYvnfZ1E-86h4xLlgPgXEF12_Kyr4hAlpoZv7Yam2adLkZtaq5MQva8Hpj3I00ZQopzMkzKrK4-bMabDSdblFmanPAafGmjzwJyJ3fIFV7B9UDTMnToQUsKxd_EvTMFQ2WLokGuxxC2HdLqkPqg-21J8tuHrzXCvaMHPKu4B5LQDERt5zvRKMO3eXr3RGvk_ZB3IaBYKeEF9ZEoWheA0XomZEHw_8VtUwHv96lbbaZa5sa_69LDuIfeGaRP5KvfwLVJ0dVqLOeVoLfEPOsuorUGj9vUZfH4FoN_ucadm1kjMtzzCOOCwy9fD9N39J9XMHtkMxgJTnkI80JWCkwRjmBv5dSuiyqmwJFjWw4_byYwBCXBBYdpgz-I-feQYmBzbzM74yCZH6OlK6W1Z8gYPQXs0RybwlDT5r_GiAJCNyA8Mx1dQN1AspZPUgErGbzSBhTFsLKle8a7j7A6eiXfKVOrHd2Kix-kgE6BzFuSMhlG8uT1Zw04e5GWePmfu7BBoKc7sXAZY0AicDFI19sZ7m7cdnAcfCvkJ0iYGos2SISLBjodh1g1GZ6j2spRoBURecbpnWaidzkRIK8yRxVaXoOpJoL0Red50hBYFL_EHfWui16ADKeC8eyWOgAy2AVh_njqhVK7Ponb67STLj9TVUnQahN0jqFQ84DjOOGqJYDmmwAkZPZ8NlrnJchutTZy-GZgdC8c1PotT5ncaDci-QHYBe6DBzXt39zDe6yOqiWutZRbcfycBzC80gYbZ69whxIc4xJkj981DQ0HyO01uyZGtT185PRhG_xqhUh-HlAQ04OjWnPZx-0MUrfPA1X6vEBgRZf1zxq9WiweTx6GrcPTq1yMUMIZXyBNbHhqhXsHihXonRl_UY9jeJP0TyJaQIS8uTAJqhWyPta1VkhZvBI8rZ61jGjuhUBAgnictnXyi6UwgC2s5n41YCsMpgxQ_EOanP3i-80ZayVJBISUjR04GJ62rvzXUhzSnn7oAd18LK8xq0ed_EdKdwZf1M8-IORb2AHGlhzpoQ9Xvq37kXEEb7-pF9d967YhpcbDY9c56Urh5o62e7vr5xC0AtOYkqYOYZVIOJSwRAM0RtLpuF6-U-CHbQciLTj1pRZG_P_CY8ZGn8JqOMVApSjhEloUID3xYt8KQhyYzXPtlFGQVgZ7dI0EnlMFyrl0qk6RYZCiwKjRHKq1beDNwmxkZGc3LI0XgrsVa6HLe8O_n6meGBjRhJ-8ppWB4tScgBsGp8EJ0cKvKW9_EAy3gkhOKLRFm7IMMPAw3OKZkkO2QpYUtO1qVxSnPen3tGsQjYWNFoZhO_sdZMgsvi1wOGQpI9jdqk8P6TVUhGDsA0utgTQE-BmWPMzhYgg-tvB_4YmlLYVs6u9A-6Bg1YREJ50FSpPpHCldPqludGrXv4xycsmylDsD05bR_d5huuay9Ycjb2ALxmOjCywzhNPtA38znoEkZDeD04Zzd6Xm83BGN6Airklmsrqrxn4jVdYm1VSJ7inE3XAby5odNxx_ZbAvWH--IOfozviD7bmC-YyC5z1_MeXkQmLdTATifoL4tgeYlKJKEvENkkfKTATA3pb39m-TjBzRQdw2HTUjRY4f8nG_8lXl_xuxX8pU3h3IYMy_xsDw9_jacxAFLZ1Py6BQzI8-WQrH85KCwP58QsDgClJ4KA6f489sLc6Z9ZAPyoicCbjWCffmBoZweuKEDn0T87Zf8XEm-Nf3zGtTtVff3LJ75dYJFII8dPj01aQsRZG4KxF7w1c2SsUg-m8zU4N9D4X6A2EwSNau7wDKIn3Cjg92YONOamLRMZdZILzFTeRSdNrBn-7KpltUHMmpbJfnTh9pl67eSq2jXyHViHtYlgPz7JW8PoL9qnmuCZE5t5OidQGvfWSEZG53rek4ymnzMXOlcM8dVoxiBxe2q2D8XKJKMe735n1stlaWS855-q_2R0DvgzjMYS4JTtuQdxRhvHjTqavoiUmFj82NGEaK-Vtt8nDCrDlO79xRLlY5UudEG0ebspRCK0E4cyGzbBOmWE_7kiXFqKMFI8cBWB7BEAbMwMMpAv8JPSGREvCZg0qwo_O03ImJjZwlsAj8LA98v1HeMkYXQCFK24fuN0mZx_Kr1LIovb98fLn2TiJUUUKXjOjM6fUQByKVUyH-rsd6aiNRQI69DaMtGeMWc_n5xRcnV6DnTpOXK24WJ2Tt_tyqDn3KGS5lKdGJspAFmn3iY575oHJ4aO_&cid=CAASFeRox-4KtHsyccK8CEBoESnf6y77Mw&rfl=1%2Chttps%253A%252F%252Fmedia.framar.bg%252F%240
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f9da31cabd7ad9f32c9a2c18ce1838a6eaeeca9fbf55995a3e5a2abb2aface6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:56:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
170
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9343
x-xss-protection
0
server
cafe
etag
12459758733850244510
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 30 Aug 2021 13:56:36 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame A7BA
41 KB
15 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATSTAc-QZbCA956yL-izf4u_1KxFUbCbaUeq1tbZz72fOumsTcj__ajeVnjVl99DpsA9QMD6cfVWgznXpOw9WTZVzj3HDLUL6PCw0Wbt0rcYqY0eu8Wf6mV4676dQaRXlcg2eYhojwA2v1nHEW7MB3yEETNw&cry=1&dbm_d=AKAmf-Bqi6uwN4xMHWCqwLsC6cgQ9VJQS3lTgU7VHvcC07pWa23fE-fhwHuxfJslgVDlvYhxjlahV8-X495ms_pNLikHRlz6urX2tfAedkkYMlPhG_SJNaB4s6KGVmm0a7TuMDUIF_-GOjfN0GKhAFICPomVD7fpO_C6vhdCw886_BMCoyUYS-AhJ6aA6HrCUIWCguV-NuSGuFOoP-8gQzSl3kXMDDYO6KKdKBvOEGYdxEkNAs-CgY2KxZ8R9T1gvEOpF2QICUcJc6zhAx8Q8SIjAPQJsFDkLPiJBRex8cmPi-b4bH_NQQTVB-LxbL72tzg6Sv_mXU4u_YFdbekQGT_ng1_k-b4l1HiaSyc3T1P-uL-qVHlHJOor9tE-Vut5OcVrHjIR0pCj0bszCcgIHe5kEpC5U_AhRB8yS-eSSajeN8UvCJWHiIuPkuP4oQby_UI3BKk9lFUyWa32F4CyVnIcgtKohIMuBINNbKaStrNt9-Q792FjduRmu7bHNUGHYCt0-NUPd91XF8MdMTc4E3PaNsHfJ_1ko-0nKTdea49PkC7xxSnIpk875deqT9zf5Gyf33LNGTefifve9vVzvglxERJpnlbT-x3hVRvSjPvRCUAl1qZuKEB6NHUHkdZvR1S5Qh2igSaBC9X8vGcsKRmi067P3Jm_Isz4nkBfCTn5w0daMAaAd7CW-XmvxGQgORDQSxBZId93Ds0KDX55A55rHeO1iJ73fmFVF78VzvgcVCqfRlR-EgvejMK8zoUwA9ycnFj3rJi9odbxI_vai-LumxKqxfoKSybPeD-s3YS2zBmiv31ADdV8lEEJsx4L72viFK5TSoTNY7jJSzkhvoRm4UztrrHxmAlTiw73a71rdkfdADNFDFYrkcEe1icQXytJdDpjOM4ExjOQG7NXcckv7a_4RM1VyxTTA3_y2Eh2H-JZcKItBchVRQ26VUmJmqFVDVWfejG_QgJCXJafivQzcVlesp1bLWPOaQCi9Vs73jcYy4jS-McncUG0cL5Tvp1a3MV7JKXRKwKwuUGiC1Tw7bJ98GYDbCIfXivaOs0_eEAZlg3dHy9Cy3kunBxbH2s-i7rdhogrbXqmmm4VXoIaoQM5xmZpb2mzBE8NyHc0D35JnTAFhyEgX0Ctlq6Yp1p5f96KhB1e8e1vP5KIohxIEs4sVD6ETLP6qbcEd172MATaSETiKqJ6dYeGRn4RaQTZrA1xWEmWV3APqRKlDgJl0Qp4wPRuTXxc3JD-Z461qMv26KalK8_Q32cUqIhtCK9bjAnmJjip5EmWkL19aN5veE5CQ85oSaSmVuMBCO9oCtawHZey7SiCR3TXfnUlmbSlg8zIxx3R_JrMht2ME5Q-1MPYlHR1PlH9Igeg_Vxc1y8Vb5IebAf3pUuxgOR3tqgGfTrugG67q4mWt11Uc4OVBm-7THXPVf5A_xSzUwX0ZysHQFbRIcG8XWR7pT-7kXf0J8K3URv-I6Xm5p9H3lWQoPlBjiDlmuLsIz1sVOZubdWWRB2OrYxDQicM3DBEcueqNCdQJEZ9LzlGQWwvUThsDbazgkf6eSlUxAWylmmFPPg91tvuzPy4uFosjFSKV6SD1xRsrlXAhKUzNc7_rBGpzbrXdAmS0NXnRlN6_G0E7SD5hPh-iGmq5vcCt3Varw0fLZcYvnfZ1E-86h4xLlgPgXEF12_Kyr4hAlpoZv7Yam2adLkZtaq5MQva8Hpj3I00ZQopzMkzKrK4-bMabDSdblFmanPAafGmjzwJyJ3fIFV7B9UDTMnToQUsKxd_EvTMFQ2WLokGuxxC2HdLqkPqg-21J8tuHrzXCvaMHPKu4B5LQDERt5zvRKMO3eXr3RGvk_ZB3IaBYKeEF9ZEoWheA0XomZEHw_8VtUwHv96lbbaZa5sa_69LDuIfeGaRP5KvfwLVJ0dVqLOeVoLfEPOsuorUGj9vUZfH4FoN_ucadm1kjMtzzCOOCwy9fD9N39J9XMHtkMxgJTnkI80JWCkwRjmBv5dSuiyqmwJFjWw4_byYwBCXBBYdpgz-I-feQYmBzbzM74yCZH6OlK6W1Z8gYPQXs0RybwlDT5r_GiAJCNyA8Mx1dQN1AspZPUgErGbzSBhTFsLKle8a7j7A6eiXfKVOrHd2Kix-kgE6BzFuSMhlG8uT1Zw04e5GWePmfu7BBoKc7sXAZY0AicDFI19sZ7m7cdnAcfCvkJ0iYGos2SISLBjodh1g1GZ6j2spRoBURecbpnWaidzkRIK8yRxVaXoOpJoL0Red50hBYFL_EHfWui16ADKeC8eyWOgAy2AVh_njqhVK7Ponb67STLj9TVUnQahN0jqFQ84DjOOGqJYDmmwAkZPZ8NlrnJchutTZy-GZgdC8c1PotT5ncaDci-QHYBe6DBzXt39zDe6yOqiWutZRbcfycBzC80gYbZ69whxIc4xJkj981DQ0HyO01uyZGtT185PRhG_xqhUh-HlAQ04OjWnPZx-0MUrfPA1X6vEBgRZf1zxq9WiweTx6GrcPTq1yMUMIZXyBNbHhqhXsHihXonRl_UY9jeJP0TyJaQIS8uTAJqhWyPta1VkhZvBI8rZ61jGjuhUBAgnictnXyi6UwgC2s5n41YCsMpgxQ_EOanP3i-80ZayVJBISUjR04GJ62rvzXUhzSnn7oAd18LK8xq0ed_EdKdwZf1M8-IORb2AHGlhzpoQ9Xvq37kXEEb7-pF9d967YhpcbDY9c56Urh5o62e7vr5xC0AtOYkqYOYZVIOJSwRAM0RtLpuF6-U-CHbQciLTj1pRZG_P_CY8ZGn8JqOMVApSjhEloUID3xYt8KQhyYzXPtlFGQVgZ7dI0EnlMFyrl0qk6RYZCiwKjRHKq1beDNwmxkZGc3LI0XgrsVa6HLe8O_n6meGBjRhJ-8ppWB4tScgBsGp8EJ0cKvKW9_EAy3gkhOKLRFm7IMMPAw3OKZkkO2QpYUtO1qVxSnPen3tGsQjYWNFoZhO_sdZMgsvi1wOGQpI9jdqk8P6TVUhGDsA0utgTQE-BmWPMzhYgg-tvB_4YmlLYVs6u9A-6Bg1YREJ50FSpPpHCldPqludGrXv4xycsmylDsD05bR_d5huuay9Ycjb2ALxmOjCywzhNPtA38znoEkZDeD04Zzd6Xm83BGN6Airklmsrqrxn4jVdYm1VSJ7inE3XAby5odNxx_ZbAvWH--IOfozviD7bmC-YyC5z1_MeXkQmLdTATifoL4tgeYlKJKEvENkkfKTATA3pb39m-TjBzRQdw2HTUjRY4f8nG_8lXl_xuxX8pU3h3IYMy_xsDw9_jacxAFLZ1Py6BQzI8-WQrH85KCwP58QsDgClJ4KA6f489sLc6Z9ZAPyoicCbjWCffmBoZweuKEDn0T87Zf8XEm-Nf3zGtTtVff3LJ75dYJFII8dPj01aQsRZG4KxF7w1c2SsUg-m8zU4N9D4X6A2EwSNau7wDKIn3Cjg92YONOamLRMZdZILzFTeRSdNrBn-7KpltUHMmpbJfnTh9pl67eSq2jXyHViHtYlgPz7JW8PoL9qnmuCZE5t5OidQGvfWSEZG53rek4ymnzMXOlcM8dVoxiBxe2q2D8XKJKMe735n1stlaWS855-q_2R0DvgzjMYS4JTtuQdxRhvHjTqavoiUmFj82NGEaK-Vtt8nDCrDlO79xRLlY5UudEG0ebspRCK0E4cyGzbBOmWE_7kiXFqKMFI8cBWB7BEAbMwMMpAv8JPSGREvCZg0qwo_O03ImJjZwlsAj8LA98v1HeMkYXQCFK24fuN0mZx_Kr1LIovb98fLn2TiJUUUKXjOjM6fUQByKVUyH-rsd6aiNRQI69DaMtGeMWc_n5xRcnV6DnTpOXK24WJ2Tt_tyqDn3KGS5lKdGJspAFmn3iY575oHJ4aO_&cid=CAASFeRox-4KtHsyccK8CEBoESnf6y77Mw&rfl=1%2Chttps%253A%252F%252Fmedia.framar.bg%252F%240
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 13 Aug 2021 17:07:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
247895
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Aug 2022 17:07:51 GMT
sd
us-u.openx.net/w/1.0/ Frame 15DF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIc--kbxyeRW-aZ0GZBymgA&google_cver=1
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIc--kbxyeRW-aZ0GZBymgA&google_cver=1
43 B
172 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIc--kbxyeRW-aZ0GZBymgA&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjZIRDakScY__vCqAEwAQ&v=APEucNVhx8qWnqombqszrjyNmcCjH-hHu2BmNo4E-rkrm_cLRTEce4nFb_4_CGr-Kf89CWC9JuwEkDCUrR1EM6SbOWZh7YbF1Yl-xqMCo7iilFvkewxtUtm1n1MAIy4Pio0s4lY6cWsoARwMoFSPFAaAV65mzuFhW_Ip9-nBlQgFirpVyGTdALE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.213.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
via
1.1 google
server
OXGW/16.213.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIc--kbxyeRW-aZ0GZBymgA&google_cver=1
date
Mon, 16 Aug 2021 13:59:26 GMT
via
1.1 google
server
OXGW/16.213.0
alt-svc
clear
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
pixel
cm.g.doubleclick.net/ Frame 15DF
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWQzYzU5NmYtY2Q1OS0yMGEyLWQ0ZTUtZTRmNTQ4ZjZjZTJi
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWQzYzU5NmYtY2Q1OS0yMGEyLWQ0ZTUtZTRmNTQ4ZjZjZTJi
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjZIRDakScY__vCqAEwAQ&v=APEucNVhx8qWnqombqszrjyNmcCjH-hHu2BmNo4E-rkrm_cLRTEce4nFb_4_CGr-Kf89CWC9JuwEkDCUrR1EM6SbOWZh7YbF1Yl-xqMCo7iilFvkewxtUtm1n1MAIy4Pio0s4lY6cWsoARwMoFSPFAaAV65mzuFhW_Ip9-nBlQgFirpVyGTdALE
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
gzip
server
OXGW/16.213.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWQzYzU5NmYtY2Q1OS0yMGEyLWQ0ZTUtZTRmNTQ4ZjZjZTJi
content-type
image/gif
alt-svc
clear
content-length
0
via
1.1 google
um
sync.teads.tv/ Frame 15DF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
  • https://sync.teads.tv/um?eid=3&uid=CAESEMBkFKj3hVKk3KYGvI12V68&google_cver=1
23 B
172 B
Image
General
Full URL
https://sync.teads.tv/um?eid=3&uid=CAESEMBkFKj3hVKk3KYGvI12V68&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjZIRDakScY__vCqAEwAQ&v=APEucNVhx8qWnqombqszrjyNmcCjH-hHu2BmNo4E-rkrm_cLRTEce4nFb_4_CGr-Kf89CWC9JuwEkDCUrR1EM6SbOWZh7YbF1Yl-xqMCo7iilFvkewxtUtm1n1MAIy4Pio0s4lY6cWsoARwMoFSPFAaAV65mzuFhW_Ip9-nBlQgFirpVyGTdALE
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.45.108.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-93.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.3 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
cache-control
max-age=0, no-cache, no-store
expires
Mon, 16 Aug 2021 13:59:26 GMT
server
akka-http/10.2.3
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.teads.tv/um?eid=3&uid=CAESEMBkFKj3hVKk3KYGvI12V68&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
281
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
um
sync.teads.tv/ Frame 15DF
23 B
172 B
Image
General
Full URL
https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COjZIRDakScY__vCqAEwAQ&v=APEucNVhx8qWnqombqszrjyNmcCjH-hHu2BmNo4E-rkrm_cLRTEce4nFb_4_CGr-Kf89CWC9JuwEkDCUrR1EM6SbOWZh7YbF1Yl-xqMCo7iilFvkewxtUtm1n1MAIy4Pio0s4lY6cWsoARwMoFSPFAaAV65mzuFhW_Ip9-nBlQgFirpVyGTdALE
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.45.108.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-93.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.3 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
cache-control
max-age=0, no-cache, no-store
expires
Mon, 16 Aug 2021 13:59:26 GMT
server
akka-http/10.2.3
content-length
23
content-type
image/gif
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 3364
22 KB
8 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/Enqz_20U.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
8395
date
Mon, 16 Aug 2021 00:46:47 GMT
expires
Tue, 16 Aug 2022 00:46:47 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
47559
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ebStdBanner.js
secure-ds.serving-sys.com/BurstingCachedScripts//Ad_2_208_3_0/ Frame A7BA
221 KB
63 KB
Script
General
Full URL
https://secure-ds.serving-sys.com/BurstingCachedScripts//Ad_2_208_3_0/ebStdBanner.js
Requested by
Host: bs.serving-sys.com
URL: https://bs.serving-sys.com/Serving/adServer.bs?c=28&cn=display&pli=1076593214&gdpr=&gdpr_consent=&w=300&h=600&ncu=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC4sJiPW8aYaeZIdSA7_UP15Gr-AHI95nLYqywgsO0Df2B5LbrAhABIPyMznJgqbC-gMwBoAG-jdfCA8gBCakCeG5--LrGsz6oAwGqBMkBT9AXjClr5ZBSFj96BfgUHXIUuDuamnbUBGSDMrkR131OnkDQbra04v22rmxS-UvfrX5rheTNQCVndTK85DUgGK0Q7BU3VRxaQHaY-qGsbN3oOemmSyuFHIgbCX3dltODmXW5c1Wucqw0dV-RP7nGDShz8GWkykwNrl7D7NYqcwUnKSqDcUxSszkTi3qTJo6tDPWoGp_hWiSingVT9ZYjyVScoK3uJqyR6KSqNMAh3QewP5swiDRFkfbXKJsdiBanmQc1Clyue69uwAS8u8qc2QPgBAOQBgGgBk2AB6ryqD2oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE7OrtgvQEwDYEwqIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRox-4KtHsyccK8CEBoESnf6y77Mw%26sig%3DAOD64_1_TIJsz2PH7kuqOnfh957ioRyFtA%26client%3Dca-pub-3555560909776325%26dbm_c%3DAKAmf-CpR_bFnJ4je1-mgO2-hyFbQZftxWZTqJnJtcXAZNN0p9AkdcfrNRd6vJcuPW91FfKmIg28aZIfuxzXOIMlb9CSehWYrQK5b48hSOsSZj2FaQZz6j95uKAgKCQYA1bXH9SAt-u6N6VO83OLCgbTUXgs42uATg%26cry%3D1%26dbm_d%3DAKAmf-C9kxv7QPNlr-b2KXIoFm-A7iW7qSkZ_aiIOckzOxubPHIO7x00_AXOIXrIidI56VNcB1K1qpvOxHfBSv8TegObx15iHz9DGU7tRTI2m-scuMAA9OJdZ04YQeKmzFlh4o5dCl-5uDBKVdOqZjrke8kTYYnNELVxWYYB16sZ0sI26xsXd6FvsK70JSwVe2Eb_ZQY2W9RWnLvoRJHXt_EZKkBOBXSli0oiHyfTON8Ocl9HmJV5YoKiVCbCBPKsYeXga2geW49jQgXJAOnC-1tJwD1C0YTaKfM3Dg1242gB2dxTZ7DG7fZnHEGbsSdeXwW0WEIgrj8TAw-uwq5i2Pl-cCUL-0aXuUdVtOUyEhG0IK9t12PUo10fWFMNbY8nlhgqg3yasCBUd6lw3y_yijM9LfnzU5eQWDXmGDsOQFJI78rvvjDJQz-Ei16F1K9IE1tJFKKRNjPcCBb9DkBOkWT9cS9yCQrMMfTt2AGIcZ2n7KNjPIMl1M%26adurl%3D&e=0&ord=1629122365543911&z=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.25 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-25.deploy.static.akamaitechnologies.com
Software
/ ARR/2.5
Resource Hash
d9229ae35321b85d514e96b63261eef7e4155348b269b9b8e75e2a964a4464e9

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
gzip
last-modified
Mon, 02 Aug 2021 15:43:06 GMT
server
x-powered-by
ARR/2.5
etag
"15292f16b587d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
63990
expires
Mon, 31 Dec 2035 00:00:00 GMT
truncated
/ Frame A7BA
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a40c3d1c001979c0900a3cc7440a124490aaa2cd2f289517e6eb67275efd2fb

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
gen_204
pagead2.googlesyndication.com/pagead/ Frame AA6F
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BhKe-PW8aYd_rJb_d7_UPlPuCuA0AAAAAOAHgBAI&bg=!l5SllNDNAAbOj6irzo87ACkAdvg8Wu-hdFiEm0NICJGp2p46StH3PntgZKddbBWBAvlSjlN2QBhllgIAAAGXUgAAAD5oAQcKAFpC3Ra9RzZRVUn3xPXQSNaDJo9qTl1z0vYzqq0NmackVw6jzUzN8WeXsiX9UCKDrxEEpSWqpsd0IzM6VKkoQLnLPqEEbSYZbyuPVHs-zUErbfy_lrPlo7aYvrSZAtTqwcK7MykbR60lI7XnGaKb94Oxnd0DHFjCg9KSb-SacqFGO0pMTdbPtxIICn--BOax13hAunaL2RrtxaRXTdWM9pWUR8M3T7s2d9yg6olo1CmvV1vwvx_zV4nco-oF7mRqAsYYq35B_-mpTImA8WBwtVWhmEKrW2YI6ItHE_nI_0rn6fH_PXLuY0W-pPuZhypQJj_4LSfunWiQA63VLqlBxsEUJYwWtQdjfhiMN3DnKdUBil-5DLfT5Tr9CGZw2Rf5tfUE5iRo8FY2_jrCjFEHhPUztTTEVqYULWDsHJqTEqR074TDZNbZq13FMmtm2p5siDyxKDBNEVht2t7_ExLRd6nzLtGOsJVmDCSHcVHnXg57pvRd1v5Sontmy36i8LHMF2sPqkGP6PL_b1V4AlsqaZRWP-7JM0rzwyJV8w8JA1K2al_qjqxLRfsbJjuS1NRq5Zdc59DrA1QaQbYNynRivhoWE_UvMK193ZGODeMXNievAjhOrO5b5DaaQJ9UqS2UsyDYYSmHtPgCmU5NnwC8gLMdXqu4eAN6Qx7wpjMVyO2sqog9y_lAET0hvvPZQSyjXHwnTK9iYDUwkFR0QLOLwFK6GEPSchjeJaJ40WJyGu11ciqfOkSpGPQwAHoZZfrKerBLrilQpOeiNycvnbEG7KqYsJ66cQAeGXKcr3cnpb5CsayYDQFrtokeluCezy9FXsuyq1tfoivwDYPOV2-Tee8poSL_p5Nrw_U37ZIM-3q7YlcDRoV5r-sByObEvVLxu-X_8LPY5bD-wAGY8jTPdDTV59An8dLUNwYr-fiJjQaOYSsF_AdTpDsyYwCVVIOxdyFC04wibP7mFLCts6FUhyd7mE8xMKAs75FH3gBAcxfD3_xggbSevzvTWkYbdUX-lf6_PHcq357rP_tWOkaNY5HUEcABaXE5EZWW8lDkbPn60hU3-mUVUT_-UTM_mXZNPZFr
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
pagead2.googlesyndication.com/bg/ Frame 3364
35 KB
13 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/yduTghXy_zT30UeDo9_qp5xNeH18Lbbutfu5_UhFAFY.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c9db938215f2ff34f7d14783a3dfeaa79c4d787d7c2db6eeb5fbb9fd48450056
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:07:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
3136
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13302
x-xss-protection
0
last-modified
Tue, 03 Aug 2021 09:38:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 16 Aug 2022 13:07:10 GMT
URLUtil.js
secure-ds.serving-sys.com/BurstingCachedScripts/Modules_1_75_0_0/ Frame A7BA
7 KB
2 KB
Script
General
Full URL
https://secure-ds.serving-sys.com/BurstingCachedScripts/Modules_1_75_0_0/URLUtil.js
Requested by
Host: secure-ds.serving-sys.com
URL: https://secure-ds.serving-sys.com/BurstingCachedScripts//Ad_2_208_3_0/ebStdBanner.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.25 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-25.deploy.static.akamaitechnologies.com
Software
/ ARR/2.5
Resource Hash
269bd69d6c1d25e848132ecfb48ec214040e49fd45e444760c3e226ca5fd7962

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:59:26 GMT
content-encoding
gzip
last-modified
Mon, 02 Aug 2021 15:43:05 GMT
server
x-powered-by
ARR/2.5
etag
"ff3c315b587d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
1985
expires
Mon, 31 Dec 2035 00:00:00 GMT
perfromnace_300x600_62239117647320132.jpg
secure-ds.serving-sys.com/resources/PROD/asset/48480/IMAGE/20210507/ Frame A7BA
72 KB
72 KB
Image
General
Full URL
https://secure-ds.serving-sys.com/resources/PROD/asset/48480/IMAGE/20210507/perfromnace_300x600_62239117647320132.jpg
Requested by
Host: 9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
URL: https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.25 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-25.deploy.static.akamaitechnologies.com
Software
ATS/7.1.0 /
Resource Hash
5e02194bef79f2bd3e8e9b6cc085807690d5ae1f9fe8a0f47e67c6028965ca51

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
MzfgLszeaoiemLrSsVk.D9onZdycoEvT
last-modified
Fri, 07 May 2021 13:13:02 GMT
server
ATS/7.1.0
x-amz-request-id
NMEWG525SECDE0BV
etag
"c9556bb75ceb359c97b5d148a96fab27"
content-type
image/jpeg
access-control-allow-origin
*
date
Mon, 16 Aug 2021 13:59:26 GMT
x-amz-replication-status
COMPLETED
accept-ranges
bytes
content-length
73638
x-amz-id-2
e3LkGYDIQqpi0hG9effb5nrfSFz0RNQRGuRklEXsh4tj/dwpYpElG00sslVeA0bgEfDLgTZ2lH0=
expires
Mon, 31 Dec 2035 00:00:00 GMT
evt
lm.serving-sys.com/lm/ Frame A7BA
0
230 B
XHR
General
Full URL
https://lm.serving-sys.com/lm/evt
Requested by
Host: secure-ds.serving-sys.com
URL: https://secure-ds.serving-sys.com/BurstingCachedScripts//Ad_2_208_3_0/ebStdBanner.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.205.87.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-205-87-49.compute-1.amazonaws.com
Software
LogModule 0.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
Access-Control-Allow-Credentials
true
Server
LogModule 0.4
Content-Length
0
Content-Type
text/plain
Serving
bs.serving-sys.com/ Frame A7BA
24 B
629 B
XHR
General
Full URL
https://bs.serving-sys.com/Serving?cn=display&c=40&sessionid=2809218761221363612&ai=1083513824&usercookie=u2=9d332850-1355-46d3-a98a-97667ed1c0b8&oo=0&clsrc=2&clbv=_2_208_3_0&gdprpurposes=1023&dg=1076099838&sdg=1076633632&ctick=83&ord=0.2160897708622187
Requested by
Host: secure-ds.serving-sys.com
URL: https://secure-ds.serving-sys.com/BurstingCachedScripts//Ad_2_208_3_0/ebStdBanner.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.158.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-158-246.eu-central-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
2e7778c6ed3c31a131da378d6e573a1b3b6723037cdeea4c4832da83e60c9399

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
p3p
CP="NOI DEVa OUR BUS UNI"
access-control-allow-origin
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
cache-control
private
access-control-allow-credentials
true
content-type
text/html; charset=UTF-8
content-length
24
expires
Sun, 05-Jun-2005 22:00:00 GMT
adServer.bs
bs.serving-sys.com/Serving/ Frame A7BA
0
505 B
XHR
General
Full URL
https://bs.serving-sys.com/Serving/adServer.bs?cn=int&iv=2&interactionsStr=$$1083513824~~0~~1076099838~~2809218761221363612%5EActualSize~300x600~0~01020~86$$&usercookie=u2=9d332850-1355-46d3-a98a-97667ed1c0b8&rnd=0.6923059439647241&flv=-1&res=32
Requested by
Host: secure-ds.serving-sys.com
URL: https://secure-ds.serving-sys.com/BurstingCachedScripts//Ad_2_208_3_0/ebStdBanner.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.158.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-158-246.eu-central-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
p3p
CP="NOI DEVa OUR BUS UNI"
access-control-allow-origin
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-type
text/html; charset=UTF-8
content-length
0
expires
Sun, 05-Jun-2005 22:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 3364
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BrH05Pm8aYf-hCsbU7_UPq8Ke6AIAAAAAOAHgBAI&bg=!vb6lvvrNAAbOj6irzo87ACkAdvg8WjdxF24IIJpsW33z40bT_cYufBHhqGdPylbjq_PlPomsVVamwwIAAACkUgAAAApoAQeZAsCACiSk5GOhNGQdeKNUMmrI1o1WMo6lyd1hFM12LV2kTBK_GiEnrUBsDZ-xpnYDrSDOKzgbCcMlMIXuqS5q7W4KH_NkoHUHeOdFGdVMbZNFWaVSOOTV9kWNBtmj4-lJXOg1zTp3VE_X2x7ciqKLSaSWmforq0g6AfGz0Amms4xple4LdescMuvDtH1cgRnQjkjwWUS-QdZ-g4ugccaIls3AwSM_KpMd3RvZ7_S-Vtgg-qUC2PuFxeP_TEB7aaBnXEKFuoKp9TGGsGZHT0_3QfEL7goQSBUD7ewtF5ij-7-m0Dkf7LPokcpMLy6kxlTIYdihgBSHrU69NZeYyFDHdpATVBlOwfXNVhHwpRfymi7EHMhzKaTb_t9i7sM-C3GhLBiYlucNXueTN2L577bEtWVnOBYNUhph5iTGIsaMYYq2uFF4vWKTk3I19c0mfZpVpkat3c5SFSVECda214wo5QaOwcPC8mMoc-tcd2nJ38T_beaGs6FM33RaFk1BncAa8fN0BUwvE80mF5OI0yFYKBSdoMn0CEcwP8k-bkHqGBrDt4p4Ie7o5ekPzyzG6mntCuZ_FwzO7WBroJycP3CouAHnQbYRTQwEMFGG1YKA9c5wgCs9tKb9D4lmEZJXcnZyuYGOptQz0Uikjnv3ihK9FUvX-lBYSl63gqYnMcYFy9clEHbRK4tQ_MiriVEGaow9BUqZWtZ__sZYpkF4JabISgcnfYCcuk6mXPxGBHBfjmiohbARfKcB36l3LaCdooZ7HMVIAmhAuKbI5cxucp0PRnQHWE3nDlaVVvg3yN70HpkYl1Rqsd32HJx-RAaB4tvIozPUW188NORlhxrSnuXks1WscObZ1yQFKDBt-UtHlfAEc4pm2QoMjUpz1VBrL8P9-6bPwfjWKnfUWWjdH9hITrvD5gM56aszI1rRMza5GqsoJw
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 11DF
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvv9XplXtLv2g1bf6kzmRp9X_DCuol3BS33NWyZ4dWUHJP8bYMrFM2Ad_oUHwiVQz1HPDp9Qizken6NhbWX0rwgyspVqm0FQ172sOPPW0bgrSo9NSKyuEcMH-dV9A&sai=AMfl-YTkNrisv-vj7XrAB1I3W3osEKyfoHolGtpsC6u-DzNOgz50drF_i5tdc_1G3kJa2_yDBEt3Zhe0i459IWhe64-6MrpRv2t1LeK5qGjB3aQEXtCNX8RoHhEGtSvx4cZA&sig=Cg0ArKJSzDjhOW39FZTfEAE&cid=CAASFeRo7rrrztcpFhn_iNEc3cku2sMz7A&id=lidar2&mcvt=1001&p=190,975,440,1275&asp=190,975,440,1275&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210813&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=583895516&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629122365585&dlt=10&rpt=159&isd=0&lsd=0&msd=0&r=v&speed=1
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame A7BA
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvgIG2V5ZYv_T4qhyULabwL0Nc1XLf0BL08plaMjX3vKHyW2Xp7cEhmOQBmIq_GoGuAcPKPlTFMftr8FxS108XTEmePdHex4msWKPESkFU8XEeFPiYKGdTs7Ty3Qw&sai=AMfl-YRuvAfD6N9YIeEfDWnc33R41lsvc7CSHWW0ycc8tCeSwwtbfQM9lnKTivKvQT9YyaOMlhY9Rp1KJ8Mo-w4-BO-RTJbBaAiO43XRUZfQ2U4YuNhRxH515RkJH8iT0IF-&sig=Cg0ArKJSzIfJpG2QXSpaEAE&cid=CAASFeRox-4KtHsyccK8CEBoESnf6y77Mw&id=lidar2&mcvt=1000&p=1131,1234,1171,1275&asp=1131,1234,1171,1275&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210813&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=709049632&rs=4&met=ie&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629122366082&dlt=33&rpt=262&isd=0&lsd=0&msd=0&r=v&speed=1
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Aug 2021 13:59:27 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
data
b141.s248.meetrics.net/ Frame 11DF
43 B
308 B
Image
General
Full URL
https://b141.s248.meetrics.net/data?/eG0iEMYAATkzFARksFAQtjFztJNSA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.3.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h222.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:27 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Mon, 16-Aug-21 13:59:26 GMT
fa8a9580fd08931a5b14a3f85d075549.jpg
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
191 KB
191 KB
Image
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/fa8a9580fd08931a5b14a3f85d075549.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1c038fbd88fc69d675a8988d322fcf669c4ce57170192b0aa34c439106e4eb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:52:16 GMT
x-content-type-options
nosniff
last-modified
Thu, 29 Jul 2021 10:43:27 GMT
server
sffe
age
432
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
195638
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:07:16 GMT
data
b141.s248.meetrics.net/ Frame 11DF
43 B
308 B
Image
General
Full URL
https://b141.s248.meetrics.net/data?/eG0iFW7AAl2yFuvFfhFwpFTkzFARksFAQtjFZmRNSA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.3.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h222.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:29 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Mon, 16-Aug-21 13:59:28 GMT
data
b141.s248.meetrics.net/ Frame 11DF
43 B
308 B
Image
General
Full URL
https://b141.s248.meetrics.net/data?/eG0iGJOBATkzFARksFAQtjFjsJNSA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
136.243.3.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
h222.meetrics.de
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Aug 2021 13:59:30 GMT
Server
nginx
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-control
no-cache,no-store,must-revalidate
Connection
keep-alive
Expires
Mon, 16-Aug-21 13:59:29 GMT
int
lm.serving-sys.com/lm/ Frame A7BA
0
230 B
XHR
General
Full URL
https://lm.serving-sys.com/lm/int
Requested by
Host: secure-ds.serving-sys.com
URL: https://secure-ds.serving-sys.com/BurstingCachedScripts//Ad_2_208_3_0/ebStdBanner.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.205.87.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-205-87-49.compute-1.amazonaws.com
Software
LogModule 0.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin
https://9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
Access-Control-Allow-Credentials
true
Server
LogModule 0.4
Content-Length
0
Content-Type
text/plain
fa8a9580fd08931a5b14a3f85d075549.jpg
s0.2mdn.net/creatives/assets/4023062/ Frame 74BC
191 KB
191 KB
Image
General
Full URL
https://s0.2mdn.net/creatives/assets/4023062/fa8a9580fd08931a5b14a3f85d075549.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1c038fbd88fc69d675a8988d322fcf669c4ce57170192b0aa34c439106e4eb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/ads/richmedia/studio/pv2/61171919/20210202143115826/index.html?e=69&leftOffset=0&topOffset=0&c=wHSaAq45Uo&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 13:52:16 GMT
x-content-type-options
nosniff
last-modified
Thu, 29 Jul 2021 10:43:27 GMT
server
sffe
age
435
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
195638
x-xss-protection
0
expires
Mon, 16 Aug 2021 14:07:16 GMT
data
b141.s248.meetrics.net/ Frame 11DF
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
b141.s248.meetrics.net
URL
https://b141.s248.meetrics.net/data?/eG0iHGwBATkzFARksFAQtjFUxJNSA

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| lang string| GoogleAnalyticsObject function| ga string| pp_gemius_identifier function| gemius_pending function| gemius_hit function| gemius_event function| pp_gemius_hit function| pp_gemius_event function| $ function| jQuery object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| gemius_cmpclient object| gemius_hcconn number| pp_gemius_cnt function| load_search function| load_rate function| load_slider function| address_tolatlong function| oauth function| popupwindow function| load_social function| getURLParameter function| notif function| ad_flags function| emoticon function| load_tipster function| countdown function| price_rate function| load_lazy function| load_semantic function| pageview function| ajax_loadable function| popup_ad function| wallpaper function| right function| scrollpage function| load_masonry function| reload_masonry function| addstate function| replacestate function| isInViewport function| load_adsense function| escapeRegExp boolean| localhost string| dir string| sdir string| uri number| ww string| layout object| menu object| search object| busy boolean| resized object| count boolean| fullscreen object| lazy object| ajax number| menuheight object| curr string| fb_app_id number| width object| scrolling boolean| analitycs object| $wallpaper object| $popup object| $history function| fbq function| _fbq object| googletag object| ggeac object| google_js_reporting_queue boolean| gptLoaded number| adslots function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| ampInaboxIframes object| ampInaboxPendingMessages object| GoogleGcLKhOms function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| google_image_requests

5 Cookies

Domain/Path Name / Value
.framar.bg/ Name: _gat
Value: 1
.framar.bg/ Name: _ga
Value: GA1.2.627043016.1629122361
.framar.bg/ Name: __gfp_64b
Value: SUvWkAN.KMl5HPQim.4GxO_WRjh.ZaqVI1.0cyyNArr.G7|1629122360
.framar.bg/ Name: _gid
Value: GA1.2.701776015.1629122361
.framar.bg/ Name: framar_v7_2018
Value: lk0mobk9964fan0klrpln75lu2

3 Console Messages

Source Level URL
Text
console-api log (Line 23)
Message:
113
console-api log (Line 23)
Message:
113
console-api log (Line 23)
Message:
113

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors https://*.framar.bg/ 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9cfa2d727093d9a2ef8ea0acce778abb.safeframe.googlesyndication.com
adservice.google.com
adservice.google.de
adsys.insert.bg
b141.s248.meetrics.net
bs.serving-sys.com
cdn-images.mailchimp.com
cm.g.doubleclick.net
connect.facebook.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
gabg.hit.gemius.pl
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
images.dmca.com
lm.serving-sys.com
media.framar.bg
pagead2.googlesyndication.com
s0.2mdn.net
s248.meetrics.net
s248.mxcdn.net
secure-ds.serving-sys.com
securepubads.g.doubleclick.net
static.framar.bg
stats.g.doubleclick.net
sync.teads.tv
tpc.googlesyndication.com
us-u.openx.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
b141.s248.meetrics.net
136.243.3.97
142.250.181.226
142.250.184.194
142.250.185.98
151.139.242.29
178.132.86.60
185.33.221.15
2.16.186.25
2.18.233.67
2.18.234.21
23.45.108.93
2a00:1450:4001:803::2004
2a00:1450:4001:803::2006
2a00:1450:4001:803::200e
2a00:1450:4001:809::2001
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2002
2a00:1450:4001:811::2002
2a00:1450:4001:811::2004
2a00:1450:4001:813::2003
2a00:1450:4001:828::2001
2a00:1450:4001:829::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:830::200a
2a00:1450:4001:831::2003
2a00:1450:400c:c08::9b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f145:82:face:b00c:0:25de
35.244.159.8
54.205.87.49
54.93.158.246
65.9.79.92
78.128.6.34
79.124.75.51
88.198.52.202
01e86200726b4e98454cfa57e339174d75ec58979f340aeac70c647c2aac2848
020173820807c9ef2d38e74ddb3a22093ff7c27326f1f7348e1ec6f5c3aa1501
02ce38f5b8d88c0ab23184d295bae3fe2e4b6c793efac6c20c3fc1fa186678ce
04a7aa95c9475a51804e12ce60ea7ccd16cc5311b5f5800dab56a586c937a947
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
08d4e132e8ad9e23f61a5202ff77a2595e11deb35718592c7b09bee6666da084
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a796de18f0601165163596ec46445a07465299db0d7f934e29b395192c45e22
1c038fbd88fc69d675a8988d322fcf669c4ce57170192b0aa34c439106e4eb97
1d9ae9c2b13f600455e7ed99ff682742e47bf5491cdf6a6a382eff1479bb96c9
269bd69d6c1d25e848132ecfb48ec214040e49fd45e444760c3e226ca5fd7962
2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77
2e7778c6ed3c31a131da378d6e573a1b3b6723037cdeea4c4832da83e60c9399
2f0b7264810a4f05251ac724721a5a3a61887cff9bd30e1fbbc1bc832e94d38a
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029
3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7
408106c87372c56322eba467db72a14582b2081f72274f81050b52058875ea0d
4301cd45f98ed5527e5f7124672421b9f331172be8e928691a475d9f4a58bc77
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3
437d2a6994f6efd0312bcffac4c16b05a60b9d9b6b595cedaa6c6a23b32a2d68
4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d2883443b24e424527f6a0a7aa2897b3df71f239db40373c4ff760e48147801
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5473a1b5a3fa5443822b82f5b2fd19b1e6b8aa5f2c005f127cb524e331e2ba11
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
5a7be06bf8a03f9a03723900253cdf86beda08012f06fc5b52de0bbed24e6503
5c95b7ae9972bc9c9da2fa44ba13d8c2198a2e588e2138cf2688d594c8921eab
5e02194bef79f2bd3e8e9b6cc085807690d5ae1f9fe8a0f47e67c6028965ca51
5e454e46db2f4864eb2414775901072f5c932fe3f7aaa3c32ad888ececf2b831
66464d5b19daa9f0aa57283f2b8671327fc289e164c0a67c8456eb5a71f6d814
683c17912c216bfddb8a7c1f52a1e5394940b2788028262807993a65fcf9b954
6a40c3d1c001979c0900a3cc7440a124490aaa2cd2f289517e6eb67275efd2fb
6b377ab6c06360a74771ad2422411789491e1751e8e73aa113a2ef0c7809d09d
6b56fc94819942f107fe8b14483f71ac822c74a8f4f06bb493ec1655c37541b0
71e81530f4047cfe4d5dea50d7c3ef6d93efcf5d5b73aee5c71deec01b19e87d
7500dfacb8e6ee287398c0eee4bb84bf32849b808a3bf2240a5ebf3f14fb3879
7761979199bf20d25fe4726392f9e6c268295e5d179b2bb5a683cb10fb6ad0d2
797615e58c75e693b00cfe7d92ed4d478056e55c37d8429ad9332166ad3a4cd8
79cc39ab51de99510d98e22dfc56bd456b3ffbb29671e3d2e61719ee50792565
7b061d5f3a690d0cf42bfddbe6f928dd83530e5994271b2e0c9f6f210456a93f
7cfc4cec708b3ef2763009b293e7b21286f9e8e3e833486c9346653f3c64b4d1
7f3c5f63ccbd1ec90451543520be5271f6d289dc43f7888738c6d3949f519c2a
827cb6489a9f1ca31903ded44357bbffa902d97fb73ec5e091b37d689f8ae58f
828a463f63d56e8f1adbeada715664a8aa5ed4a8d2c1361967f5a0db822135f0
836f1dfab32f0c5396a51e712bc4388ba740ec4f2158964170f3dba614d13db6
83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85308bd0681cf8ccfcfbc231343ccd517beb8fa87ec8983b25911587def6bf8d
8998caec458197a509fccf1e993ba0fd7284d36c1f7de3d6fdd549eceaf3b6ac
89ee540bbb3aca4b8db6314526f492c377b8258640c18a7615dee490e3981852
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
99a336d42e4e130971fac5e498ac76a43d12fd0acb56a846543dfaa37eccb67c
9bdd30986e675e3bf5f2a6224998df0f43b29456d7508b5827c26245508d1036
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a05cc5ac54a292c6da7e975ab07ffb9a9d6a40bf16e808e8288f36ba643757b0
a0d935a7299a2841d3faefd10da9bcb94b5c14f7b62f02a8c9396cface3d1a08
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a64226eb76cbbf7401a530208e51b4fcbc992b2e253acd10e23f9d8744cf05e7
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a8b2cd57c0602b17629ec21097850f362133ab46298e49f34e95d3bb3b4d6d99
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b8f45c32872215c5067c4ee8370911aba19b8b12b9d65558c9d326ac94851e89
b959f2fbface7fc1e8968fe402772d4a3c82b930e3f6af03bda81bffcda3f859
baf754e587991454813c323a18df68165d30fd3dcb53c9326f3a6696e93d2f31
c1ef99d0be8824b94143a33208c1c30545c028ab365666d87fa109b50285a27a
c3019d406dd60c5d2782bd1bbeacb33e221050797927f76e56c93229fc476996
c4243f7f5aa95631ca62fab376c3804859e808b66d373d07270872d23b8b081b
c475336cb0ff67b379c301938f81e4cdafd871a2a73e32afec2ce5c02416be1f
c5239ff1a3bb2d94df21411a1d60de9590fb061b5dd8dfca89155993cc1ff44f
c7e1bce9874a76bf4e23242fbc125fa4af027a3e09830b4e643c39dbd4e589e9
c9db938215f2ff34f7d14783a3dfeaa79c4d787d7c2db6eeb5fbb9fd48450056
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d4deb3935b0b32858e4233eeaf8c196244f17555d2beb90be70cd2b6cff543c8
d585510ebf6dccd5790b2083b5e4425473fa2277aef2dc2be1fcba2d04f47e33
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d7d86060c574ba0aec7350fe1cb355ab8cde4827a5ee318640292cb346e649dd
d90d26b6ea47e7fea82b6ce3eb344233db9053cb45e55f25dfb3c320ffc599ab
d9229ae35321b85d514e96b63261eef7e4155348b269b9b8e75e2a964a4464e9
dc1956c857b8efbfd8a6e8ed94d5a57aa54dfb34305d3e79cbec2547d682d170
deb605e510e9a1e2612812d7d2fb0d8a6dbbaeb840344b27d754dc504e841608
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
e7d4d5340bbe57a01d8f7992142e2763d438d5783890c76748306eebfa056a69
e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0
e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770
e941f1bbc1d2944a5736ddb7ac07622a19eb578bd535e5ac4785d3f2662fe4a3
e98a1273451d9c990f69b8e455cc3119feca8af8e0f20dc0b7c4982217550458
ec4dc85fedc0e2bb8d0810a195eaa27a05ea3c2b518b8acf31900fef60a91b8f
ee40139e57f52990fba5c8ddc8e14020bc73696ec15eb2d4ad102dee5361953d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5a7f3ae46790934d7d73c03987d4a998c35cbdab3b32cd44b514f90fea54916
f9da31cabd7ad9f32c9a2c18ce1838a6eaeeca9fbf55995a3e5a2abb2aface6b
fad57ffa341bfb8f1762f9e4c59c0cf4839b6141c11ae41b7aad142b450f0619
fe7ba6878c2a97b24c7d5e94f3a65e27b7bad627c521c461fd8b044598b31247