pravoteka.ru Open in urlscan Pro
91.239.27.42 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://pravoteka.ru/
Submission: On October 07 via api (October 7th 2022, 4:10:21 am UTC) from US — Scanned from DE

Summary HTTP 63 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 17 IPs in 4 countries across 17 domains to perform 63 HTTP transactions. The main IP is 91.239.27.42, located in Russian Federation and belongs to MNGTNET, RU. The main domain is pravoteka.ru.

This is the only time pravoteka.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
14	91.239.27.42 91.239.27.42	199274 (MNGTNET) (MNGTNET)
2	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
5	75.2.81.221 75.2.81.221	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1 1	2a02:6b8::90 2a02:6b8::90	13238 (YANDEX) (YANDEX)
4 9	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
4	2a02:6b8:20::215 2a02:6b8:20::215	13238 (YANDEX) (YANDEX)
4	2a00:1450:400... 2a00:1450:400d:806::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:400d:806::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
4	2600:9000:214... 2600:9000:214f:dc00:1d:4618:5c80:21	16509 (AMAZON-02) (AMAZON-02)
1	185.53.178.30 185.53.178.30	61969 (TEAMINTER...) (TEAMINTERNET-AS)
1	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80a::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
63	17

14 91.239.27.42 (Russian Federation)

ASN199274 (MNGTNET, RU)
PTR: 91-239-27-42.flops.ru

pravoteka.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 75.2.81.221 (United States)

ASN16509 (AMAZON-02, US)
PTR: a2e6b661ca0e4c4c4.awsglobalaccelerator.com

api.leadiacloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
form.leadiacloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::90 (Moscow, Russian Federation) 1 redirects

ASN13238 (YANDEX, RU)

bs.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:6b8::1:119 (Moscow, Russian Federation) 4 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:6b8:20::215 (Russian Federation)

ASN13238 (YANDEX, RU)

site.yandex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400d:806::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:806::2002 (Ireland)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:214f:dc00:1d:4618:5c80:21 (United States)

ASN16509 (AMAZON-02, US)

d38psrni17bvxu.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.53.178.30 (Germany)

ASN61969 (TEAMINTERNET-AS, DE)

c.parkingcrew.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80e::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80a::2001 (Ireland)

ASN15169 (GOOGLE, US)

afs.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	pravoteka.ru pravoteka.ru	211 KB
9	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 131 tpc.googlesyndication.com — Cisco Umbrella Rank: 170	205 KB
7	google.com www.google.com — Cisco Umbrella Rank: 19 adservice.google.com — Cisco Umbrella Rank: 136	110 KB
5	yandex.com 2 redirects mc.yandex.com — Cisco Umbrella Rank: 8250	2 KB
5	yandex.ru 3 redirects bs.yandex.ru — Cisco Umbrella Rank: 27584 mc.yandex.ru — Cisco Umbrella Rank: 2147	58 KB
5	leadiacloud.com api.leadiacloud.com form.leadiacloud.com	9 KB
4	cloudfront.net d38psrni17bvxu.cloudfront.net	21 KB
4	gstatic.com fonts.gstatic.com	114 KB
3	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 68	5 KB
3	yandex.net site.yandex.net — Cisco Umbrella Rank: 65564	28 KB
2	googleusercontent.com afs.googleusercontent.com — Cisco Umbrella Rank: 13666	1 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 118	2 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 5221	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1003	647 B
1	yastatic.net yastatic.net — Cisco Umbrella Rank: 3474	28 KB
1	parkingcrew.net c.parkingcrew.net — Cisco Umbrella Rank: 131389	1005 B
0	leadia.ru Failed promo.leadia.ru Failed
63	17

	Domain	Requested by
14	pravoteka.ru	pravoteka.ru
6	www.google.com	form.leadiacloud.com www.google.com tpc.googlesyndication.com
6	pagead2.googlesyndication.com	pravoteka.ru pagead2.googlesyndication.com tpc.googlesyndication.com
5	mc.yandex.com	2 redirects pravoteka.ru
4	d38psrni17bvxu.cloudfront.net	form.leadiacloud.com d38psrni17bvxu.cloudfront.net
4	form.leadiacloud.com	pravoteka.ru d38psrni17bvxu.cloudfront.net form.leadiacloud.com
4	fonts.gstatic.com	fonts.googleapis.com
4	mc.yandex.ru	2 redirects pravoteka.ru
3	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
3	googleads.g.doubleclick.net	pagead2.googlesyndication.com
3	site.yandex.net	pravoteka.ru site.yandex.net
2	afs.googleusercontent.com	www.google.com
2	fonts.googleapis.com	pravoteka.ru
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	yastatic.net	site.yandex.net
1	c.parkingcrew.net	form.leadiacloud.com
1	bs.yandex.ru	1 redirects
1	api.leadiacloud.com	pravoteka.ru
0	promo.leadia.ru Failed	pravoteka.ru
63	21

This site contains links to these domains. Also see Links.

Domain
www.namars.ru
metrika.yandex.ru

Subject Issuer	Validity	Valid
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.yastatic-net.ru GlobalSign ECC OV SSL CA 2018	`2022-08-31` - `2023-02-28`	6 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2022-05-21` - `2022-10-31`	5 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh

This page contains 8 frames:

Primary Page: http://pravoteka.ru/
Frame ID: 03F7BEB6E5BB8D7F374F295ED8026B3B
Requests: 39 HTTP requests in this frame

Frame: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
Frame ID: B09B4CFA273A845BFD32BD32928FF393
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/zrt_lookup.html
Frame ID: 83EB9AFE5E17387C77F136FFA96E0F6D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5845613288065918&output=html&h=600&slotname=4030725388&adk=788576250&adf=4059110530&pi=t.ma~as.4030725388&w=200&fwrn=4&fwrnh=100&lmt=1665115817&rafmt=1&format=200x600&url=http%3A%2F%2Fpravoteka.ru%2F&fwr=0&rpe=1&resp_fmts=4&wgl=1&dt=1665115816864&bpp=6&bdt=640&idt=261&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&correlator=775186128882&frm=20&pv=2&ga_vid=539074730.1665115817&ga_sid=1665115817&ga_hid=885956909&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=315&ady=174&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44761793%2C42531705%2C44774293%2C31062931%2C31068920&oid=2&pvsid=4157380081794447&tmod=883904413&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&fsb=1&xpc=swOiGeGB6J&p=http%3A//pravoteka.ru&dtd=277
Frame ID: B609B7306A5388CF215F3633AA8ED7B5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5845613288065918&output=html&adk=1812271804&adf=3025194257&lmt=1665115817&plat=9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fpravoteka.ru%2F&ea=0&pra=7&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&dt=1665115816887&bpp=2&bdt=664&idt=262&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=200x600&nras=1&correlator=775186128882&frm=20&pv=1&ga_vid=539074730.1665115817&ga_sid=1665115817&ga_hid=885956909&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44761793%2C42531705%2C44774293%2C31062931%2C31068920&oid=2&pvsid=4157380081794447&tmod=883904413&uas=0&nvt=1&fsapi=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=2&uci=a!2&fsb=1&dtd=268
Frame ID: EA46D9B09AD879F2387A4707A4BA811D
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/afs/ads?adtest=off&psid=1420240428&pcsa=false&channel=000001%2Cbucket078&client=dp-teaminternet04_3ph&r=m&sc_status=0&hl=de&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2477992239354928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300953%2C17300956%2C17301063%2C17301066%2C17301094%2C17301097&format=r3%7Cs&nocache=6391665115817413&num=0&output=afd_ads&domain_name=form.leadiacloud.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1665115817414&u_w=1600&u_h=1200&biw=-12245933&bih=-12245933&isw=750&ish=370&psw=750&psh=789&frm=2&cl=478865286&uio=--&cont=tc&jsid=caf&jsv=478865286&rurl=http%3A%2F%2Fform.leadiacloud.com%2F%3Fp%3Dlawyer%26t%3Dblue%26w%3D434%26product%3Dlawyer%26template%3Dblue%26style%3Ddefault%26width%3D750%26height%3D370%26ref%3D&referer=http%3A%2F%2Fpravoteka.ru%2F&adbw=master-1%3A530
Frame ID: 8B1853E8E4564525D8CCD527096BF279
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 1A372FC2132173410009DD03731FF90F
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E31888016E3D8E5938F296226239B0BE
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Портал правовой помощи - Правотека.ру

Detected technologies

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

63
Requests

40 %
HTTPS

76 %
IPv6

17
Domains

21
Subdomains

17
IPs

4
Countries

793 kB
Transfer

1571 kB
Size

15
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://www.namars.ru/

Search URL Search Domain Scan URL

URL: https://metrika.yandex.ru/stat/?id=25914452&from=informer

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

http://bs.yandex.ru/informer/25914452/3_1_FFFFFFFF_EFEFEFFF_0_pageviews HTTP 302
https://mc.yandex.ru/informer/25914452/3_1_FFFFFFFF_EFEFEFFF_0_pageviews

Request Chain 24

http://mc.yandex.ru/metrika/watch.js HTTP 302
https://mc.yandex.ru/metrika/watch.js

Request Chain 45

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9783.M3EmPdQO5RXsCfa5vZ_45QgUscrWpawfKkW0E9eay6d8TJUx2MOnofDmttbK2J1e.HVGpuaD9NGAoxk2A8KQHAq9qy8Y%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9783.7xSLnScH12hz_c8MU0mPWqW7v_aBDmcslcbmsVxe-NRMKezacw_Cr4CY3XA2cF8346vnQGOykVvGv2OXt9sUFg%2C%2C.vVb7SmtSqJclvjCOzrNX5CqluT0%2C

Request Chain 48

https://mc.yandex.com/watch/25914452?wmode=7&page-url=http%3A%2F%2Fpravoteka.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aasbylctlprmpze3z6p9rs%3Afp%3A1557%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A908319579091%3Ahid%3A788634063%3Az%3A0%3Ai%3A20221007041017%3Aet%3A1665115817%3Ac%3A1%3Arn%3A365589856%3Arqn%3A1%3Au%3A1665115817455052996%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A61%2C71%2C872%2C214%2C0%2C0%2C%2C347%2C11%2C%2C%2C%2C1566%3Acpf%3A1%3Antf%3A1%3Ans%3A1665115815217%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1665115818%3At%3A%D0%9F%D0%BE%D1%80%D1%82%D0%B0%D0%BB%20%D0%BF%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D0%B8%20-%20%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D1%82%D0%B5%D0%BA%D0%B0.%D1%80%D1%83&t=gdpr(14)clc(0-0-0)aw(1)rqnt(1)rqnl(1)ti(2) HTTP 302
https://mc.yandex.com/watch/25914452/1?wmode=7&page-url=http%3A%2F%2Fpravoteka.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aasbylctlprmpze3z6p9rs%3Afp%3A1557%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A908319579091%3Ahid%3A788634063%3Az%3A0%3Ai%3A20221007041017%3Aet%3A1665115817%3Ac%3A1%3Arn%3A365589856%3Arqn%3A1%3Au%3A1665115817455052996%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A61%2C71%2C872%2C214%2C0%2C0%2C%2C347%2C11%2C%2C%2C%2C1566%3Acpf%3A1%3Antf%3A1%3Ans%3A1665115815217%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1665115818%3At%3A%D0%9F%D0%BE%D1%80%D1%82%D0%B0%D0%BB%20%D0%BF%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D0%B8%20-%20%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D1%82%D0%B5%D0%BA%D0%B0.%D1%80%D1%83&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29

63 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
pravoteka.ru/ 29 KB
29 KB 1004ms
872ms Document
text/html 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to

Full URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 7dc1f3f26f921b728ecb657f570a23dc51d567795970f5013a07bbc0adb92e62

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private
Content-Length: 29308
Content-Type: text/html; charset=utf-8
Date: Fri, 07 Oct 2022 04:10:14 GMT
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET

GET
H/1.1 200
OK general.css
pravoteka.ru/content/ 41 KB
41 KB 151ms
77ms Stylesheet
text/css 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to

Full URL: http://pravoteka.ru/content/general.css
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: ce178ae6dde5065409f91e5e6c06687ce43a74f5907c4aefe56bcf41e0a21eac

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Thu, 07 Apr 2016 05:26:24 GMT
Server: Microsoft-IIS/7.5
ETag: "463af68e90d11:0"
X-Powered-By: ASP.NET
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 41560

GET
H/1.1 200
OK css
fonts.googleapis.com/ 8 KB
1 KB 85ms
46ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Noto+Serif:400,700,400italic,700italic&subset=latin,cyrillic

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

HTTP/1.1

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2326c8e58bd9eee4b635b257ff6cc4eb99c3aa2bf169983fcf2860ba8dd7fcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:16 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Last-Modified: Fri, 07 Oct 2022 04:10:16 GMT
Server: ESF
Cross-Origin-Opener-Policy: same-origin-allow-popups
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Fri, 07 Oct 2022 04:10:16 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 1 KB
1 KB 85ms
47ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=PT+Sans:400&subset=latin,cyrillic

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

HTTP/1.1

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

642d14cd983fce2cea5db5afb04ff17ee03eeb3feb274a658e9b88cc8cc29d80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:16 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Last-Modified: Fri, 07 Oct 2022 04:10:16 GMT
Server: ESF
Cross-Origin-Opener-Policy: same-origin-allow-popups
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Fri, 07 Oct 2022 04:10:16 GMT

GET
H/1.1 200
OK jquery-2.0.3.min.js Show response
pravoteka.ru/scripts/ 82 KB
82 KB 154ms
78ms Script
application/x-javascript 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to

Full URL: http://pravoteka.ru/scripts/jquery-2.0.3.min.js
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: b13cb5989e08fcb02314209d101e1102f3d299109bdc253b62aa1da21c9e38ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:33 GMT
Server: Microsoft-IIS/7.5
ETag: "b8508745751fd01:0"
X-Powered-By: ASP.NET
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 83612

GET
H/1.1 200
OK jquery.unobtrusive-ajax.min.js Show response
pravoteka.ru/scripts/ 4 KB
4 KB 154ms
77ms Script
application/x-javascript 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to

Full URL: http://pravoteka.ru/scripts/jquery.unobtrusive-ajax.min.js
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 125b6b268c7662f295b841038ca5f594ae1cd5adf116cfdf867f529dcf535a38

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:34 GMT
Server: Microsoft-IIS/7.5
ETag: "d2946e46751fd01:0"
X-Powered-By: ASP.NET
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 3585

GET
H/1.1 200
OK jquery.validate.min.js Show response
pravoteka.ru/scripts/ 21 KB
21 KB 158ms
81ms Script
application/x-javascript 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to

Full URL: http://pravoteka.ru/scripts/jquery.validate.min.js
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 7705fee13417229d718f14947e9860d5bb2b25bd15c9f5cd834f2545c7bad0a6

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:35 GMT
Server: Microsoft-IIS/7.5
ETag: "14171347751fd01:0"
X-Powered-By: ASP.NET
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 21068

GET
H/1.1 200
OK jquery.validate.unobtrusive.min.js Show response
pravoteka.ru/scripts/ 6 KB
6 KB 159ms
81ms Script
application/x-javascript 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to

Full URL: http://pravoteka.ru/scripts/jquery.validate.unobtrusive.min.js
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: c43c532923fb3bc58b4f17d98f842122978ec76cc38d428149036e045f5ff0a1

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:36 GMT
Server: Microsoft-IIS/7.5
ETag: "10d69347751fd01:0"
X-Powered-By: ASP.NET
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 5700

GET
H/1.1 200
OK general.js Show response
pravoteka.ru/scripts/ 10 KB
10 KB 283ms
74ms Script
application/x-javascript 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to

Full URL: http://pravoteka.ru/scripts/general.js
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: c23b807171deb950e3eda0e89e61b9be4e43b6f2ed05fc50ab9efa1827454f04

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Sun, 24 May 2015 17:21:26 GMT
Server: Microsoft-IIS/7.5
ETag: "b4735f104696d01:0"
X-Powered-By: ASP.NET
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 10237

GET
H/1.1 200
OK widget.js Show response
api.leadiacloud.com/ 324 B
832 B 285ms
163ms Script
text/javascript 75.2.81.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://api.leadiacloud.com/widget.js?p=lawyer&c=6418225625563136&pos=right&margin=0&photo=5&color=336699&w=434&t=modern
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 75.2.81.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a2e6b661ca0e4c4c4.awsglobalaccelerator.com
Software: nginx /
Resource Hash: fb4566e6664a3326bf0bf9653ac3f7f177d288ab5a19436ce40f2f28afdcada8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:16 GMT
X-Language: german
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Transfer-Encoding: chunked
Accept-CH-Lifetime: 30
Content-Type: text/javascript;charset=UTF-8
Connection: keep-alive

GET runme.php
promo.leadia.ru/ 0
0

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 140 KB
51 KB 96ms
59ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

HTTP/1.1

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dfc86271a8e90d81b3afaf7476b4586502d4e2d26067495ce0ccf4263fc48540

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:16 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 14188216566997322129
Vary: Accept-Encoding, Origin
Content-Type: text/javascript; charset=UTF-8
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Timing-Allow-Origin: *
Content-Length: 51863
X-XSS-Protection: 0
Expires: Fri, 07 Oct 2022 04:10:16 GMT

GET
H/1.1 200
OK icon_namars.png
pravoteka.ru/Content/images/ 2 KB
2 KB 77ms
77ms Image
image/png 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pravoteka.ru/Content/images/icon_namars.png
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 9bf2371fd5fce55d6fed8607d9d9f3bfc548cc5952c9017b5b2b330dfb2fae80

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:26 GMT
Server: Microsoft-IIS/7.5
ETag: "fc55bf41751fd01:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 2090

GET
H2

200

3_1_FFFFFFFF_EFEFEFFF_0_pageviews
mc.yandex.ru/informer/25914452/
Redirect Chain

http://bs.yandex.ru/informer/25914452/3_1_FFFFFFFF_EFEFEFFF_0_pageviews
https://mc.yandex.ru/informer/25914452/3_1_FFFFFFFF_EFEFEFFF_0_pageviews

1 KB
2 KB

206ms
82ms

Image
image/png

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/informer/25914452/3_1_FFFFFFFF_EFEFEFFF_0_pageviews

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

8e2984d02ff87ec808f84282cefe64d61ab5fdb34c6c3405b44abc2754c1323d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
last-modified: Fri, 07-Oct-2022 04:10:17 GMT
content-type: image/png
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 1304
x-xss-protection: 1; mode=block
expires: Fri, 07-Oct-2022 04:10:17 GMT

Redirect headers

Location: https://mc.yandex.ru/informer/25914452/3_1_FFFFFFFF_EFEFEFFF_0_pageviews
Strict-Transport-Security: max-age=31536000
Timing-Allow-Origin: *
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK all.js Show response
site.yandex.net/v2.0/js/ 56 KB
18 KB 250ms
69ms Script
application/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

http://site.yandex.net/v2.0/js/all.js

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

HTTP/1.1

Server

2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

70a0083e92cf715231f7734f0ecf0365c77ec3fdfe97921d75b39afd09871711

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:16 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=43200000; includeSubDomains;
NEL: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
Connection: keep-alive
Content-Length: 17550
Last-Modified: Thu, 14 Jan 2021 10:10:45 GMT
Server: nginx/1.17.9
Etag: "8f2519316a4049b587937d3aad5b2c1c"
Vary: Accept-Encoding
Report-To: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=216013
Accept-Ranges: bytes
Timing-Allow-Origin: *
Keep-Alive: timeout=5
X-Robots-Tag: noindex, noarchive, nofollow
Expires: Sun, 09 Oct 2022 16:08:24 GMT

GET
H/1.1 200
OK pravoteka.png
pravoteka.ru/content/images/ 4 KB
4 KB 76ms
75ms Image
image/png 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pravoteka.ru/content/images/pravoteka.png
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/content/general.css
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 04b015935b74fade2c32e2b92b2bdfae9bcea303f0d467541aaa0c7c0d668ea2

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/content/general.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:28 GMT
Server: Microsoft-IIS/7.5
ETag: "1c127e42751fd01:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 3698

GET
H/1.1 200
OK home_active.png
pravoteka.ru/content/images/ 1 KB
1 KB 81ms
80ms Image
image/png 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pravoteka.ru/content/images/home_active.png
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/content/general.css
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 5b44c0942c44f32b55cb89c8a3d9aa7a35c4be96a671a7c8519fdb273743eda0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/content/general.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:26 GMT
Server: Microsoft-IIS/7.5
ETag: "ca317a41751fd01:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1045

GET
H/1.1 200
OK menu_item_active_arrow.png
pravoteka.ru/content/images/ 3 KB
4 KB 76ms
75ms Image
image/png 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pravoteka.ru/content/images/menu_item_active_arrow.png
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/content/general.css
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: aceb498ab3120229304e62efcf6f8ce3e3ecc9079422d9278574f5ec3cc119c6

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/content/general.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:27 GMT
Server: Microsoft-IIS/7.5
ETag: "c6f0fa41751fd01:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 3577

GET
H/1.1 200
OK menu_item_arrow.png
pravoteka.ru/content/images/ 2 KB
2 KB 82ms
81ms Image
image/png 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pravoteka.ru/content/images/menu_item_arrow.png
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/content/general.css
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 5dda937522f40b5015a13566d480f17545f398444e841f8d09d21de9b1f1f2cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/content/general.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:27 GMT
Server: Microsoft-IIS/7.5
ETag: "eaed3842751fd01:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1571

GET
H/1.1 200
OK jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v17/ 44 KB
45 KB 106ms
51ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=PT+Sans:400&subset=latin,cyrillic

Protocol

HTTP/1.1

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://pravoteka.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Thu, 06 Oct 2022 05:11:42 GMT
X-Content-Type-Options: nosniff
Age: 82714
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 45300
X-XSS-Protection: 0
Last-Modified: Wed, 27 Apr 2022 16:11:08 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Fri, 06 Oct 2023 05:11:42 GMT

GET
H/1.1 200
OK ga6Iaw1J5X9T9RW6j9bNfFcWaA.woff2
fonts.gstatic.com/s/notoserif/v21/ 23 KB
24 KB 106ms
52ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/notoserif/v21/ga6Iaw1J5X9T9RW6j9bNfFcWaA.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Noto+Serif:400,700,400italic,700italic&subset=latin,cyrillic

Protocol

HTTP/1.1

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25475d82cc976fb2c71b15b3e416c22bf636dd247bbb268d312e7c076ec5b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://pravoteka.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Tue, 04 Oct 2022 16:37:25 GMT
X-Content-Type-Options: nosniff
Age: 214371
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 23948
X-XSS-Protection: 0
Last-Modified: Mon, 09 May 2022 19:47:44 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Wed, 04 Oct 2023 16:37:25 GMT

GET
H/1.1 200
OK jizaRExUiTo99u79D0aExdGM.woff2
fonts.gstatic.com/s/ptsans/v17/ 28 KB
29 KB 105ms
52ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0aExdGM.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=PT+Sans:400&subset=latin,cyrillic

Protocol

HTTP/1.1

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e9c22d02fc319b701844b334477a05fd32acee9668feb98672f6c27887f79cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://pravoteka.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Tue, 04 Oct 2022 13:35:38 GMT
X-Content-Type-Options: nosniff
Age: 225278
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 28444
X-XSS-Protection: 0
Last-Modified: Wed, 27 Apr 2022 16:45:23 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Wed, 04 Oct 2023 13:35:38 GMT

GET
H/1.1 200
OK ga6Iaw1J5X9T9RW6j9bNfFMWaCi_.woff2
fonts.gstatic.com/s/notoserif/v21/ 16 KB
16 KB 103ms
53ms Font
font/woff2 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/notoserif/v21/ga6Iaw1J5X9T9RW6j9bNfFMWaCi_.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Noto+Serif:400,700,400italic,700italic&subset=latin,cyrillic

Protocol

HTTP/1.1

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

749532b47faa826b6001b06da2e4085a3118525b9c9164fd0aa10e9944b9967a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fonts.googleapis.com/
Origin: http://pravoteka.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Tue, 04 Oct 2022 19:36:17 GMT
X-Content-Type-Options: nosniff
Age: 203639
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 16132
X-XSS-Protection: 0
Last-Modified: Mon, 09 May 2022 19:36:36 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Wed, 04 Oct 2023 19:36:17 GMT

GET
H/1.1 200
OK / Show response
form.leadiacloud.com/ Frame B09B 11 KB
6 KB 273ms
171ms Document
text/html 75.2.81.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/
Protocol: HTTP/1.1
Server: 75.2.81.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a2e6b661ca0e4c4c4.awsglobalaccelerator.com
Software: nginx /
Resource Hash: fda0e195523bc82e4bc37b4b18ad3056f1f0eadb56cb318df9b12a4f087895d6

Request headers

Referer: http://pravoteka.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-CH: viewport-width dpr device-memory rtt downlink ect ua ua-full-version ua-platform ua-platform-version ua-arch ua-model ua-mobile
Accept-CH-Lifetime: 30
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 07 Oct 2022 04:10:17 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_cUqjmgDhOcVgz7YVsZe2Lnz+v4V78+zqAKkYB1yHWgGC9IK8Yk3EJDuvtA+xbuqqgmnQ2X4EvPRqKW8ZtPEqRA==
X-Buckets: bucket078
X-Language: german
X-Template: tpl_Regnitz_twoclick

GET
H/1.1 200
OK counter.png
pravoteka.ru/content/images/ 1 KB
1 KB 78ms
78ms Image
image/png 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pravoteka.ru/content/images/counter.png
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/content/general.css
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 32bf21d0d9c9436dbb37b5de9ef459aec4ca44a93158ddba003010649446610d

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/content/general.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:24 GMT
Server: Microsoft-IIS/7.5
ETag: "2c167b40751fd01:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1176

GET
H2

200

watch.js Show response
mc.yandex.ru/metrika/
Redirect Chain

http://mc.yandex.ru/metrika/watch.js
https://mc.yandex.ru/metrika/watch.js

159 KB
56 KB

324ms
161ms

Script
application/javascript

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

1b3dfcfe97d043475a764d9c2f2072aa76cb46141e59eea505f16dd5bc8ab28e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Tue, 04 Oct 2022 10:25:54 GMT
etag: "633be002-df26"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 57126
expires: Fri, 07 Oct 2022 05:10:17 GMT

Redirect headers

Location: https://mc.yandex.ru/metrika/watch.js
Content-Length: 0

GET
H/1.1 200
OK socials.png
pravoteka.ru/content/images/ 4 KB
4 KB 77ms
75ms Image
image/png 91.239.27.42
MNGTNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pravoteka.ru/content/images/socials.png
Requested by: Host: pravoteka.ru
URL: http://pravoteka.ru/content/general.css
Protocol: HTTP/1.1
Server: 91.239.27.42 , Russian Federation, ASN199274 (MNGTNET, RU),
Reverse DNS: 91-239-27-42.flops.ru
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 1dfbc1d09e0617d703cc890ce164904a5b8c03240af16f4edb43080b631c9c10

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/content/general.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:14 GMT
Last-Modified: Wed, 24 Dec 2014 12:29:28 GMT
Server: Microsoft-IIS/7.5
ETag: "b047f542751fd01:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 3806

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/ 349 KB
115 KB 156ms
72ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5845613288065918&plah=pravoteka.ru

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

488b112425a02f7abea521a22023ede7eaa0cd6108c7b49a894554f6437b22e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117220
x-xss-protection: 0
server: cafe
etag: 10573265793117252544
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 04:10:16 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/ Frame 83EB 10 KB
5 KB 174ms
50ms Document
text/html 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://pravoteka.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 82442
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 05:16:15 GMT
etag: 9671129459699598864
expires: Thu, 20 Oct 2022 05:16:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK caf.js Show response
www.google.com/adsense/domains/ Frame B09B 145 KB
53 KB 84ms
46ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.google.com/adsense/domains/caf.js

Requested by

Host: form.leadiacloud.com
URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=

Protocol

HTTP/1.1

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9e8a75d0dfde2af31be915751e50263f1ce59f51fa49a6b7ffb54ade4bb306a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:17 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
X-XSS-Protection: 0
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
ETag: "11059703472354090869"
Vary: Accept-Encoding
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Content-Type: text/javascript; charset=UTF-8
Cache-Control: private, max-age=3600
Accept-Ranges: bytes
Expires: Fri, 07 Oct 2022 04:10:17 GMT

GET
H/1.1 200
OK style.css
d38psrni17bvxu.cloudfront.net/themes/assets/ Frame B09B 829 B
827 B 88ms
37ms Stylesheet
text/css 2600:9000:214f:dc00:1d:4618:5c80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d38psrni17bvxu.cloudfront.net/themes/assets/style.css
Requested by: Host: form.leadiacloud.com
URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
Protocol: HTTP/1.1
Server: 2600:9000:214f:dc00:1d:4618:5c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 93a1109ada0cd55dedeaf7e9c4251a7f91ac3c3e1ab85e25e37b6cd4e47d504b

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Thu, 06 Oct 2022 07:34:23 GMT
Content-Encoding: gzip
Via: 1.1 fc7091924e65025d5bfb92361ec3e660.cloudfront.net (CloudFront)
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
Server: nginx
X-Amz-Cf-Pop: FRA53-C1
Age: 74154
ETag: W/"5ebab1f0-33d"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: 9X3XwbfgH2dXpIZYx3dqD_oK8UefGr1Dc8rn_Sv_qQnrHsHIqxKhsQ==

GET
H/1.1 200
OK style.css
d38psrni17bvxu.cloudfront.net/themes/regnitz_0f823431/ Frame B09B 1 KB
1022 B 88ms
37ms Stylesheet
text/css 2600:9000:214f:dc00:1d:4618:5c80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d38psrni17bvxu.cloudfront.net/themes/regnitz_0f823431/style.css
Requested by: Host: form.leadiacloud.com
URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
Protocol: HTTP/1.1
Server: 2600:9000:214f:dc00:1d:4618:5c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 73c8b1941a2a223b487245530177d98cab9ac48b1ce903a48b29c76c96c1fda4

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 01:47:11 GMT
Content-Encoding: gzip
Via: 1.1 48391c4ed2c51e95dcabcb70cf613126.cloudfront.net (CloudFront)
Last-Modified: Fri, 25 Feb 2022 11:24:01 GMT
Server: nginx
X-Amz-Cf-Pop: FRA53-C1
Age: 8586
ETag: W/"6218bc51-4ec"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: YhtYuJSjo7Il-IyIVLCWLgVNdZnW9LnjEMLIsaXkX7J5Ay9Jjx0GmQ==

GET
H/1.1 200
OK sale_form.js Show response
c.parkingcrew.net/scripts/ Frame B09B 761 B
1005 B 139ms
87ms Script
application/javascript 185.53.178.30
TEAMINTERNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://c.parkingcrew.net/scripts/sale_form.js
Requested by: Host: form.leadiacloud.com
URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
Protocol: HTTP/1.1
Server: 185.53.178.30 , Germany, ASN61969 (TEAMINTERNET-AS, DE),
Reverse DNS
Software: nginx /
Resource Hash: f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:17 GMT
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
Server: nginx
ETag: "5ebab1f0-2f9"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 761

GET
H/1.1 200
OK js3caf.js Show response
d38psrni17bvxu.cloudfront.net/scripts/ Frame B09B 7 KB
7 KB 88ms
37ms Script
application/javascript 2600:9000:214f:dc00:1d:4618:5c80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://d38psrni17bvxu.cloudfront.net/scripts/js3caf.js
Requested by: Host: form.leadiacloud.com
URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
Protocol: HTTP/1.1
Server: 2600:9000:214f:dc00:1d:4618:5c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ba5b7354353b0eec1637564dae072fee662a5b9862f6bf7ed5e60a5a76f2ef44

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 02:32:44 GMT
Via: 1.1 a75b67932d84d80b40e12159613deb16.cloudfront.net (CloudFront)
Last-Modified: Thu, 14 Jan 2021 10:54:01 GMT
Server: nginx
X-Amz-Cf-Pop: FRA53-C1
Age: 5853
ETag: "600022c9-1b58"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7000
X-Amz-Cf-Id: 2PO-BmNQay2VzNevqfOEfO-rk5Vl7XF1tP9CadloyzHly2vUQwGang==

GET
H2 200 jquery.min.js Show response
yastatic.net/jquery/1.6.2/ 89 KB
28 KB 189ms
58ms Script
application/x-javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/jquery/1.6.2/jquery.min.js

Requested by

Host: site.yandex.net
URL: http://site.yandex.net/v2.0/js/all.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 28368
last-modified: Mon, 12 Nov 2018 13:13:42 GMT
server: nginx/1.17.9
etag: "57f5e4ce99f95e1eb0f18d52b65b6769"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31556952
x-nginx-request-id: aa63c41a2072023c
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Oct 2023 16:04:29 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
647 B 129ms
46ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=pravoteka.ru&callback=_gfp_s_&client=ca-pub-5845613288065918

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5845613288065918&plah=pravoteka.ru

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

7c8fa7892ae1d6ee689fee61c75979fad9083cd79ad10348d017dcb2b200b424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 203
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 128ms
46ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=pravoteka.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 197ms
74ms Script
application/javascript 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pravoteka.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 400 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B609 603 B
217 B 89ms
88ms Document
text/html 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5845613288065918&output=html&h=600&slotname=4030725388&adk=788576250&adf=4059110530&pi=t.ma~as.4030725388&w=200&fwrn=4&fwrnh=100&lmt=1665115817&rafmt=1&format=200x600&url=http%3A%2F%2Fpravoteka.ru%2F&fwr=0&rpe=1&resp_fmts=4&wgl=1&dt=1665115816864&bpp=6&bdt=640&idt=261&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&correlator=775186128882&frm=20&pv=2&ga_vid=539074730.1665115817&ga_sid=1665115817&ga_hid=885956909&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=315&ady=174&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44761793%2C42531705%2C44774293%2C31062931%2C31068920&oid=2&pvsid=4157380081794447&tmod=883904413&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&fsb=1&xpc=swOiGeGB6J&p=http%3A//pravoteka.ru&dtd=277

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://pravoteka.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Oct 2022 04:10:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EA46 0
180 B 75ms
74ms Document
text/html 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5845613288065918&output=html&adk=1812271804&adf=3025194257&lmt=1665115817&plat=9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fpravoteka.ru%2F&ea=0&pra=7&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&dt=1665115816887&bpp=2&bdt=664&idt=262&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=200x600&nras=1&correlator=775186128882&frm=20&pv=1&ga_vid=539074730.1665115817&ga_sid=1665115817&ga_hid=885956909&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44761793%2C42531705%2C44774293%2C31062931%2C31068920&oid=2&pvsid=4157380081794447&tmod=883904413&uas=0&nvt=1&fsapi=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=2&uci=a!2&fsb=1&dtd=268

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://pravoteka.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 07 Oct 2022 04:10:17 GMT
expires: Fri, 07 Oct 2022 04:10:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK track.php Show response
form.leadiacloud.com/ Frame B09B 0
608 B 153ms
153ms XHR
text/html 75.2.81.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://form.leadiacloud.com/track.php?domain=leadiacloud.com&toggle=browserjs&uid=MTY2NTExNTgxNi45OTM6NzIyYmM1MGJmYmY4MGNkMWRmZmVmMzE3MWYxNTUyM2ZiYmI1NDQyNzI3YmYzYWFjNzBjYzU0YWQyYTc4MzhlZTo2MzNmYTZhOGYyNzAw
Requested by: Host: d38psrni17bvxu.cloudfront.net
URL: http://d38psrni17bvxu.cloudfront.net/scripts/js3caf.js
Protocol: HTTP/1.1
Server: 75.2.81.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a2e6b661ca0e4c4c4.awsglobalaccelerator.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:17 GMT
Content-Encoding: gzip
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
X-Custom-Track: browserjs
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Accept-CH-Lifetime: 30
Connection: keep-alive

POST
H/1.1 201
Created ls.php Show response
form.leadiacloud.com/ Frame B09B 0
911 B 163ms
162ms XHR
text/javascript 75.2.81.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://form.leadiacloud.com/ls.php
Requested by: Host: form.leadiacloud.com
URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
Protocol: HTTP/1.1
Server: 75.2.81.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a2e6b661ca0e4c4c4.awsglobalaccelerator.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Fri, 07 Oct 2022 04:10:17 GMT
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Transfer-Encoding: chunked
Accept-CH-Lifetime: 30
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: http://form.leadiacloud.com
Access-Control-Allow-Methods: POST, OPTIONS
Charset: utf-8
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_IA6C6M0Utowum/1CaNPvynk18Wcc6PlmkU6YQB8znASn0Uj9lM640N1U1OEjyxjKz2EQVejgaHOpj8faZ2/opg==
Connection: keep-alive
X-Log-Success: 633fa6a92192164fb74d9ab4

GET
H/1.1 200
OK arrows.png
d38psrni17bvxu.cloudfront.net/themes/regnitz_0f823431/img/ Frame B09B 11 KB
12 KB 37ms
37ms Image
image/png 2600:9000:214f:dc00:1d:4618:5c80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://d38psrni17bvxu.cloudfront.net/themes/regnitz_0f823431/img/arrows.png
Requested by: Host: d38psrni17bvxu.cloudfront.net
URL: http://d38psrni17bvxu.cloudfront.net/themes/regnitz_0f823431/style.css
Protocol: HTTP/1.1
Server: 2600:9000:214f:dc00:1d:4618:5c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 67dff0aad873050f12609885f2264417ccdd0d438311000a704c89f0865f7865

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://d38psrni17bvxu.cloudfront.net/themes/regnitz_0f823431/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Thu, 06 Oct 2022 09:14:43 GMT
Via: 1.1 a75b67932d84d80b40e12159613deb16.cloudfront.net (CloudFront)
Last-Modified: Fri, 25 Feb 2022 11:24:01 GMT
Server: nginx
X-Amz-Cf-Pop: FRA53-C1
Age: 68134
ETag: "6218bc51-2c6f"
X-Cache: Hit from cloudfront
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11375
X-Amz-Cf-Id: LGCFEydO2fJZQXpSGRjFPou44laNydnYYJqDXm2rr8WT2pgUrYk4gw==

GET
H2 200 ads Show response
www.google.com/afs/ Frame 8B18 6 KB
2 KB 199ms
117ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/afs/ads?adtest=off&psid=1420240428&pcsa=false&channel=000001%2Cbucket078&client=dp-teaminternet04_3ph&r=m&sc_status=0&hl=de&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2477992239354928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300953%2C17300956%2C17301063%2C17301066%2C17301094%2C17301097&format=r3%7Cs&nocache=6391665115817413&num=0&output=afd_ads&domain_name=form.leadiacloud.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1665115817414&u_w=1600&u_h=1200&biw=-12245933&bih=-12245933&isw=750&ish=370&psw=750&psh=789&frm=2&cl=478865286&uio=--&cont=tc&jsid=caf&jsv=478865286&rurl=http%3A%2F%2Fform.leadiacloud.com%2F%3Fp%3Dlawyer%26t%3Dblue%26w%3D434%26product%3Dlawyer%26template%3Dblue%26style%3Ddefault%26width%3D750%26height%3D370%26ref%3D&referer=http%3A%2F%2Fpravoteka.ru%2F&adbw=master-1%3A530

Requested by

Host: www.google.com
URL: http://www.google.com/adsense/domains/caf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

5a363bd54eef1a6c982e9132e005551f84d034c8d4ec3c2d93a38e01efb555b5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://form.leadiacloud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=3600
content-disposition: inline
content-encoding: br
content-length: 2103
content-type: text/html; charset=UTF-8
date: Fri, 07 Oct 2022 04:10:17 GMT
expires: Fri, 07 Oct 2022 04:10:17 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: gws
x-xss-protection: 0

GET
H2 200 suggest.js Show response
site.yandex.net/v2.0/js/ 8 KB
3 KB 61ms
60ms Script
application/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://site.yandex.net/v2.0/js/suggest.js

Requested by

Host: site.yandex.net
URL: http://site.yandex.net/v2.0/js/all.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

dc41be78fcb3b0ca16fc52b3026f8120ada7e9c8b6c1f989d84431ff689276cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 2610
last-modified: Thu, 14 Jan 2021 10:10:45 GMT
server: nginx/1.17.9
etag: "5905bc95497a3dcdd5543e8af9bb2553"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=216013
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 09 Oct 2022 16:06:17 GMT

GET
H2 200 opensearch.js Show response
site.yandex.net/v2.0/js/ 22 KB
7 KB 68ms
68ms Script
application/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://site.yandex.net/v2.0/js/opensearch.js

Requested by

Host: site.yandex.net
URL: http://site.yandex.net/v2.0/js/all.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

de66288f054df7f389e8281f87fb0a9a05095149f4e96d13c32a1c3b61b1a4a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 6188
last-modified: Thu, 14 Jan 2021 10:10:45 GMT
server: nginx/1.17.9
etag: "1df256fb3e065fdf3b47b6ac51380393"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=216013
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 09 Oct 2022 16:09:57 GMT

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9783.M3EmPdQO5RXsCfa5vZ_45QgUscrWpawfKkW0E9eay6d8TJUx2MOnofDmttbK2J1e.HVGpuaD9NGAoxk2A8KQHAq9qy8Y%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9783.7xSLnScH12hz_c8MU0mPWqW7v_aBDmcslcbmsVxe-NRMKezacw_Cr4CY3XA2cF8346vnQGOykVvGv2OXt9sUFg%2C%2C.vVb7SmtSqJclvjCOzrNX5CqluT0%2C

75 B
75 B

81ms
81ms

Image
text/html

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9783.7xSLnScH12hz_c8MU0mPWqW7v_aBDmcslcbmsVxe-NRMKezacw_Cr4CY3XA2cF8346vnQGOykVvGv2OXt9sUFg%2C%2C.vVb7SmtSqJclvjCOzrNX5CqluT0%2C

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9783.7xSLnScH12hz_c8MU0mPWqW7v_aBDmcslcbmsVxe-NRMKezacw_Cr4CY3XA2cF8346vnQGOykVvGv2OXt9sUFg%2C%2C.vVb7SmtSqJclvjCOzrNX5CqluT0%2C
date: Fri, 07 Oct 2022 04:10:17 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
112 B 81ms
81ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 04 Oct 2022 10:25:54 GMT
etag: "633be002-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Fri, 07 Oct 2022 05:10:17 GMT

GET
H3 200 caf.js Show response
www.google.com/adsense/domains/ Frame 8B18 145 KB
53 KB 126ms
47ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/adsense/domains/caf.js?pac=0

Requested by

Host: www.google.com
URL: https://www.google.com/afs/ads?adtest=off&psid=1420240428&pcsa=false&channel=000001%2Cbucket078&client=dp-teaminternet04_3ph&r=m&sc_status=0&hl=de&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2477992239354928&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17300953%2C17300956%2C17301063%2C17301066%2C17301094%2C17301097&format=r3%7Cs&nocache=6391665115817413&num=0&output=afd_ads&domain_name=form.leadiacloud.com&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1665115817414&u_w=1600&u_h=1200&biw=-12245933&bih=-12245933&isw=750&ish=370&psw=750&psh=789&frm=2&cl=478865286&uio=--&cont=tc&jsid=caf&jsv=478865286&rurl=http%3A%2F%2Fform.leadiacloud.com%2F%3Fp%3Dlawyer%26t%3Dblue%26w%3D434%26product%3Dlawyer%26template%3Dblue%26style%3Ddefault%26width%3D750%26height%3D370%26ref%3D&referer=http%3A%2F%2Fpravoteka.ru%2F&adbw=master-1%3A530

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b621c7b7655254c456bd2ec21f8ec8b16a1379cddc3e8312ac0b44fd32ecd388

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
etag: "11890004755756193255"
vary: Accept-Encoding
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
accept-ranges: bytes
expires: Fri, 07 Oct 2022 04:10:17 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/25914452/
Redirect Chain

https://mc.yandex.com/watch/25914452?wmode=7&page-url=http%3A%2F%2Fpravoteka.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aasbylctlprmpze3z6p9rs%3Afp%3A1557%3Afu%3A0%3Aen%3Autf-8%3Ala%...
https://mc.yandex.com/watch/25914452/1?wmode=7&page-url=http%3A%2F%2Fpravoteka.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aasbylctlprmpze3z6p9rs%3Afp%3A1557%3Afu%3A0%3Aen%3Autf-8%3Al...

427 B
533 B

84ms
84ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/25914452/1?wmode=7&page-url=http%3A%2F%2Fpravoteka.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aasbylctlprmpze3z6p9rs%3Afp%3A1557%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A908319579091%3Ahid%3A788634063%3Az%3A0%3Ai%3A20221007041017%3Aet%3A1665115817%3Ac%3A1%3Arn%3A365589856%3Arqn%3A1%3Au%3A1665115817455052996%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A61%2C71%2C872%2C214%2C0%2C0%2C%2C347%2C11%2C%2C%2C%2C1566%3Acpf%3A1%3Antf%3A1%3Ans%3A1665115815217%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1665115818%3At%3A%D0%9F%D0%BE%D1%80%D1%82%D0%B0%D0%BB%20%D0%BF%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D0%B8%20-%20%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D1%82%D0%B5%D0%BA%D0%B0.%D1%80%D1%83&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29

Requested by

Host: pravoteka.ru
URL: http://pravoteka.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

e28b23d44b57c33a3471ae8825564a0a69c95b581306dc75c18c0dad82609306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Oct 2022 04:10:17 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Fri, 07-Oct-2022 04:10:17 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: http://pravoteka.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 427
x-xss-protection: 1; mode=block
expires: Fri, 07-Oct-2022 04:10:17 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 Oct 2022 04:10:17 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 07-Oct-2022 04:10:17 GMT
location: /watch/25914452/1?wmode=7&page-url=http%3A%2F%2Fpravoteka.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aasbylctlprmpze3z6p9rs%3Afp%3A1557%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A908319579091%3Ahid%3A788634063%3Az%3A0%3Ai%3A20221007041017%3Aet%3A1665115817%3Ac%3A1%3Arn%3A365589856%3Arqn%3A1%3Au%3A1665115817455052996%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A61%2C71%2C872%2C214%2C0%2C0%2C%2C347%2C11%2C%2C%2C%2C1566%3Acpf%3A1%3Antf%3A1%3Ans%3A1665115815217%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1665115818%3At%3A%D0%9F%D0%BE%D1%80%D1%82%D0%B0%D0%BB%20%D0%BF%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D0%B8%20-%20%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D1%82%D0%B5%D0%BA%D0%B0.%D1%80%D1%83&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29rqnl%281%29ti%282%29
access-control-allow-origin: http://pravoteka.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Fri, 07-Oct-2022 04:10:17 GMT

GET
H2 200 search.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame 8B18 391 B
890 B 190ms
51ms Image
image/svg+xml 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 06 Oct 2022 11:51:30 GMT
age: 58727
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
last-modified: Thu, 19 Dec 2019 14:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
vary: Accept-Encoding
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type: image/svg+xml
cache-control: public, max-age=82800
accept-ranges: bytes
expires: Fri, 07 Oct 2022 10:51:30 GMT

GET
H2 200 chevron.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame 8B18 200 B
289 B 190ms
52ms Image
image/svg+xml 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 07 Oct 2022 00:50:04 GMT
age: 12013
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 174
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
vary: Accept-Encoding
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type: image/svg+xml
cache-control: public, max-age=82800
accept-ranges: bytes
expires: Fri, 07 Oct 2022 23:50:04 GMT

GET
H/1.1 200
OK track.php Show response
form.leadiacloud.com/ Frame B09B 0
610 B 151ms
151ms XHR
text/html 75.2.81.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://form.leadiacloud.com/track.php?domain=leadiacloud.com&caf=1&toggle=answercheck&answer=yes&uid=MTY2NTExNTgxNi45OTM6NzIyYmM1MGJmYmY4MGNkMWRmZmVmMzE3MWYxNTUyM2ZiYmI1NDQyNzI3YmYzYWFjNzBjYzU0YWQyYTc4MzhlZTo2MzNmYTZhOGYyNzAw
Requested by: Host: d38psrni17bvxu.cloudfront.net
URL: http://d38psrni17bvxu.cloudfront.net/scripts/js3caf.js
Protocol: HTTP/1.1
Server: 75.2.81.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a2e6b661ca0e4c4c4.awsglobalaccelerator.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Fri, 07 Oct 2022 04:10:17 GMT
Content-Encoding: gzip
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
X-Custom-Track: answercheck
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Accept-CH-Lifetime: 30
Connection: keep-alive

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 128ms
52ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221003&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed9e48da88333cb6ebce45c0066626a4ed9a5d2ab87680661527ceaa6223f03e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11164
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 143ms
60ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 07 Oct 2022 04:10:18 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1A37 13 KB
5 KB 116ms
37ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://pravoteka.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 47046
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 06 Oct 2022 15:06:12 GMT
expires: Fri, 06 Oct 2023 15:06:12 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E318 783 B
535 B 50ms
49ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9a15276992f0e7b9526ae0ff73b8bb79ee59cec99f30a1b8c74adfbc09035d95

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oR-1KgJF0ZzixWiv-SU_WQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://pravoteka.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-oR-1KgJF0ZzixWiv-SU_WQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 07 Oct 2022 04:10:18 GMT
expires: Fri, 07 Oct 2022 04:10:18 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E318 0
0 148ms
71ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221003&jk=4157380081794447&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 200 -Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js Show response
pagead2.googlesyndication.com/bg/ Frame 1A37 36 KB
16 KB 48ms
37ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 13:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226932
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15918
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Oct 2023 13:08:06 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1A37 0
10 B 37ms
37ms Image
text/plain 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?As9Ucw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 04:10:18 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 75ms
74ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221003&jk=4157380081794447&bg=!9fal9rLNAAYQgTJdMIE7ACkAdvg8WpH3R3S1Vrrh7ybWI7SavGU7yNNLq_se76VVSiJPRRJX7MXH3QIAAABOUgAAAAJoAQeZAtTjs074EMU0pYGFM3lfTX3RsTg4c4EiX0iTjLTLIaDT2b-m4ofzmZ5MoE-fyvOr1cFXR_iuXhKRxlwUY0m_N2-A6ePjq2sTLZy3MWImGfVHX-kWK76NQuy5Z4QX5GSfQuaiCwVAtsC_Zh1ppTEq8yioVagKjMx6K1a9H1txJHLy6qix_NqYUxEylYfhGld_pz3qtNKf26X2aU0vkuf7fkuqwDGJ97kZto8qNxwRDUPhGIBxkgaVBoMwbESpwl9iKdR2h5s9O8U6IMLcAiJGHz2SXl1pHItt9kTD1WITBA9NVaBiQYMIFBMpYFo0qb7gRZB9XZrBPdA90sPMWL2OrervKhaP2vkGA6CPvREFUzmiP497-aZ7tKrgI8u8rWSbo9BFifNJQWcPv1DiJKMPQwrBgX8A2ZobAIzCsjNJYKCdkPi6fNjO8rSoOO881PZx9qSHPOBNBDgbWJaa49IK2Mmi6McpkP5Dppb5DgWRyPGDwapt7vvoJgu47-TBj385djkGHQxih4WPtqezCWVC1mE6NR32_gXQlYILH_duqxqcPIKT52b5Y2PCjp1Eu1yalNcX8CcNZRBDmqQNVFhu6anheVovCNVI_P_y5SVI2IhWWC3TuYFPEAHUJWu_rd6SmVF09CHYAP_cVzP2zFzcO1suCGTEyaNc2WxH8kM0ZouA-erKBwgyN0wv7suBI9FPoTf252xcsVSeQkuDmWGBZ3DednSEORPJJaLXevcXELSu1ymHPeT2lMo0MV0V7CqcH9KrpCFMDXa40sp8YH_deyH8x0FqTZVBbWzoLQ-l-qi6FmAtLS0jSNgClsfAaoSXRfO96LB9O4ZAs_nPc2YDqkcejQ5V2g0xjKfH44hrd4Ikx5EF28UN8eb7UCtvuFnKzzvv2ml78xmzxfJcIyeJ5KsNLRl_e1O6dLv0Un6Kvu-n0zc6R2Pt8RFcxMdYcJ3vkmfgKuP0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://pravoteka.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 204 gen_204
www.google.com/afs/ Frame B09B 0
17 B 119ms
118ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/afs/gen_204?client=dp-teaminternet04_3ph&output=uds_ads_only&zx=uzcdn2i89s2z&aqid=qaY_Y4bFIrCBjuwPkuSi-Ak&psid=1420240428&pbt=bs&adbx=110&adby=128&adbh=485&adbw=530&adbah=156%2C156%2C156&adbn=master-1&eawp=partner-dp-teaminternet04_3ph&errv=478865286&csala=6%7C0%7C210%7C174%7C207&lle=0&llm=1000&ifv=1&usr=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

bfcache-opt-in: unload
date: Fri, 07 Oct 2022 04:10:19 GMT
server: gws
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
www.google.com/afs/ Frame B09B 0
16 B 58ms
57ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/afs/gen_204?client=dp-teaminternet04_3ph&output=uds_ads_only&zx=q2oprtxjcsm7&aqid=qaY_Y4bFIrCBjuwPkuSi-Ak&psid=1420240428&pbt=bv&adbx=110&adby=128&adbh=485&adbw=530&adbah=156%2C156%2C156&adbn=master-1&eawp=partner-dp-teaminternet04_3ph&errv=478865286&csala=6%7C0%7C210%7C174%7C207&lle=0&llm=1000&ifv=1&usr=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://form.leadiacloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

bfcache-opt-in: unload
date: Fri, 07 Oct 2022 04:10:20 GMT
server: gws
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: promo.leadia.ru
URL: http://promo.leadia.ru/runme.php?userid=434&product=lawyer&template=ivs2013&theme=default&language=ru&region=ru&style=default&width=728&height=400&banner=http://pravoteka.ru/Content/Images/button.png

Verdicts & Comments Add Verdict or Comment

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
pravoteka.ru/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: gasihoe0iwfr5tg3ezbacqum
.doubleclick.net/	1970-01-20 06:31:56	Name: test_cookie Value: CheckForPermission
.pravoteka.ru/	1970-01-20 15:53:31	Name: __gads Value: ID=1e650303af3aa9e7-22c5acea3bce00ad:T=1665115817:RT=1665115817:S=ALNI_Maku_QGuc_VWbu-bNZJfQdygxrG7Q
.pravoteka.ru/	1970-01-20 15:17:31	Name: _ym_uid Value: 1665115817455052996
.pravoteka.ru/	1970-01-20 15:17:31	Name: _ym_d Value: 1665115817
.mc.yandex.com/	1970-01-20 06:31:56	Name: sync_cookie_csrf Value: 2289268399fake
.pravoteka.ru/	1970-01-20 06:33:07	Name: _ym_isad Value: 2
.mc.yandex.ru/	1970-01-20 06:31:56	Name: sync_cookie_csrf Value: 1472154028fake
.yandex.com/	1970-01-20 15:17:31	Name: yandexuid Value: 6650125931665115817
.yandex.com/	1970-01-20 15:17:31	Name: yuidss Value: 6650125931665115817
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 1978192821665115817
.yandex.com/	1970-01-20 16:07:55	Name: i Value: mZE9Dv4kGQeeukmuQAx0Uxv2HbKqLCDswwzp6xJK32xthkt1bLxDYsakjs1pMMAEuW+CRywM21/3DELzAFiN5qBhPIE=
.yandex.com/	1970-01-20 15:17:31	Name: ymex Value: 1696651817.yrts.1665115817#1696651817.yrtsi.1665115817
.pravoteka.ru/	1970-01-20 06:31:57	Name: _ym_visorc Value: w
.google.com/	1970-01-20 10:55:27	Name: NID Value: 511=pvbTrLfSj4tkFxYbxKAyIPfH8iHqSsWDuyTB__vXXKLoR6_RaXfSi9cgoktXz4HjRrHP5WW1M47yZKu08GvsmnYHLk_MgIYRG2NFmvEgFr-ke5Rc1D1AcFjUF0HWUbNgPiyntS_nZbxO418rsyOqR0mI1-A_Rz63QGfcTu8N3mk

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://promo.leadia.ru/runme.php?userid=434&product=lawyer&template=ivs2013&theme=default&language=ru&region=ru&style=default&width=728&height=400&banner=http://pravoteka.ru/Content/Images/button.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5845613288065918&output=html&h=600&slotname=4030725388&adk=788576250&adf=4059110530&pi=t.ma~as.4030725388&w=200&fwrn=4&fwrnh=100&lmt=1665115817&rafmt=1&format=200x600&url=http%3A%2F%2Fpravoteka.ru%2F&fwr=0&rpe=1&resp_fmts=4&wgl=1&dt=1665115816864&bpp=6&bdt=640&idt=261&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&correlator=775186128882&frm=20&pv=2&ga_vid=539074730.1665115817&ga_sid=1665115817&ga_hid=885956909&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=315&ady=174&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44761793%2C42531705%2C44774293%2C31062931%2C31068920&oid=2&pvsid=4157380081794447&tmod=883904413&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&fsb=1&xpc=swOiGeGB6J&p=http%3A//pravoteka.ru&dtd=277 Message: Failed to load resource: the server responded with a status of 400 ()
javascript	error	URL: http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref=(Line 133) Message: Unsafe attempt to initiate navigation for frame with URL 'http://pravoteka.ru/' from frame with URL 'http://form.leadiacloud.com/?p=lawyer&t=blue&w=434&product=lawyer&template=blue&style=default&width=750&height=370&ref='. The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor has it received a user gesture. See https://www.chromestatus.com/feature/5851021045661696.
network	error	URL: https://mc.yandex.com/sync_cookie_image_decide?token=9783.7xSLnScH12hz_c8MU0mPWqW7v_aBDmcslcbmsVxe-NRMKezacw_Cr4CY3XA2cF8346vnQGOykVvGv2OXt9sUFg%2C%2C.vVb7SmtSqJclvjCOzrNX5CqluT0%2C Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
afs.googleusercontent.com
api.leadiacloud.com
bs.yandex.ru
c.parkingcrew.net
d38psrni17bvxu.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
form.leadiacloud.com
googleads.g.doubleclick.net
mc.yandex.com
mc.yandex.ru
pagead2.googlesyndication.com
partner.googleadservices.com
pravoteka.ru
promo.leadia.ru
site.yandex.net
tpc.googlesyndication.com
www.google.com
yastatic.net
promo.leadia.ru
142.250.186.130
185.53.178.30
2600:9000:214f:dc00:1d:4618:5c80:21
2a00:1450:4001:802::2002
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2002
2a00:1450:4001:827::2001
2a00:1450:4001:830::2004
2a00:1450:400d:806::2002
2a00:1450:400d:806::2003
2a00:1450:400d:80a::2001
2a00:1450:400d:80e::2002
2a02:6b8:20::215
2a02:6b8::1:119
2a02:6b8::90
75.2.81.221
91.239.27.42
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
04b015935b74fade2c32e2b92b2bdfae9bcea303f0d467541aaa0c7c0d668ea2
125b6b268c7662f295b841038ca5f594ae1cd5adf116cfdf867f529dcf535a38
1b3dfcfe97d043475a764d9c2f2072aa76cb46141e59eea505f16dd5bc8ab28e
1dfbc1d09e0617d703cc890ce164904a5b8c03240af16f4edb43080b631c9c10
25475d82cc976fb2c71b15b3e416c22bf636dd247bbb268d312e7c076ec5b6e4
32bf21d0d9c9436dbb37b5de9ef459aec4ca44a93158ddba003010649446610d
488b112425a02f7abea521a22023ede7eaa0cd6108c7b49a894554f6437b22e7
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5a363bd54eef1a6c982e9132e005551f84d034c8d4ec3c2d93a38e01efb555b5
5b44c0942c44f32b55cb89c8a3d9aa7a35c4be96a671a7c8519fdb273743eda0
5dda937522f40b5015a13566d480f17545f398444e841f8d09d21de9b1f1f2cd
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
642d14cd983fce2cea5db5afb04ff17ee03eeb3feb274a658e9b88cc8cc29d80
67dff0aad873050f12609885f2264417ccdd0d438311000a704c89f0865f7865
70a0083e92cf715231f7734f0ecf0365c77ec3fdfe97921d75b39afd09871711
73c8b1941a2a223b487245530177d98cab9ac48b1ce903a48b29c76c96c1fda4
749532b47faa826b6001b06da2e4085a3118525b9c9164fd0aa10e9944b9967a
7705fee13417229d718f14947e9860d5bb2b25bd15c9f5cd834f2545c7bad0a6
7c8fa7892ae1d6ee689fee61c75979fad9083cd79ad10348d017dcb2b200b424
7dc1f3f26f921b728ecb657f570a23dc51d567795970f5013a07bbc0adb92e62
7e9c22d02fc319b701844b334477a05fd32acee9668feb98672f6c27887f79cf
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
8e2984d02ff87ec808f84282cefe64d61ab5fdb34c6c3405b44abc2754c1323d
920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563
93a1109ada0cd55dedeaf7e9c4251a7f91ac3c3e1ab85e25e37b6cd4e47d504b
9a15276992f0e7b9526ae0ff73b8bb79ee59cec99f30a1b8c74adfbc09035d95
9bf2371fd5fce55d6fed8607d9d9f3bfc548cc5952c9017b5b2b330dfb2fae80
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
aceb498ab3120229304e62efcf6f8ce3e3ecc9079422d9278574f5ec3cc119c6
b13cb5989e08fcb02314209d101e1102f3d299109bdc253b62aa1da21c9e38ba
b621c7b7655254c456bd2ec21f8ec8b16a1379cddc3e8312ac0b44fd32ecd388
b9e8a75d0dfde2af31be915751e50263f1ce59f51fa49a6b7ffb54ade4bb306a
ba5b7354353b0eec1637564dae072fee662a5b9862f6bf7ed5e60a5a76f2ef44
c2326c8e58bd9eee4b635b257ff6cc4eb99c3aa2bf169983fcf2860ba8dd7fcf
c23b807171deb950e3eda0e89e61b9be4e43b6f2ed05fc50ab9efa1827454f04
c43c532923fb3bc58b4f17d98f842122978ec76cc38d428149036e045f5ff0a1
ce178ae6dde5065409f91e5e6c06687ce43a74f5907c4aefe56bcf41e0a21eac
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
dc41be78fcb3b0ca16fc52b3026f8120ada7e9c8b6c1f989d84431ff689276cd
de66288f054df7f389e8281f87fb0a9a05095149f4e96d13c32a1c3b61b1a4a3
dfc86271a8e90d81b3afaf7476b4586502d4e2d26067495ce0ccf4263fc48540
e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d
e28b23d44b57c33a3471ae8825564a0a69c95b581306dc75c18c0dad82609306
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed9e48da88333cb6ebce45c0066626a4ed9a5d2ab87680661527ceaa6223f03e
f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758
fb4566e6664a3326bf0bf9653ac3f7f177d288ab5a19436ce40f2f28afdcada8
fda0e195523bc82e4bc37b4b18ad3056f1f0eadb56cb318df9b12a4f087895d6

pravoteka.ru Open in urlscan Pro 91.239.27.42 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

63 Requests

40 %HTTPS

76 %IPv6

17 Domains

21 Subdomains

17 IPs

4 Countries

793 kBTransfer

1571 kBSize

15 Cookies

2 Outgoing links

Redirected requests

63 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pravoteka.ru Open in urlscan Pro
91.239.27.42 Public Scan

Screenshot
Live screenshot

Full Image

63
Requests

40 %
HTTPS

76 %
IPv6

17
Domains

21
Subdomains

17
IPs

4
Countries

793 kB
Transfer

1571 kB
Size

15
Cookies

63 HTTP transactions
0 data transactions