urlscan.io logo urlscan.io
SecurityTrails logo

click1.e.fireflyengage.com Open in urlscan Pro
74.214.203.11  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://click1.e.fireflyengage.com/ViewMessage.do?m=qssgvnfmd&r=owfltlrlzz&s=bfgqcsvjkgscsqnjdpsspsddbmfvbvgzdqm&q=1638913500&a=view
Effective URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Submission: On December 08 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 7 domains to perform 25 HTTP transactions. The main IP is 74.214.203.11, located in United States and belongs to AMAZON-AES, US. The main domain is click1.e.fireflyengage.com.
This is the only time click1.e.fireflyengage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 74.214.203.11 14618 (AMAZON-AES)
4 2a03:2880:f02... 32934 (FACEBOOK)
1 96.46.128.252 14618 (AMAZON-AES)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
6 16 2606:4700:10:... 13335 (CLOUDFLAR...)
6 6 13.84.54.237 8075 (MICROSOFT...)
6 13.224.189.15 16509 (AMAZON-02)
1 13.224.189.18 16509 (AMAZON-02)
25 7
2    74.214.203.11 (United States)

ASN14618 (AMAZON-AES, US)
click1.e.fireflyengage.com
4    2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    96.46.128.252 (United States)

ASN14618 (AMAZON-AES, US)
PTR: www.efeedbacktrk.com
d0ed58.efeedbacktrk.com
1    2606:4700:20::681a:71c (United States)

ASN13335 (CLOUDFLARENET, US)
email.network.exchange
16    2606:4700:10::6816:274b (United States)

ASN13335 (CLOUDFLARENET, US)
www.westernjournal.com
6    13.84.54.237 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
stripe.rs-1198-a.com
6    13.224.189.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-15.fra2.r.cloudfront.net
images-prod.powerinboxedge.com
1    13.224.189.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-18.fra2.r.cloudfront.net
branding.rs-1198-a.com
Domain Requested by
16 www.westernjournal.com 6 redirects click1.e.fireflyengage.com
6 images-prod.powerinboxedge.com click1.e.fireflyengage.com
6 stripe.rs-1198-a.com 6 redirects
4 connect.facebook.net click1.e.fireflyengage.com
connect.facebook.net
2 click1.e.fireflyengage.com
1 branding.rs-1198-a.com click1.e.fireflyengage.com
1 email.network.exchange click1.e.fireflyengage.com
1 d0ed58.efeedbacktrk.com click1.e.fireflyengage.com
25 8

This site contains links to these domains. Also see Links.

Domain
www.e.fireflyengage.com
Subject Issuer Validity Valid
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-09-16 -
2021-12-15		 3 months crt.sh
*.efeedbacktrk.com
Go Daddy Secure Certificate Authority - G2		 2021-07-06 -
2022-05-28		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-15 -
2022-06-14		 a year crt.sh

This page contains 1 frames:

Primary Page: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Frame ID: 6624D1D1CDD9407331EEFB9BFEDF1E8F
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Maxwell Trial: FBI Agent Reveals the Horrifying Discovery They Made Inside Epstein's Safe Maxwell Trial: FBI Agent Reveals the Horrifying Discovery They Made Inside Epstein's Safe

Page URL History Show full URLs

  1. http://click1.e.fireflyengage.com/ViewMessage.do?m=qssgvnfmd&r=owfltlrlzz&s=bfgqcsvjkgscsqnjdpsspsddbmfvbvgzdq... Page URL
  2. http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF Page URL

Page Statistics

25
Requests

16 %
HTTPS

38 %
IPv6

7
Domains

8
Subdomains

7
IPs

2
Countries

1361 kB
Transfer

1767 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://click1.e.fireflyengage.com/ViewMessage.do?m=qssgvnfmd&r=owfltlrlzz&s=bfgqcsvjkgscsqnjdpsspsddbmfvbvgzdqm&q=1638913500&a=view Page URL
  2. http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://connect.facebook.net/en_US/all.js HTTP 307
  • https://connect.facebook.net/en_US/all.js
Request Chain 3
  • http://connect.facebook.net/en_US/all.js HTTP 307
  • https://connect.facebook.net/en_US/all.js
Request Chain 7
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Jeffrey-Epstein.jpg HTTP 301
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Jeffrey-Epstein.jpg
Request Chain 8
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=0&cs_stripeid=120823 HTTP 303
  • http://images-prod.powerinboxedge.com/v3/images/4528/757493
Request Chain 10
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Iowa-School.jpg HTTP 301
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Iowa-School.jpg
Request Chain 11
  • http://www.westernjournal.com/wp-content/uploads/2021/12/alec-badlwin-for-dec.-7.jpg HTTP 301
  • https://www.westernjournal.com/wp-content/uploads/2021/12/alec-badlwin-for-dec.-7.jpg
Request Chain 12
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Kamala-Harris-1.jpg HTTP 301
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Kamala-Harris-1.jpg
Request Chain 13
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Bharat-Ramamurti.jpg HTTP 301
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Bharat-Ramamurti.jpg
Request Chain 14
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=0&cs_stripeid=120824 HTTP 303
  • http://images-prod.powerinboxedge.com/v3/images/0/757508
Request Chain 15
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Devin-Nunes-Donald-Trump.jpg HTTP 301
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Devin-Nunes-Donald-Trump.jpg
Request Chain 16
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Maxwells.jpg HTTP 307
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Maxwells.jpg
Request Chain 17
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Joel-Osteen-1.jpg HTTP 307
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Joel-Osteen-1.jpg
Request Chain 18
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Ghislaine-Maxwell.jpg HTTP 307
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Ghislaine-Maxwell.jpg
Request Chain 19
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Kareem-v-Lebron.jpg HTTP 307
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Kareem-v-Lebron.jpg
Request Chain 20
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=0&cs_stripeid=120822 HTTP 303
  • http://images-prod.powerinboxedge.com/v3/images/4529/780167
Request Chain 21
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=1&cs_stripeid=120822 HTTP 303
  • http://images-prod.powerinboxedge.com/v3/images/4529/757492
Request Chain 22
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=2&cs_stripeid=120822 HTTP 303
  • http://images-prod.powerinboxedge.com/v3/images/4529/757538
Request Chain 23
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=3&cs_stripeid=120822 HTTP 303
  • http://images-prod.powerinboxedge.com/v3/images/4529/788438

25 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
ViewMessage.do
click1.e.fireflyengage.com/ 		3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://click1.e.fireflyengage.com/ViewMessage.do?m=qssgvnfmd&r=owfltlrlzz&s=bfgqcsvjkgscsqnjdpsspsddbmfvbvgzdqm&q=1638913500&a=view
Protocol
HTTP/1.1
Server
74.214.203.11 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
74895ff6c57acc7cfbdbf0a3a820637ead7ee8029aa4024e99ea10fd2b6219c5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
Apache-Coyote/1.1
Connection
Keep-Alive
Keep-Alive
timeout=60
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Date
Wed, 08 Dec 2021 16:26:26 GMT
all.js
connect.facebook.net/en_US/
Redirect Chain
  • http://connect.facebook.net/en_US/all.js
  • https://connect.facebook.net/en_US/all.js
3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/all.js
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do?m=qssgvnfmd&r=owfltlrlzz&s=bfgqcsvjkgscsqnjdpsspsddbmfvbvgzdqm&q=1638913500&a=view
Protocol
H2
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
95fb1ab628ac48be5c0ab0d28463582bae7f6f1e206cde9585c9fdc07199019e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
zMrtNq1Bzm9QC7FIHHz3Cg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
1685
x-fb-rlafr
0
x-fb-debug
+kparlcPKYZPm+gRrqc3CjXsBRcVbA9dEZNjFbCf/0Ca6S4STWuhrhuy+Xckir1T1tMDz0RPduK98QekUqVmtA==
x-fb-trip-id
917726464
x-fb-content-md5
277422f281fbcfd1b6d6802056fde39d
x-frame-options
DENY
date
Wed, 08 Dec 2021 16:26:26 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"f0a9cb935e06af1b7c1d273ae70d1bc1"
timing-allow-origin
*
priority
u=3,i
expires
Wed, 08 Dec 2021 16:29:46 GMT

Redirect headers

Location
https://connect.facebook.net/en_US/all.js
Non-Authoritative-Reason
HSTS
all.js
connect.facebook.net/en_US/ 		286 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/all.js?hash=1b93b6d2db6a68d37e0fa361e3db40ec
Requested by
Host: connect.facebook.net
URL: http://connect.facebook.net/en_US/all.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
http://click1.e.fireflyengage.com/
Origin
http://click1.e.fireflyengage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
+q+TdnTj1Kfxl2RqTQ1mIg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
82744
x-fb-rlafr
0
x-fb-debug
RQY4DAXU5epzaj3G3Rx6WgQ7JBhduV7Bzn8O2zlfdg/niaiozmhq2gjCzWsiJDZPvvdelQiDbjbZeaBozBd8WQ==
x-fb-content-md5
c3dc38ee757e5a2be386f621fc08ce59
x-frame-options
DENY
date
Wed, 08 Dec 2021 16:26:26 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"b4d6a1790503ddf3980fb3a2f7ea73c6"
timing-allow-origin
*
priority
u=3,i
expires
Thu, 08 Dec 2022 16:00:00 GMT
Primary Request ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
click1.e.fireflyengage.com/ 		54 KB
54 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
74.214.203.11 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d55f559363844af2fe9a78cc645d3170e08c76c590a774a81f1e4a4a6ecf7aab

Request headers

Upgrade-Insecure-Requests
1
Origin
http://click1.e.fireflyengage.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/ViewMessage.do?m=qssgvnfmd&r=owfltlrlzz&s=bfgqcsvjkgscsqnjdpsspsddbmfvbvgzdqm&q=1638913500&a=view

Response headers

Server
Apache-Coyote/1.1
Connection
Keep-Alive
Keep-Alive
timeout=60
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Date
Wed, 08 Dec 2021 16:26:26 GMT
all.js
connect.facebook.net/en_US/
Redirect Chain
  • http://connect.facebook.net/en_US/all.js
  • https://connect.facebook.net/en_US/all.js
3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/all.js
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H3
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
95fb1ab628ac48be5c0ab0d28463582bae7f6f1e206cde9585c9fdc07199019e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
zMrtNq1Bzm9QC7FIHHz3Cg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
1685
x-fb-rlafr
0
x-fb-debug
+kparlcPKYZPm+gRrqc3CjXsBRcVbA9dEZNjFbCf/0Ca6S4STWuhrhuy+Xckir1T1tMDz0RPduK98QekUqVmtA==
x-fb-content-md5
277422f281fbcfd1b6d6802056fde39d
x-frame-options
DENY
date
Wed, 08 Dec 2021 16:26:26 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"f0a9cb935e06af1b7c1d273ae70d1bc1"
timing-allow-origin
*
priority
u=3,i
expires
Wed, 08 Dec 2021 16:29:46 GMT

Redirect headers

Location
https://connect.facebook.net/en_US/all.js
Non-Authoritative-Reason
HSTS
aydptvryzhvntvpcnybmvnvmvbnbsgdrsrhlbpgmtppsslh_srskbkskrrtbkvlpbvmjj.gif
d0ed58.efeedbacktrk.com/ 		68 B
466 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d0ed58.efeedbacktrk.com/aydptvryzhvntvpcnybmvnvmvbnbsgdrsrhlbpgmtppsslh_srskbkskrrtbkvlpbvmjj.gif
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
96.46.128.252 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
www.efeedbacktrk.com
Software
sp /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 08 Dec 2021 16:26:26 GMT
Server
sp
Content-Type
image/png;charset=utf-8
Cache-Control
private, max-age=0, no-cache, no-store, must-revalidate
Connection
Keep-Alive
imagetoolbar
no
Keep-Alive
timeout=60
Content-Length
68
Expires
Thu, 01 Jan 1970 00:00:00 GMT
logo1-liftablePNG.png
email.network.exchange/wp-content/uploads/2020/01/ 		68 KB
69 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://email.network.exchange/wp-content/uploads/2020/01/logo1-liftablePNG.png
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:71c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f675ed96e293ec4a558c29be7a9d9f9bf836cc6699688bdbad5bb376ab559f55

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
cf-cache-status
REVALIDATED
last-modified
Wed, 22 Jan 2020 17:49:03 GMT
server
cloudflare
etag
"5e288b0f-111a1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gfJvg%2FUM%2FD%2BoK3cSA3SwviDqRjExGGWQgDTNL%2BXJJLlU%2FNP5OPfT1bcqZMDpHFZ4OZDgrIUBav3NrHh7N9qx2%2BiGs%2F78g7HNC52tfg7oILNHKrhvdl%2Bb4qRghIrya6XnQ6KSw2dqBZiNzRZtqvHs2X3Z9Ek%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=86400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
6ba75afeba31dfef-FRA
content-length
70049
all.js
connect.facebook.net/en_US/ 		286 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/all.js?hash=1b93b6d2db6a68d37e0fa361e3db40ec
Requested by
Host: connect.facebook.net
URL: http://connect.facebook.net/en_US/all.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a3acf46da9c9d842c246290d95518dea423a1e824a3acfd9be690383f25eeb9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
http://click1.e.fireflyengage.com/
Origin
http://click1.e.fireflyengage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
+q+TdnTj1Kfxl2RqTQ1mIg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
82744
x-fb-rlafr
0
x-fb-debug
RQY4DAXU5epzaj3G3Rx6WgQ7JBhduV7Bzn8O2zlfdg/niaiozmhq2gjCzWsiJDZPvvdelQiDbjbZeaBozBd8WQ==
x-fb-content-md5
c3dc38ee757e5a2be386f621fc08ce59
x-frame-options
DENY
date
Wed, 08 Dec 2021 16:26:26 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"b4d6a1790503ddf3980fb3a2f7ea73c6"
timing-allow-origin
*
priority
u=3,i
expires
Thu, 08 Dec 2022 16:00:00 GMT
Jeffrey-Epstein.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Jeffrey-Epstein.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Jeffrey-Epstein.jpg
46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Jeffrey-Epstein.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec7a4d1a99f828fbc7f439c34e6d773c00e71ccc120fb06b83c82b0c738dd9d5
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
144496
cf-polished
origSize=55261, status=webp_bigger
content-length
47372
last-modified
Tue, 07 Dec 2021 00:00:40 GMT
server
cloudflare
etag
"61aea428-d7dd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b0059d66927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Jeffrey-Epstein.jpg
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6ba75afeecb22c32-FRA
Expires
Wed, 08 Dec 2021 17:26:27 GMT
757493
images-prod.powerinboxedge.com/v3/images/4528/
Redirect Chain
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=0&cs_stripeid=120823
  • http://images-prod.powerinboxedge.com/v3/images/4528/757493
30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://images-prod.powerinboxedge.com/v3/images/4528/757493
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
13.224.189.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-15.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3d5d0534093fcfdb76f6228b139bf0afe5948abeb8c712b37ed35b58c4021f3f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Via
1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront)
Last-Modified
Mon, 19 Jul 2021 22:00:12 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA2-C1
ETag
"772acaf75f240b19bfbedaa07223f593"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
30646
X-Amz-Cf-Id
FcgKbwgMuLLJ9EFD7r1DMjUaY1jNHsILF0U1wzSIeIH-pc3Hx0aedw==

Redirect headers

Pragma
no-cache
Date
Wed, 08 Dec 2021 16:26:27 GMT
Location
http://images-prod.powerinboxedge.com/v3/images/4528/757493
Access-Control-Expose-Headers
Request-Context
Cache-Control
no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Request-Context
appId=cid-v1:b1915e72-e266-47bd-9574-958ec8610746
Content-Length
0
Expires
-1
transparent.gif
branding.rs-1198-a.com/recommend/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://branding.rs-1198-a.com/recommend/transparent.gif
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
13.224.189.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ead3884004084eb183a040673cf1d63b64e1c83519df2803646110e21a11795b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 07 Dec 2021 14:42:11 GMT
Via
1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
Last-Modified
Wed, 12 Aug 2015 16:56:10 GMT
Server
AmazonS3
Age
92657
ETag
"4128f95bd8487bb29a31913da47afcb6"
X-Cache
Hit from cloudfront
Content-Type
image/gif
Connection
keep-alive
X-Amz-Cf-Pop
FRA2-C1
Accept-Ranges
bytes
Content-Length
18632
X-Amz-Cf-Id
PT076a_apaC6WCyHrGeYq9zy_djnxQPsaOokJSxk4i2fb6eIfHrnkg==
Iowa-School.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Iowa-School.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Iowa-School.jpg
68 KB
69 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Iowa-School.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1cd06bd3e093ed25a351eb87cdd6a4f8d75224a883a1954622a86b60891d92f
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
99869
cf-polished
origSize=76756, status=webp_bigger
content-length
70012
last-modified
Tue, 07 Dec 2021 01:25:01 GMT
server
cloudflare
etag
"61aeb7ed-12bd4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b0059cd6927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Iowa-School.jpg
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6ba75afeead95b5c-FRA
Expires
Wed, 08 Dec 2021 17:26:27 GMT
alec-badlwin-for-dec.-7.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/alec-badlwin-for-dec.-7.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/alec-badlwin-for-dec.-7.jpg
88 KB
88 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/alec-badlwin-for-dec.-7.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6aba03eb9d741e35476d37ea610a5386d7227f6cd47ae3b05d5b18ed6e4c70f
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept
cf-cache-status
HIT
age
96352
cf-polished
origFmt=jpeg, origSize=94693
content-disposition
inline; filename="alec-badlwin-for-dec.webp"
content-length
89876
last-modified
Tue, 07 Dec 2021 13:24:26 GMT
server
cloudflare
etag
"61af608a-171e5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b0059c66927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://www.westernjournal.com/wp-content/uploads/2021/12/alec-badlwin-for-dec.-7.jpg
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6ba75afee8804a85-FRA
Expires
Wed, 08 Dec 2021 17:26:27 GMT
Kamala-Harris-1.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Kamala-Harris-1.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Kamala-Harris-1.jpg
76 KB
76 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Kamala-Harris-1.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fecb45dbd98ccf8060ce077e5f95f33157228b07423d38d642385f6a09e03acf
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
146284
cf-polished
origSize=84922, status=webp_bigger
content-length
77685
last-modified
Mon, 06 Dec 2021 23:43:28 GMT
server
cloudflare
etag
"61aea020-14bba"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b0059d06927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Kamala-Harris-1.jpg
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6ba75afeeeac2c3a-FRA
Expires
Wed, 08 Dec 2021 17:26:27 GMT
Bharat-Ramamurti.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Bharat-Ramamurti.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Bharat-Ramamurti.jpg
82 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Bharat-Ramamurti.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
edbc1fc9d63510589037189ad2dbb4beed871a3ff2e6563ada832af68d49ad1b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
83256
cf-polished
origSize=91496, status=webp_bigger
content-length
83914
last-modified
Tue, 07 Dec 2021 16:47:20 GMT
server
cloudflare
etag
"61af9018-16568"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b0059cb6927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Bharat-Ramamurti.jpg
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6ba75afeeab92c42-FRA
Expires
Wed, 08 Dec 2021 17:26:27 GMT
757508
images-prod.powerinboxedge.com/v3/images/0/
Redirect Chain
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=0&cs_stripeid=120824
  • http://images-prod.powerinboxedge.com/v3/images/0/757508
70 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://images-prod.powerinboxedge.com/v3/images/0/757508
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
13.224.189.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-15.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
12242e6e9109332f14d6891fd983c220afeea870fff2a0db2ca1e5ec0568a2ee

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Wed, 08 Dec 2021 15:35:54 GMT
Via
1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Mon, 19 Jul 2021 21:59:51 GMT
Server
AmazonS3
Age
3104
ETag
"8a43210abce4e965c75409fdce1ed0e6"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=3600
X-Amz-Cf-Pop
FRA2-C1
Accept-Ranges
bytes
Content-Length
71704
X-Amz-Cf-Id
5TzutXTTv9iCVpeds_34lj2UJn0KtAPs5CQPHeT29RTWgGVZBQlSmA==

Redirect headers

Pragma
no-cache
Date
Wed, 08 Dec 2021 16:26:26 GMT
Location
http://images-prod.powerinboxedge.com/v3/images/0/757508
Access-Control-Expose-Headers
Request-Context
Cache-Control
no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Request-Context
appId=cid-v1:b1915e72-e266-47bd-9574-958ec8610746
Content-Length
0
Expires
-1
Devin-Nunes-Donald-Trump.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Devin-Nunes-Donald-Trump.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Devin-Nunes-Donald-Trump.jpg
78 KB
79 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Devin-Nunes-Donald-Trump.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72782b58b5ab203a50200345b64865dc4b95a95f955abe89013d410cc46ce92e
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
101454
cf-polished
origSize=88312, status=webp_bigger
content-length
80237
last-modified
Tue, 07 Dec 2021 01:43:11 GMT
server
cloudflare
etag
"61aebc2f-158f8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b0059d46927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Devin-Nunes-Donald-Trump.jpg
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6ba75afeee135b6e-FRA
Expires
Wed, 08 Dec 2021 17:26:27 GMT
Maxwells.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Maxwells.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Maxwells.jpg
83 KB
84 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Maxwells.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71319ba6b40ad545ed55a2ca1e07a96f2873a1d90c9c49cc0a574b68fbb1065b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
157366
cf-polished
origSize=95993, status=webp_bigger
content-length
85396
last-modified
Mon, 06 Dec 2021 18:58:26 GMT
server
cloudflare
etag
"61ae5d52-176f9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b009a8e6927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Maxwells.jpg
Non-Authoritative-Reason
HSTS
Joel-Osteen-1.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Joel-Osteen-1.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Joel-Osteen-1.jpg
73 KB
73 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Joel-Osteen-1.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11981406463ce1901b192c08d7e883e0f5f34cc2589983848b1a6bf539ab39c4
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
166266
cf-polished
origSize=82942, status=webp_bigger
content-length
74269
last-modified
Mon, 06 Dec 2021 17:53:18 GMT
server
cloudflare
etag
"61ae4e0e-143fe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b009a976927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Joel-Osteen-1.jpg
Non-Authoritative-Reason
HSTS
Ghislaine-Maxwell.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Ghislaine-Maxwell.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Ghislaine-Maxwell.jpg
59 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Ghislaine-Maxwell.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0d0fc7f0483872cfe6bc3cbdac4ccc336b9c7f08be65b36b2da45e6b0cab849
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
161138
cf-polished
origSize=69768, status=webp_bigger
content-length
60525
last-modified
Mon, 06 Dec 2021 19:19:01 GMT
server
cloudflare
etag
"61ae6225-11088"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b00aabd6927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Ghislaine-Maxwell.jpg
Non-Authoritative-Reason
HSTS
Kareem-v-Lebron.jpg
www.westernjournal.com/wp-content/uploads/2021/12/
Redirect Chain
  • http://www.westernjournal.com/wp-content/uploads/2021/12/Kareem-v-Lebron.jpg
  • https://www.westernjournal.com/wp-content/uploads/2021/12/Kareem-v-Lebron.jpg
109 KB
109 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.westernjournal.com/wp-content/uploads/2021/12/Kareem-v-Lebron.jpg
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
H2
Server
2606:4700:10::6816:274b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
30c669d444ee6784ce3d38f419f3f46857dc41d2ee266358bb43b7f78f2a90f3
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 16:26:27 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
146631
cf-polished
origSize=119944, status=webp_bigger
content-length
111652
last-modified
Mon, 06 Dec 2021 23:05:04 GMT
server
cloudflare
etag
"61ae9720-1d488"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
6ba75b00aac06927-FRA
cf-bgj
imgq:100,h2pri

Redirect headers

Location
https://www.westernjournal.com/wp-content/uploads/2021/12/Kareem-v-Lebron.jpg
Non-Authoritative-Reason
HSTS
780167
images-prod.powerinboxedge.com/v3/images/4529/
Redirect Chain
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=0&cs_stripeid=120822
  • http://images-prod.powerinboxedge.com/v3/images/4529/780167
49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://images-prod.powerinboxedge.com/v3/images/4529/780167
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
13.224.189.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-15.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
97e1ff263bfe1c15e50642ccb8212fb7c80995bf96dcfdb8c93c0ca151a68033

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Via
1.1 f7bf326347bdd7f275a38a22b5b83724.cloudfront.net (CloudFront)
Last-Modified
Wed, 01 Sep 2021 19:04:15 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA2-C1
ETag
"b83b7fa6b73d236f3a0e8847258eff69"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
49879
X-Amz-Cf-Id
U-prpBhiTAFhHDZRSmcqQ13SspT1MdhWOi2iNi3PT-EFTc9wPYMmnQ==

Redirect headers

Pragma
no-cache
Date
Wed, 08 Dec 2021 16:26:26 GMT
Location
http://images-prod.powerinboxedge.com/v3/images/4529/780167
Access-Control-Expose-Headers
Request-Context
Cache-Control
no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Request-Context
appId=cid-v1:b1915e72-e266-47bd-9574-958ec8610746
Content-Length
0
Expires
-1
757492
images-prod.powerinboxedge.com/v3/images/4529/
Redirect Chain
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=1&cs_stripeid=120822
  • http://images-prod.powerinboxedge.com/v3/images/4529/757492
59 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://images-prod.powerinboxedge.com/v3/images/4529/757492
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
13.224.189.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-15.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ad01610e51a74ad5e77f667891ba6cd86c0e903d124ab376c34e659188b15290

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Via
1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
Last-Modified
Mon, 19 Jul 2021 22:00:37 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA2-C1
ETag
"5c8e6fd2ef4ab0567999cd57a64af98b"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
60605
X-Amz-Cf-Id
pAAiYf7oHvLiLdu21AhPHrXvx6iTv2wuodZX0sEmbulHjXL-gIAhbA==

Redirect headers

Pragma
no-cache
Date
Wed, 08 Dec 2021 16:26:26 GMT
Location
http://images-prod.powerinboxedge.com/v3/images/4529/757492
Access-Control-Expose-Headers
Request-Context
Cache-Control
no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Request-Context
appId=cid-v1:b1915e72-e266-47bd-9574-958ec8610746
Content-Length
0
Expires
-1
757538
images-prod.powerinboxedge.com/v3/images/4529/
Redirect Chain
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=2&cs_stripeid=120822
  • http://images-prod.powerinboxedge.com/v3/images/4529/757538
50 KB
50 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://images-prod.powerinboxedge.com/v3/images/4529/757538
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
13.224.189.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-15.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
13a72117b0be9b5730170a568dae369daeed23f18091f6f73b76f2895e91e712

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Via
1.1 cdcb559c2f25d8ad2ccf0419bee33b03.cloudfront.net (CloudFront)
Last-Modified
Mon, 19 Jul 2021 22:00:24 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA2-C1
ETag
"11a6b6ff111a9c1fa071f86f94f8f1dc"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
51068
X-Amz-Cf-Id
emKcQFbVkVJo25po_heEvSEqwDTyoZRw2mtPzPlSiIwA65wCOUFJaQ==

Redirect headers

Pragma
no-cache
Date
Wed, 08 Dec 2021 16:26:26 GMT
Location
http://images-prod.powerinboxedge.com/v3/images/4529/757538
Access-Control-Expose-Headers
Request-Context
Cache-Control
no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Request-Context
appId=cid-v1:b1915e72-e266-47bd-9574-958ec8610746
Content-Length
0
Expires
-1
788438
images-prod.powerinboxedge.com/v3/images/4529/
Redirect Chain
  • http://stripe.rs-1198-a.com/stripe/image?cs_email=jon.bone@paccar.com&cs_sendid=540619&cs_esp=postup&cs_offset=3&cs_stripeid=120822
  • http://images-prod.powerinboxedge.com/v3/images/4529/788438
25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://images-prod.powerinboxedge.com/v3/images/4529/788438
Requested by
Host: click1.e.fireflyengage.com
URL: http://click1.e.fireflyengage.com/ViewMessage.do;jsessionid=531A2980E69A571FF00032768A3F37FF
Protocol
HTTP/1.1
Server
13.224.189.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-15.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bbc8e291fa9d1467ecc71d3c9407fe49818c69d805be2da024b2893e0a457e10

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://click1.e.fireflyengage.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Wed, 08 Dec 2021 16:26:27 GMT
Via
1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront)
Last-Modified
Fri, 17 Sep 2021 19:56:05 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA2-C1
ETag
"1e3e30d165a04fff3fc6b7a8375cbc35"
X-Cache
Hit from cloudfront
Content-Type
image/png
Cache-Control
public, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
25599
X-Amz-Cf-Id
tMbYIGqSOEM9W5oy4zx8pbQ1jsjLVh-uVsJAtMlAsTlNgS9TrdFFCA==

Redirect headers

Pragma
no-cache
Date
Wed, 08 Dec 2021 16:26:26 GMT
Location
http://images-prod.powerinboxedge.com/v3/images/4529/788438
Access-Control-Expose-Headers
Request-Context
Cache-Control
no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Request-Context
appId=cid-v1:b1915e72-e266-47bd-9574-958ec8610746
Content-Length
0
Expires
-1

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| FB

1 Cookies

Domain/Path Name / Value
click1.e.fireflyengage.com/ Name: JSESSIONID
Value: 1A0B18C15FF4CCEB3FF8B071C00014FF

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

branding.rs-1198-a.com
click1.e.fireflyengage.com
connect.facebook.net
d0ed58.efeedbacktrk.com
email.network.exchange
images-prod.powerinboxedge.com
stripe.rs-1198-a.com
www.westernjournal.com
13.224.189.15
13.224.189.18
13.84.54.237
2606:4700:10::6816:274b
2606:4700:20::681a:71c
2a03:2880:f02d:12:face:b00c:0:3
74.214.203.11
96.46.128.252
11981406463ce1901b192c08d7e883e0f5f34cc2589983848b1a6bf539ab39c4
12242e6e9109332f14d6891fd983c220afeea870fff2a0db2ca1e5ec0568a2ee
13a72117b0be9b5730170a568dae369daeed23f18091f6f73b76f2895e91e712
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
30c669d444ee6784ce3d38f419f3f46857dc41d2ee266358bb43b7f78f2a90f3
3d5d0534093fcfdb76f6228b139bf0afe5948abeb8c712b37ed35b58c4021f3f
71319ba6b40ad545ed55a2ca1e07a96f2873a1d90c9c49cc0a574b68fbb1065b
72782b58b5ab203a50200345b64865dc4b95a95f955abe89013d410cc46ce92e
74895ff6c57acc7cfbdbf0a3a820637ead7ee8029aa4024e99ea10fd2b6219c5
95fb1ab628ac48be5c0ab0d28463582bae7f6f1e206cde9585c9fdc07199019e
97e1ff263bfe1c15e50642ccb8212fb7c80995bf96dcfdb8c93c0ca151a68033
a0d0fc7f0483872cfe6bc3cbdac4ccc336b9c7f08be65b36b2da45e6b0cab849
a3acf46da9c9d842c246290d95518dea423a1e824a3acfd9be690383f25eeb9a
ad01610e51a74ad5e77f667891ba6cd86c0e903d124ab376c34e659188b15290
bbc8e291fa9d1467ecc71d3c9407fe49818c69d805be2da024b2893e0a457e10
d1cd06bd3e093ed25a351eb87cdd6a4f8d75224a883a1954622a86b60891d92f
d55f559363844af2fe9a78cc645d3170e08c76c590a774a81f1e4a4a6ecf7aab
d6aba03eb9d741e35476d37ea610a5386d7227f6cd47ae3b05d5b18ed6e4c70f
ead3884004084eb183a040673cf1d63b64e1c83519df2803646110e21a11795b
ec7a4d1a99f828fbc7f439c34e6d773c00e71ccc120fb06b83c82b0c738dd9d5
edbc1fc9d63510589037189ad2dbb4beed871a3ff2e6563ada832af68d49ad1b
f675ed96e293ec4a558c29be7a9d9f9bf836cc6699688bdbad5bb376ab559f55
fecb45dbd98ccf8060ce077e5f95f33157228b07423d38d642385f6a09e03acf