www.bloomberg.com Open in urlscan Pro
104.108.39.139 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://link.bankingdive.com/click/21534118.10864/aHR0cHM6Ly93d3cuYmxvb21iZXJnLmNvbS9uZXdzL2FydGljbGVzLzIwMjAtMDktMTYvY2l0aWd...
Effective URL:
https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1s...
Submission: On September 25 via api (September 25th 2020, 6:10:47 pm UTC) from US

Summary HTTP 217 Redirects Links 47 Behaviour Indicators

Summary

This website contacted 48 IPs in 7 countries across 40 domains to perform 217 HTTP transactions. The main IP is 104.108.39.139, located in Netherlands and belongs to AKAMAI-AS, US. The main domain is www.bloomberg.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on May 12th 2020. Valid for: a year.

This is the only time www.bloomberg.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::681a:447	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9 32	104.108.39.139 104.108.39.139	16625 (AKAMAI-AS) (AKAMAI-AS)
80	151.101.113.73 151.101.113.73	54113 (FASTLY) (FASTLY)
1	99.86.243.79 99.86.243.79	16509 (AMAZON-02) (AMAZON-02)
1	143.204.94.111 143.204.94.111	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700::68... 2606:4700::6811:4e6b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
1	34.238.7.196 34.238.7.196	14618 (AMAZON-AES) (AMAZON-AES)
10	99.86.243.21 99.86.243.21	16509 (AMAZON-02) (AMAZON-02)
4	69.187.26.120 69.187.26.120	10361 (BLOOMBERG...) (BLOOMBERG-NET)
2	172.217.23.162 172.217.23.162	15169 (GOOGLE) (GOOGLE)
1	172.217.21.226 172.217.21.226	15169 (GOOGLE) (GOOGLE)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
2 3	185.167.164.51 185.167.164.51	198622 (ADFORM) (ADFORM)
1	37.157.2.244 37.157.2.244	198622 (ADFORM) (ADFORM)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:10c... 2a02:26f0:10c:582::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	34.240.2.137 34.240.2.137	16509 (AMAZON-02) (AMAZON-02)
21	151.101.113.44 151.101.113.44	54113 (FASTLY) (FASTLY)
5	151.101.129.73 151.101.129.73	54113 (FASTLY) (FASTLY)
1	95.100.197.53 95.100.197.53	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	3.20.41.86 3.20.41.86	16509 (AMAZON-02) (AMAZON-02)
2	95.100.197.246 95.100.197.246	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:218... 2600:9000:2182:5600:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1 1	185.94.180.127 185.94.180.127	35220 (SPOTX-AMS) (SPOTX-AMS)
1	95.100.196.125 95.100.196.125	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 5	2a00:1450:400... 2a00:1450:4001:824::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	2001:1af8:470... 2001:1af8:4700:b214::100	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2600:9000:206... 2600:9000:206e:8200:13:7ad6:7840:21	16509 (AMAZON-02) (AMAZON-02)
1	3.9.96.171 3.9.96.171	16509 (AMAZON-02) (AMAZON-02)
1	34.251.197.102 34.251.197.102	16509 (AMAZON-02) (AMAZON-02)
1	3.215.9.17 3.215.9.17	14618 (AMAZON-AES) (AMAZON-AES)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
2	2606:4700:20:... 2606:4700:20::ac43:45f7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.166.113.188 52.166.113.188	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2001:1af8:470... 2001:1af8:4700:b081::104	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
3	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
2	151.101.1.181 151.101.1.181	54113 (FASTLY) (FASTLY)
1 5	2.19.34.195 2.19.34.195	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	2.20.142.234 2.20.142.234	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
217	48

1 2606:4700:20::681a:447 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

link.bankingdive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 104.108.39.139 (Netherlands) 9 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-39-139.deploy.static.akamaitechnologies.com

www.bloomberg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

80 151.101.113.73 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

assets.bwbx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.243.79 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-79.vie50.r.cloudfront.net

cdn.privacy-mgmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.94.111 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-111.fra50.r.cloudfront.net

ccpa.sp-prod.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:4e6b (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.238.7.196 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-238-7-196.compute-1.amazonaws.com

location.bloomberg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 99.86.243.21 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-21.vie50.r.cloudfront.net

sourcepointcmp.bloomberg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.187.26.120 (United States)

ASN10361 (BLOOMBERG-NET, US)

login.bloomberg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s22-in-f162.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.21.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s13-in-f226.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.167.164.51 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

a2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.2.244 (Denmark)

ASN198622 (ADFORM, DK)

s2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:582::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.240.2.137 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-2-137.eu-west-1.compute.amazonaws.com

ads.avocet.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.avct.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 151.101.113.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
15.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vidstat.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.129.73 (United States)

ASN54113 (FASTLY, US)

cdn.gotraffic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.100.197.53 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-197-53.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.20.41.86 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-20-41-86.us-east-2.compute.amazonaws.com

personalization.bloomberg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.100.197.246 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-197-246.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:5600:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.94.180.127 (Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, NL)

js.spotx.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.100.196.125 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-196-125.deploy.static.akamaitechnologies.com

aka.spotxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:824::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:1af8:4700:b214::100 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

a-fds.youborafds01.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:8200:13:7ad6:7840:21 (United States)

ASN16509 (AMAZON-02, US)

d2p3zdq8vjvnxd.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.9.96.171 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.251.197.102 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-197-102.eu-west-1.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.215.9.17 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:45f7 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.166.113.188 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

collector.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:1af8:4700:b081::104 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

infinity-c6.youboranqs01.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

trc-events.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.1.181 (United States)

ASN54113 (FASTLY, US)

widget.perfectmarket.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.19.34.195 (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-19-34-195.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.20.142.234 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-20-142-234.deploy.static.akamaitechnologies.com

liveproduseast.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
80	bwbx.io assets.bwbx.io	1 MB
48	bloomberg.com 9 redirects www.bloomberg.com location.bloomberg.com sourcepointcmp.bloomberg.com login.bloomberg.com personalization.bloomberg.com	299 KB
24	taboola.com cdn.taboola.com trc.taboola.com trc-events.taboola.com 15.taboola.com images.taboola.com vidstat.taboola.com	590 KB
7	doubleclick.net 2 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net	117 KB
5	akamaized.net liveproduseast.akamaized.net	352 KB
5	scorecardresearch.com 1 redirects sb.scorecardresearch.com	5 KB
5	google.de www.google.de	924 B
5	google.com 2 redirects www.google.com	2 KB
5	gotraffic.net cdn.gotraffic.net	453 KB
4	moatads.com z.moatads.com mb.moatads.com geo.moatads.com px.moatads.com	77 KB
4	adform.net 2 redirects a2.adform.net s2.adform.net	30 KB
3	youboranqs01.com infinity-c6.youboranqs01.com	654 B
3	brandmetrics.com cdn.brandmetrics.com collector.brandmetrics.com	13 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	bing.com bat.bing.com	8 KB
3	googleadservices.com www.googleadservices.com	15 KB
3	cloudflare.com cdnjs.cloudflare.com	7 KB
2	perfectmarket.com widget.perfectmarket.com	32 KB
2	googleapis.com imasdk.googleapis.com	209 KB
2	avct.cloud 1 redirects ads.avct.cloud	733 B
2	licdn.com snap.licdn.com	3 KB
2	yimg.com s.yimg.com	6 KB
1	google-analytics.com www.google-analytics.com	18 KB
1	twitter.com analytics.twitter.com	652 B
1	rlcdn.com api.rlcdn.com	223 B
1	rkdms.com mid.rkdms.com	159 B
1	cloudfront.net d2p3zdq8vjvnxd.cloudfront.net	367 B
1	youborafds01.com a-fds.youborafds01.com	454 B
1	t.co t.co	448 B
1	spotxcdn.com aka.spotxcdn.com	177 KB
1	spotx.tv 1 redirects js.spotx.tv	594 B
1	adsafeprotected.com static.adsafeprotected.com	7 KB
1	indexww.com js-sec.indexww.com	33 KB
1	avocet.io 1 redirects ads.avocet.io	140 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	65 KB
1	sp-prod.net ccpa.sp-prod.net	18 KB
1	privacy-mgmt.com cdn.privacy-mgmt.com	41 KB
1	bankingdive.com 1 redirects link.bankingdive.com	758 B
0	px-cloud.net Failed collector-px8fcgygk4.px-cloud.net Failed
217	40

	Domain	Requested by
80	assets.bwbx.io	www.bloomberg.com assets.bwbx.io cdn.gotraffic.net
32	www.bloomberg.com	9 redirects www.bloomberg.com assets.bwbx.io cdn.gotraffic.net
12	images.taboola.com	www.bloomberg.com
10	sourcepointcmp.bloomberg.com	cdn.privacy-mgmt.com ccpa.sp-prod.net sourcepointcmp.bloomberg.com
5	liveproduseast.akamaized.net	cdn.gotraffic.net
5	sb.scorecardresearch.com	1 redirects cdn.taboola.com widget.perfectmarket.com
5	www.google.de	www.bloomberg.com
5	www.google.com	2 redirects www.bloomberg.com
5	googleads.g.doubleclick.net	2 redirects www.googleadservices.com
5	cdn.gotraffic.net	assets.bwbx.io cdn.gotraffic.net
4	trc.taboola.com	cdn.taboola.com
4	login.bloomberg.com	assets.bwbx.io
3	trc-events.taboola.com	cdn.taboola.com
3	infinity-c6.youboranqs01.com	cdn.gotraffic.net
3	cdn.taboola.com	www.bloomberg.com assets.bwbx.io cdn.taboola.com
3	bat.bing.com	www.bloomberg.com
3	a2.adform.net	2 redirects
3	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
3	cdnjs.cloudflare.com	www.bloomberg.com
2	widget.perfectmarket.com	cdn.taboola.com widget.perfectmarket.com
2	cdn.brandmetrics.com	www.bloomberg.com cdn.brandmetrics.com
2	px.ads.linkedin.com	1 redirects www.bloomberg.com
2	imasdk.googleapis.com	cdn.gotraffic.net
2	ads.avct.cloud	1 redirects www.bloomberg.com
2	snap.licdn.com	www.bloomberg.com snap.licdn.com
2	s.yimg.com	www.bloomberg.com s.yimg.com
2	securepubads.g.doubleclick.net	assets.bwbx.io securepubads.g.doubleclick.net
1	vidstat.taboola.com	cdn.taboola.com
1	15.taboola.com	cdn.taboola.com
1	www.google-analytics.com	widget.perfectmarket.com
1	collector.brandmetrics.com	cdn.brandmetrics.com
1	analytics.twitter.com	static.ads-twitter.com
1	api.rlcdn.com	js-sec.indexww.com
1	mid.rkdms.com	js-sec.indexww.com
1	px.moatads.com	www.bloomberg.com
1	geo.moatads.com	z.moatads.com
1	mb.moatads.com	z.moatads.com
1	d2p3zdq8vjvnxd.cloudfront.net	www.bloomberg.com
1	a-fds.youborafds01.com	cdn.gotraffic.net
1	www.linkedin.com	1 redirects
1	t.co	www.bloomberg.com
1	aka.spotxcdn.com	www.bloomberg.com
1	js.spotx.tv	1 redirects
1	static.adsafeprotected.com	cdn.gotraffic.net
1	z.moatads.com	cdn.gotraffic.net
1	personalization.bloomberg.com	assets.bwbx.io
1	js-sec.indexww.com	assets.bwbx.io
1	ads.avocet.io	1 redirects
1	s2.adform.net	www.bloomberg.com
1	static.ads-twitter.com	www.bloomberg.com
1	location.bloomberg.com	assets.bwbx.io
1	www.googletagmanager.com	www.bloomberg.com
1	ccpa.sp-prod.net	www.bloomberg.com
1	cdn.privacy-mgmt.com	www.bloomberg.com
1	link.bankingdive.com	1 redirects
0	collector-px8fcgygk4.px-cloud.net Failed	www.bloomberg.com
217	56

This site contains links to these domains. Also see Links.

Domain
bba.bloomberg.net
service.bloomberg.com
sponsored.bloomberg.com
www.facebook.com
twitter.com
www.instagram.com
www.linkedin.com
link.mail.bloombergbusiness.com
subscribe.businessweek.com
www.youtube.com
www.citigroup.com
bloom.bg
nytm.org
bloombergmedia.com

Subject Issuer	Validity	Valid
www.bloomberg.com DigiCert SHA2 Extended Validation Server CA	`2020-05-12` - `2021-05-17`	a year	crt.sh
*.privacy-mgmt.com Let's Encrypt Authority X3	`2020-08-01` - `2020-10-30`	3 months	crt.sh
*.sp-prod.net Let's Encrypt Authority X3	`2020-09-14` - `2020-12-13`	3 months	crt.sh
cdnjs.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-12` - `2022-08-17`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
location.bloomberg.com DigiCert SHA2 Secure Server CA	`2019-12-17` - `2022-02-25`	2 years	crt.sh
sourcepointcmp.bloomberg.com DigiCert SHA2 Secure Server CA	`2020-09-02` - `2021-10-02`	a year	crt.sh
login.bloomberg.com DigiCert SHA2 Extended Validation Server CA	`2020-01-10` - `2022-02-17`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-09-10` - `2020-10-28`	2 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.avct.cloud Let's Encrypt Authority X3	`2020-08-19` - `2020-11-17`	3 months	crt.sh
*.taboola.com DigiCert SHA2 Secure Server CA	`2020-08-10` - `2021-12-31`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
personalization.bloomberg.com DigiCert SHA2 Extended Validation Server CA	`2019-11-05` - `2022-01-21`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
static.adsafeprotected.com Amazon	`2019-11-01` - `2020-12-01`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
cdn.spotxcdn.com GeoTrust RSA CA 2018	`2020-05-21` - `2021-06-20`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.youborafds01.com Go Daddy Secure Certificate Authority - G2	`2019-10-11` - `2020-12-10`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
*.rkdms.com Entrust Certification Authority - L1K	`2017-10-09` - `2020-10-30`	3 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-16` - `2021-07-16`	a year	crt.sh
*.brandmetrics.com Go Daddy Secure Certificate Authority - G2	`2020-04-13` - `2021-06-11`	a year	crt.sh
*.youboranqs01.com Go Daddy Secure Certificate Authority - G2	`2019-10-11` - `2020-12-10`	a year	crt.sh
p.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-09-03` - `2021-02-22`	a year	crt.sh
sb.scorecardresearch.com DigiCert Secure Site ECC CA-1	`2020-07-17` - `2021-06-02`	a year	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Frame ID: D774BC5D2ADEB237305778D94B76881F
Requests: 213 HTTP requests in this frame

Frame: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
Frame ID: BBF0B9555BA1BC8C6280F8D91FC29444
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://link.bankingdive.com/click/21534118.10864/aHR0cHM6Ly93d3cuYmxvb21iZXJnLmNvbS9uZXdzL2FydGljbGVzLzI... HTTP 302
https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-pa... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

217
Requests

99 %
HTTPS

38 %
IPv6

40
Domains

56
Subdomains

48
IPs

7
Countries

4008 kB
Transfer

10760 kB
Size

36
Cookies

47 Outgoing links

These are links going to different origins than the main page.

URL: https://bba.bloomberg.net/?utm_source=bloomberg-menu&utm_medium=bcom
Title: Bloomberg Anywhere Remote LoginBloomberg Anywhere Login

Search URL Search Domain Scan URL

URL: https://service.bloomberg.com/service?utm_source=bloomberg-menu&utm_medium=bcom
Title: Bloomberg Customer SupportCustomer Support

Search URL Search Domain Scan URL

URL: https://sponsored.bloomberg.com/news/sponsors/features/hyundai/artandtechnology/?adv=16713&prx_t=ZdMFAgU5DAYikPA
Title: Art + Technology

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bloombergbusiness
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/business
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bloombergbusiness/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/bloomberg/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/markets
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bloombergmarkets/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/technology
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/BloombergTechnology/
Title: Facebook

Search URL Search Domain Scan URL

URL: http://link.mail.bloombergbusiness.com/join/4wm/politics-brief-signup&hash=b9b2681361bede0e1069ca238efb1ec2
Title: Balance of Power

Search URL Search Domain Scan URL

URL: https://twitter.com/bpolitics
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/BloombergPolitics/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/luxury
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bloombergpursuits/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bloombergpursuits/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://twitter.com/bopinion
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bloombergopinion
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bloombergopinion/
Title: Instagram

Search URL Search Domain Scan URL

URL: http://link.mail.bloombergbusiness.com/join/4wm/opinion-signup&hash=b9b2681361bede0e1069ca238efb1ec2
Title: Bloomberg Opinion Today

Search URL Search Domain Scan URL

URL: http://link.mail.bloombergbusiness.com/join/4wm/moneystuff-signup&hash=b9b2681361bede0e1069ca238efb1ec2
Title: Money Stuff

Search URL Search Domain Scan URL

URL: http://link.mail.bloombergbusiness.com/join/4wm/ritholtz-reads-signup&hash=54223001ca3ffcf40f2629c25acea67a
Title: Ritholtz's Reads

Search URL Search Domain Scan URL

URL: http://link.mail.bloombergbusiness.com/join/4wm/early-returns-signup&hash=54223001ca3ffcf40f2629c25acea67a
Title: Early Returns

Search URL Search Domain Scan URL

URL: http://link.mail.bloombergbusiness.com/join/4wm/sparklines-signup&hash=b9b2681361bede0e1069ca238efb1ec2
Title: Sparklines

Search URL Search Domain Scan URL

URL: https://subscribe.businessweek.com/servlet/OrdersGateway?cds_mag_code=BWK&cds_page_id=223855&in_source=bbw-menu
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://twitter.com/BW
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bloombergbusinessweek/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/businessweek/?hl=en
Title: Instagram

Search URL Search Domain Scan URL

URL: https://twitter.com/climate
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bloomberggreen
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/bloomberggreen/
Title: Instagram

Search URL Search Domain Scan URL

URL: http://link.mail.bloombergbusiness.com/join/4wm/citylab-daily
Title: Daily newsletter

Search URL Search Domain Scan URL

URL: https://twitter.com/CityLab
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/thisiscitylab
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/citylab
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/citylab-com
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/Bloomberg
Title: YouTube

Search URL Search Domain Scan URL

URL: https://twitter.com/BloombergTV
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/BloombergTelevision/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave
Title: Share

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=An%20employee%20at%20Citigroup%20has%20been%20placed%20on%20leave%20pending%20an%20investigation%20after%20he%20was%20identified%20as%20the%20operator%20of%20the%20most%20prominent%20QAnon%20websites&via=business&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave
Title: Tweet

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&title=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave&summary=Jason%20Gelinas%2C%20an%20employee%20at%20Citigroup%20Inc.%2C%20has%20been%20placed%20on%20paid%20leave%20pending%20an%20internal%20investigation%20after%20he%20was%20identified%20as%20the%20operator%20of%20the%20most%20prominent%20website%20dedicated%20to%20the%20QAnon%20conspiracy%20theory%2C%20according%20to%20three%20people%20familiar%20with%20the%20matter.&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave
Title: Post

Search URL Search Domain Scan URL

URL: https://www.citigroup.com/citi/investor/data/codeconduct_en.pdf
Title: code of conduct

Search URL Search Domain Scan URL

URL: https://bloom.bg/dg-ws-core-bcom-a1
Title: LEARN MORE

Search URL Search Domain Scan URL

URL: http://nytm.org/made-in-nyc
Title: Made in NYC

Search URL Search Domain Scan URL

URL: http://bloombergmedia.com/
Title: Advertise

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://link.bankingdive.com/click/21534118.10864/aHR0cHM6Ly93d3cuYmxvb21iZXJnLmNvbS9uZXdzL2FydGljbGVzLzIwMjAtMDktMTYvY2l0aWdyb3VwLWVtcGxveWVlLXdoby1vcGVyYXRlZC1xYW5vbi13ZWJzaXRlLW9uLXBhaWQtbGVhdmU_c3JlZj1IaHVlMXNjTw/5ed4fd89b868453979bda11dB82057d37 HTTP 302
https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 99

https://www.bloomberg.com/navi/api/v1/breaking-news/regional HTTP 302
https://www.bloomberg.com/navi/api/v1/breaking-news/europe

Request Chain 102

https://a2.adform.net/serving/scripts/trackpoint/async/ HTTP 301
https://s2.adform.net/banners/scripts/st/trackpoint-async.js

Request Chain 106

https://ads.avocet.io/s?add=5adf6ad75f7614a66abb437a&ty=j HTTP 301
https://ads.avct.cloud/s?r=1&add=5adf6ad75f7614a66abb437a&ty=j HTTP 302
https://ads.avct.cloud/s?bounce=true&r=1&add=5adf6ad75f7614a66abb437a&ty=j

Request Chain 138

https://js.spotx.tv/directsdk/v1/236177.js HTTP 307
https://aka.spotxcdn.com/integration/directsdk/v1/directsdk/beta.js

Request Chain 142

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=403593&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&time=1601057430255 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D403593%26url%3Dhttps%253A%252F%252Fwww.bloomberg.com%252Fnews%252Farticles%252F2020-09-16%252Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%253Fsref%253DHhue1scO%2526utm_source%253DSailthru%2526utm_medium%253Demail%2526utm_campaign%253DIssue%253A%2525202020-09-17%252520Banking%252520Dive%252520%25255Bissue%253A29713%25255D%2526utm_term%253DBanking%252520Dive%26time%3D1601057430255%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=403593&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&time=1601057430255&liSync=true

Request Chain 148

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=ljJuX8nxCuzZ7_UPjcSL2Aw&sscte=1&crd=&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb7a6QZWovzPrrtU0BwvHhXRABFjDOBR0sg HTTP 302
https://www.google.com/pagead/1p-conversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX8nxCuzZ7_UPjcSL2Aw&cid=CAQSKQCNIrLMuatj8N2t4z3ql8Tow8WZIzD8xXeaHHQvU-wB8RiWoPbhMwyG&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb6L4gvtg6mOBx6dr4LDIwICBT-Eyawvjiw&random=3951719484&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX8nxCuzZ7_UPjcSL2Aw&cid=CAQSKQCNIrLMuatj8N2t4z3ql8Tow8WZIzD8xXeaHHQvU-wB8RiWoPbhMwyG&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb6L4gvtg6mOBx6dr4LDIwICBT-Eyawvjiw&random=3951719484&resp=GooglemKTybQhCsO&ipr=y

Request Chain 149

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=ljJuX6b_CvK17_UP2oaEiAM&sscte=1&crd=&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb-0J0BFVMZ9hEWiF_iyQvecS-uBq65EGww HTTP 302
https://www.google.com/pagead/1p-conversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX6b_CvK17_UP2oaEiAM&cid=CAQSKQCNIrLMCDZWzDbi7f37EaVdSeiG8jK5NkV2XPIfMMNlBvZoOpNKFccr&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb4QlbhwnZbNnkM9eq7SLaYYvxJSvTK-HTQ&random=1197797392&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX6b_CvK17_UP2oaEiAM&cid=CAQSKQCNIrLMCDZWzDbi7f37EaVdSeiG8jK5NkV2XPIfMMNlBvZoOpNKFccr&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb4QlbhwnZbNnkM9eq7SLaYYvxJSvTK-HTQ&random=1197797392&resp=GooglemKTybQhCsO&ipr=y

Request Chain 162

https://www.bloomberg.com/markets/modules/datastrip.json?version=2&theme=blens&tickers=C:US HTTP 307
https://www.bloomberg.com/tosv.html?url=L21hcmtldHMvbW9kdWxlcy9kYXRhc3RyaXAuanNvbj90aGVtZT1ibGVucyZ2ZXJzaW9uPTImdGlja2Vycz1DJTNBVVM=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 169

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini HTTP 307
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 171

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini HTTP 307
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 173

https://www.bloomberg.com/media-manifest/streams/us.m3u8?group=backup&profile=mini HTTP 307
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 177

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini HTTP 307
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 178

https://www.bloomberg.com/media-manifest/streams/us.m3u8?group=backup&profile=mini HTTP 307
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 181

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini HTTP 307
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 182

https://www.bloomberg.com/media-manifest/streams/us.m3u8?group=backup&profile=mini HTTP 307
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

Request Chain 189

https://sb.scorecardresearch.com/p?c1=2&c2=6961552&ns_site=bloomberg-stream-test&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=c&ns_st_id=1601057431006_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=0&ns_st_pb=1&ns_st_mp=BPlayer&ns_st_mv=v0.11.194&ns_st_pn=1&ns_st_tp=1&ns_st_li=1&ns_st_ci=LIVE_US_MINI&ns_ts=1601057440045&ns_st_ca=0&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pl=LIVE_US_MINI&ns_st_ep=LIVE_US_MINI&ns_st_ty=Live%20US%20Mini&ns_st_ct=vc13&ns_st_dt=N%2FA&ns_st_pu=Bloomberg&c4=BBG&c5=02&c6=*null&c7=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&c8=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&c9=&bss_user_action=1&bss_iframe=0&playerId=US_MINI&bss_auto_play=1&bss_cont_play=0&bss_vid_type=Live%20US%20Mini&bss_pl_num=0 HTTP 302
https://sb.scorecardresearch.com/p2?c1=2&c2=6961552&ns_site=bloomberg-stream-test&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=c&ns_st_id=1601057431006_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=0&ns_st_pb=1&ns_st_mp=BPlayer&ns_st_mv=v0.11.194&ns_st_pn=1&ns_st_tp=1&ns_st_li=1&ns_st_ci=LIVE_US_MINI&ns_ts=1601057440045&ns_st_ca=0&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pl=LIVE_US_MINI&ns_st_ep=LIVE_US_MINI&ns_st_ty=Live%20US%20Mini&ns_st_ct=vc13&ns_st_dt=N%2FA&ns_st_pu=Bloomberg&c4=BBG&c5=02&c6=*null&c7=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&c8=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&c9=&bss_user_action=1&bss_iframe=0&playerId=US_MINI&bss_auto_play=1&bss_cont_play=0&bss_vid_type=Live%20US%20Mini&bss_pl_num=0&cs_ak_ss=1

Request Chain 201

https://a2.adform.net/Serving/TrackPoint/?pm=1118168&ADFdivider=%7C&ord=930850173237&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&loc=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on&us_privacy=1YNN HTTP 302
https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1118168&ADFdivider=%7C&ord=930850173237&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&loc=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on&us_privacy=1YNN

217 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set citigroup-employee-who-operated-qanon-website-on-paid-leave Show response
www.bloomberg.com/news/articles/2020-09-16/
Redirect Chain

https://link.bankingdive.com/click/21534118.10864/aHR0cHM6Ly93d3cuYmxvb21iZXJnLmNvbS9uZXdzL2FydGljbGVzLzIwMjAtMDktMTYvY2l0aWdyb3VwLWVtcGxveWVlLXdoby1vcGVyYXRlZC1xYW5vbi13ZWJzaXRlLW9uLXBhaWQtbGVhdmU...
https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20...

286 KB
46 KB

799ms
703ms

Document
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9f82c676337a2b66619893a1d4cb24bb71e1566dd820dce476982484b7d7b682

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://.bloomberg.com https://.bloomberg.com upgrade-insecure-requests

Request headers

Host: www.bloomberg.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Encoding: gzip
Content-Security-Policy: frame-ancestors 'self' http://*.bloomberg.com https://*.bloomberg.com upgrade-insecure-requests
Content-Type: text/html; charset=utf-8
ETag: W/"4765b-xRLZCXc6MqCowUX+IlEDZ7OUwW0"
Server: nginx
Vary: Accept-Encoding
Content-Length: 46063
Cache-Control: public, max-age=109
Expires: Fri, 25 Sep 2020 18:12:18 GMT
Date: Fri, 25 Sep 2020 18:10:29 GMT
Connection: keep-alive
Set-Cookie: _pxhd=7cd6b8b349d3d01c8becb34cf2fb8c25e1cb540a24f91e32a9b39d33c4ba676f:64676a61-ff5a-11ea-b641-b9b31d38a047; Expires=Sat, 25-Sep-21 18:10:28 GMT; Path=/ _pxhd=3e2795f5122adf941b4e7e069802974931e81d2d6620d62cbfbe2b1dab96013a:645716b1-ff5a-11ea-b5c5-ab830e320593; path=/

Redirect headers

status: 302
date: Fri, 25 Sep 2020 18:10:28 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=de07a4453e187814583b1982214529c611601057427; expires=Sun, 25-Oct-20 18:10:27 GMT; path=/; domain=.bankingdive.com; HttpOnly; SameSite=Lax; Secure sailthru_hid=d651a7d7736081156d5f305f30a498825ed4fd89b868453979bda11d1e9ee1f4482a82017a27203632ea5b15; expires=Sat, 25-Sep-2021 23:59:14 GMT; Max-Age=31556926; path=/; domain=bankingdive.com sailthru_bid=21534118.10864; expires=Fri, 25-Sep-2020 21:10:28 GMT; Max-Age=10800; path=/; domain=bankingdive.com
location: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
cf-ray: 5d86b3bc4b621f45-FRA
cf-cache-status: DYNAMIC
cf-request-id: 05680ea9ac00001f4515118200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

GET
H2 200 AvenirNextPForBBG-Demi-b9b4abf0ea.woff2
assets.bwbx.io/s3/fontservice/fonts/ 36 KB
36 KB 99ms
34ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/AvenirNextPForBBG-Demi-b9b4abf0ea.woff2

Requested by

Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

d24b492cc15692d79a344d3cee1952e99baf5a35e727eee802014e43311af9dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 6n5MJek4fy3n2VRAyktPkEVV9R3WQjVB
via: 1.1 varnish
etag: "b9b4abf0ea70a701fa5cfba89d02763f"
age: 8676500
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 36708
x-amz-id-2: QxIGQZZeyUKrdU0VLFRZo0eminJpZnOusTYUIT80AERIhjbvhoTMiRm8Gu7INJZE+VTpoG1oF54=
x-served-by: cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:23 GMT
server: AmazonS3
x-timer: S1601057429.144072,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 3F1AE92F3098A0B0
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 26862

GET
H2 200 BW%20Haas%20Text%20Mono%20A-55%20Roman-9fa796a3f4.woff2
assets.bwbx.io/s3/fontservice/fonts/ 24 KB
24 KB 99ms
34ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/BW%20Haas%20Text%20Mono%20A-55%20Roman-9fa796a3f4.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

749e2675e3613c6b36394312229caf79169c3a0b2e12461c833d6e5dd007982d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: h3aB0rfHBcKh9RfZTFr6FI5XAXy_9GOR
via: 1.1 varnish, 1.1 varnish
etag: "9fa796a3f4a5524556ceb9dda8d96af8"
age: 8676499
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 24320
x-amz-id-2: ZFIHkKrpm9OPtsW0cX7dUHaU6eJhYX14d4nTiEH0AWXNsZGwls0ixmPYL4wAN+Hk5z1Wgka+tJk=
x-served-by: cache-sea4438-SEA, cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:23 GMT
server: AmazonS3
x-timer: S1601057429.143997,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 3DD03EAFCDCE80B1
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 10153, 18

GET
H2 200 BWHaasGrotesk-55Roman-Web-5cf5733cd9.woff2
assets.bwbx.io/s3/fontservice/fonts/ 31 KB
31 KB 98ms
33ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-55Roman-Web-5cf5733cd9.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4f00b7c9097ac1c7661f126d5fcc494efec22745d53a1d5294027db2a7c382ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: HN6qae6CWRn_Jy1WFQEXJfgCAeXg4JdN
via: 1.1 varnish
etag: "5cf5733cd9241d8e129282b8e5b8c193"
age: 8676380
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 31420
x-amz-id-2: E8CeSzcYa3wL+GEaX5Odk2qsDUEiumEzqVec2Nl8z6CbgxKc42bI/BbQofY3Eq8t9leaQUkFlMo=
x-served-by: cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:23 GMT
server: AmazonS3
x-timer: S1601057429.143988,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 2RAN4R6N4Z9P0XAG
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 30808

GET
H2 200 BWHaasGrotesk-56Italic-Web-669253244d.woff2
assets.bwbx.io/s3/fontservice/fonts/ 33 KB
33 KB 98ms
33ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-56Italic-Web-669253244d.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

36ce7e2a8573961b9d4eb7377f293a1487af673156a2d47c3f212de3f306e380

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 1bMf88UUrfFZIsLvxODIqIYKSHVoaryK
via: 1.1 varnish, 1.1 varnish
etag: "669253244d5430629948724163d319a2"
age: 5563644
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 33488
x-amz-id-2: XQG7uE4oOZjNUnzErZ7mvyTKaVJr4GCaBJiDmFDvTZyutiq0IUdZfTVNu1luqcgsKz/6eKHWtwo=
x-served-by: cache-sea4452-SEA, cache-hhn4066-HHN
last-modified: Thu, 16 Jul 2020 17:47:35 GMT
server: AmazonS3
x-timer: S1601057429.143929,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: BED9764921CF8C4A
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 6940, 3454

GET
H2 200 BWHaasGrotesk-75Bold-Web-de8c77cce2.woff2
assets.bwbx.io/s3/fontservice/fonts/ 32 KB
32 KB 97ms
33ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-75Bold-Web-de8c77cce2.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4d6f4b49a31c43a76d5fb6e08431ec59336962b0454dd61228df343005f46120

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 8.IEAfso5rNpZlNL1xwhxF.NFUqd3aix
via: 1.1 varnish, 1.1 varnish
etag: "de8c77cce206155c16c93d0ca69528ca"
age: 7899552
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 32756
x-amz-id-2: EaNwn2NB90OkWdnmPAev2Qx0rEKXffQgqSyVFCgiYUh1YnQy4WTkq+6i0t+NFgpd0Ki4gPiNJdk=
x-served-by: cache-sea4463-SEA, cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:24 GMT
server: AmazonS3
x-timer: S1601057429.143904,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 729CE2C7331E3DC8
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 15427, 30757

GET
H2 200 BWHaasGrotesk-95Black-Web-3629d1569b.woff2
assets.bwbx.io/s3/fontservice/fonts/ 28 KB
28 KB 84ms
32ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-95Black-Web-3629d1569b.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4b77569a515f522bbfe719742ae791aefbf7b48540461b0660fdc78183d2de28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 09Io79mwkgBePOLQJuESb3sXv9waz3Bs
via: 1.1 varnish
etag: "3629d1569b48a61d0be1987c51a2faa3"
age: 8676499
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 28244
x-amz-id-2: jmVzO7qFzhZc5vVOAutumfCJoS/HrNEMeMgSov0Zb0Q96uJEICCbqY6euK+QqoWueDeIlHC8QMw=
x-served-by: cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:24 GMT
server: AmazonS3
x-timer: S1601057429.143867,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 26354357F43DD91A
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 26533

GET
H2 200 PublicoHeadline-Bold-Web-e816328678.woff2
assets.bwbx.io/s3/fontservice/fonts/ 43 KB
43 KB 84ms
32ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/PublicoHeadline-Bold-Web-e816328678.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

49ded0b7452c5a72c085bf827a174776516e16aba8c6405034667e9da15a3030

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 0_J.Wm06CUEj6jSml5naZOB_52R562Hc
via: 1.1 varnish
etag: "e8163286784edcd46498814a6e047df5"
age: 8676377
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 44084
x-amz-id-2: OuPOh4EdTpiI4/NL7WEFGvIJcUjTfoTGsSsXHiMy5lI1sFI14WAeoZ8MajyOGmStRKW9JaVbaSU=
x-served-by: cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:25 GMT
server: AmazonS3
x-timer: S1601057429.143879,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: E768B85B78ED9D8D
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 4969

GET
H2 200 PublicoText-Bold-Web-3c5266a48e.woff2
assets.bwbx.io/s3/fontservice/fonts/ 57 KB
57 KB 125ms
73ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/PublicoText-Bold-Web-3c5266a48e.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

694caab4d44df324c9903efa250d6d4f465bcc92294831e3fd7d77d3a9728fff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: vhKPpN1NjNaul76NCpryJO5lHsfivPoZ
via: 1.1 varnish, 1.1 varnish
etag: "3c5266a48ecda5201bfa002296fb4c59"
age: 8676498
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 57916
x-amz-id-2: Wv4qviCm4JGg+i50G5XMLo62Mv6jAoXT506A0uiCGxkyKJpQ8zYGhVI2WFsFSiKGevz0lC2akOU=
x-served-by: cache-sea4465-SEA, cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:25 GMT
server: AmazonS3
x-timer: S1601057429.158730,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 0540A5320F98AF60
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 17898, 8202

GET
H2 200 PublicoText-Italic-Web-b04a2274cf.woff2
assets.bwbx.io/s3/fontservice/fonts/ 54 KB
54 KB 124ms
72ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/PublicoText-Italic-Web-b04a2274cf.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1957282ebd27f3a96f88ce696c39994823162808b499210e5aaaf3695cf1c524

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: jH_Vib6gHszOujH5tktUbWfmuSMrCE1Q
via: 1.1 varnish
etag: "b04a2274cff54b8a2e075e62c3198ba2"
age: 8676467
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 55208
x-amz-id-2: xVpzLLEKsqlIi7NCDQ6iY6rs4i6AY+N6qEr3zThjd5MArtWm0XRbmNOTKVA0kyR9nq4AShOmASc=
x-served-by: cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:25 GMT
server: AmazonS3
x-timer: S1601057429.158691,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 9A703365FC6D4530
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 3528

GET
H2 200 PublicoText-Roman-Web-bfa063ee27.woff2
assets.bwbx.io/s3/fontservice/fonts/ 51 KB
52 KB 83ms
32ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/PublicoText-Roman-Web-bfa063ee27.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

ac65679285de2392fc8b76767e1db03387d7c5968544f70975f74eaecf1be10d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: qE1bwybs_heYIHz1rNJO4SwSa5JfqPwR
via: 1.1 varnish, 1.1 varnish
etag: "bfa063ee2757aeb3365e8e0680513ae6"
age: 8676498
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 52512
x-amz-id-2: KqFt0uc3HL8DwqKw0oKGWpRwWnEe6UOJUg0xmt7kudA6gLLkw/7+9/YKPSFSJGqXALjNTNeOgE4=
x-served-by: cache-sea4456-SEA, cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:25 GMT
server: AmazonS3
x-timer: S1601057429.143830,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: A2E7477CE5085631
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 27827, 5050

GET
H2 200 TiemposTextWeb-Regular-0c712f870b.woff2
assets.bwbx.io/s3/fontservice/fonts/ 55 KB
55 KB 123ms
72ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/TiemposTextWeb-Regular-0c712f870b.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5af27ea6d562e2008bcc88d1aed3d4dd7dc6f5b27485e5627d56757e5c450f1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: FQiuhv6P5Pgp4.6IVdkEZYqz4mseyiaE
via: 1.1 varnish
etag: "0c712f870ba708e0ff385f90a5f1e158"
age: 8676498
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 55979
x-amz-id-2: OIqlcY8XLYrTNMjaMeJ22Ih/PGo6EBsJeEq+SFGGS//84Lyr8IpfSweKRIJRC6cG5Ya70FTMH2g=
x-served-by: cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:26 GMT
server: AmazonS3
x-timer: S1601057429.158640,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: EA58880FB1F7F21A
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 4361

GET
H2 200 TiemposTextWeb-RegularItalic-91232ccd19.woff2
assets.bwbx.io/s3/fontservice/fonts/ 56 KB
57 KB 123ms
73ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/TiemposTextWeb-RegularItalic-91232ccd19.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

68059a851de1dd7aa643366554af5b5f08f0c8f1a6d69eda1042a05bdd75aa1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: xE7pLEm52c963gG.gMVlaEtLPN7ZlGK0
via: 1.1 varnish, 1.1 varnish
etag: "91232ccd19aecaeae53b8f36f236ed52"
age: 8676369
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 57689
x-amz-id-2: 329gmxVffbJR6XC2c2N1gh1U+lF6L/VcMMAD8JUOBMVaA0TEvxfYb0HWUd2B3LIzy/l3c512hC8=
x-served-by: cache-sea4462-SEA, cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:26 GMT
server: AmazonS3
x-timer: S1601057429.158678,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 31CB0A1571BDF203
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 2842, 487

GET
H2 200 font-face.css
assets.bwbx.io/font-service/css/Bloomberg%20Logotypes-Medium,BWHaasGrotesk-75Bold-Web,BWHaasGrotesk-95Black-Web,BWHaasGrotesk-55Roman-Web/ 1 KB
875 B 119ms
56ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/font-service/css/Bloomberg%20Logotypes-Medium,BWHaasGrotesk-75Bold-Web,BWHaasGrotesk-95Black-Web,BWHaasGrotesk-55Roman-Web/font-face.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Express

Resource Hash

ada11a51560cb25bd08d05a183e2ad443f58ff838a904ad93d438bb5c76f7cd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 733
x-powered-by: Express
x-cache: HIT, HIT
status: 200
content-length: 349
x-served-by: cache-lga21962-LGA, cache-hhn4056-HHN
x-timer: S1601057429.156577,VS0,VE0
etag: W/"5be-jfbzwEMTJwr9ytUKamp2qL+3Uu4"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css; charset=utf-8
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=900
accept-ranges: bytes
link: <https://assets.bwbx.io/s3/fontservice/fonts/Bloomberg Logotypes-Medium-0e53877b78.woff2>; rel=preload; as=font; crossorigin; nopush, <https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-75Bold-Web-de8c77cce2.woff2>; rel=preload; as=font; crossorigin; nopush, <https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-95Black-Web-3629d1569b.woff2>; rel=preload; as=font; crossorigin; nopush, <https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-55Roman-Web-5cf5733cd9.woff2>; rel=preload; as=font; crossorigin; nopush
x-cache-hits: 1, 34

GET
H2 200 bar-14112fb5bc.css
assets.bwbx.io/s3/navi/css/components/en/bar/ 11 KB
3 KB 119ms
57ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/navi/css/components/en/bar/bar-14112fb5bc.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c1f92feb266044d4c46f3279c3ef0395942abc8d21f883173e5132397e2ea5a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: AhP7Cws6pQ2WhruQPv_Fixf5KtSxi1C6
content-encoding: gzip
etag: "14112fb5bcfda365076f22cfa718f479"
age: 5111857
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 2389
x-amz-id-2: cPMoYwH7OFwGyNhX34NdLY4iZr2+wMIRMi81fei7WApEMhHYz/T8IKVYXhVKdAIHUcz1V4nGIpw=
x-served-by: cache-sea4479-SEA, cache-hhn4056-HHN
last-modified: Tue, 28 Jul 2020 14:05:24 GMT
server: AmazonS3
x-timer: S1601057429.156369,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 780FFAADA25504FB
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: text/css
x-cache-hits: 1, 2077

GET
H2 200 reg-ui-client-a21eecb921.css
assets.bwbx.io/s3/navi/vendor/css/ 2 KB
1 KB 120ms
57ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/navi/vendor/css/reg-ui-client-a21eecb921.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

403572c0908420a46398abc4ce265baa05cc5216e86c8a4e44cc4702a56779a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 43a0r623tJb_1yHIicxDbmCNF__rCv5j
content-encoding: gzip
etag: "a21eecb921f6635e707564969ad30454"
age: 6305230
x-cache: HIT, HIT
status: 200
x-amz-replication-status: PENDING
vary: Accept-Encoding
content-length: 649
x-amz-id-2: it6Cb/kIy+gb8eWYPpoDHbwOQE8FTkNVCzDSaHtIJO9qp5WxTE4p8kGHzQ81+pq/kIPcOpV5IQo=
x-served-by: cache-sea4465-SEA, cache-hhn4056-HHN
last-modified: Tue, 14 Jul 2020 18:42:20 GMT
server: AmazonS3
x-timer: S1601057429.156458,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 6J7G5M9H4VER6TEM
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: text/css
x-cache-hits: 1, 2545

GET
H2 200 styled-font-face.css
assets.bwbx.io/font-service/css/AvenirNextPForBBG:400,600/ 727 B
747 B 93ms
31ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/font-service/css/AvenirNextPForBBG:400,600/styled-font-face.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Express

Resource Hash

68b77b6ce4483e660a432e50e175ff2676d3a9d1381e2f699f89b6eb28d8802c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 121
x-powered-by: Express
x-cache: HIT, HIT
status: 200
content-length: 253
x-served-by: cache-lga21950-LGA, cache-hhn4056-HHN
x-timer: S1601057429.156388,VS0,VE0
etag: W/"2d7-najAUFiaRfMsj4QdlB31veVwBBY"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css; charset=utf-8
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=900
accept-ranges: bytes
link: <https://assets.bwbx.io/s3/fontservice/fonts/AvenirNextPForBBG-Regular-eb3bb1b816.woff2>; rel=preload; as=font; crossorigin; nopush, <https://assets.bwbx.io/s3/fontservice/fonts/AvenirNextPForBBG-Demi-b9b4abf0ea.woff2>; rel=preload; as=font; crossorigin; nopush
x-cache-hits: 1, 10

GET
H/1.1 200
OK that.css
www.bloomberg.com/tophat/assets/v2.5.1/ 21 KB
4 KB 38ms
31ms Stylesheet
text/css 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/tophat/assets/v2.5.1/that.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

openresty / BB Cache

Resource Hash

374fa3ad95eab7210f5d8d93138ea4e294ef2c2e8baeb3e46580aa6f8652819f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
ETag: "5473-5a871ca0a5980-gzip"
Last-Modified: Fri, 19 Jun 2020 15:45:58 GMT
Server: openresty
X-Powered-By: BB Cache
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=24685432
Date: Fri, 25 Sep 2020 18:10:29 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3390
Expires: Thu, 08 Jul 2021 11:14:21 GMT

GET
H2 200 font-face.css
assets.bwbx.io/font-service/css/Bloomberg/ 593 B
503 B 119ms
57ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/font-service/css/Bloomberg/font-face.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Express

Resource Hash

d02655b928b3bcc69b4fe931b5df031e29dc0899f3f0c652da890267f6b10355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 152
x-powered-by: Express
x-cache: HIT, HIT
status: 200
content-length: 235
x-served-by: cache-lga21944-LGA, cache-hhn4056-HHN
x-timer: S1601057429.156474,VS0,VE0
etag: W/"251-nq6Mncn+BhehEWVAicY2SyoOwfI"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css; charset=utf-8
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=900
accept-ranges: bytes
link: <https://assets.bwbx.io/s3/fontservice/fonts/Bloomberg-048eeffe56.woff2>; rel=preload; as=font; crossorigin; nopush
x-cache-hits: 1, 13

GET
H2 200 bb-global-footer-76035a1f00.css
assets.bwbx.io/s3/bbnav/public/stylesheets/ 2 KB
1 KB 119ms
57ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/bbnav/public/stylesheets/bb-global-footer-76035a1f00.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5d9e5a4f49925ca2d0a2801abe9c715483c801a5364e9cf155346c4fcd273707

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 7MY3cyJteuFxldqT4yvQeMAmrK.k_EWH
content-encoding: gzip
etag: "76035a1f007b5b6e90b229be4ce01330"
age: 3134358
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 718
x-amz-id-2: Ef53Sw2hDnTxjzqxNiv2xx+GRE7wP9luF9uHY11T3dIjfK0pNZjnwuGQmFGUyn2y4D1wDUmPp9M=
x-served-by: cache-sea4470-SEA, cache-hhn4056-HHN
last-modified: Wed, 19 Aug 2020 20:51:37 GMT
server: AmazonS3
x-timer: S1601057429.156435,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 8F1E697987295AB7
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: text/css
x-cache-hits: 24577, 2573

GET
H2 200 wrapperMessagingWithoutDetection.js Show response
cdn.privacy-mgmt.com/ 141 KB
41 KB 71ms
29ms Script
application/javascript 99.86.243.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.privacy-mgmt.com/wrapperMessagingWithoutDetection.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-79.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 27ab02fc09609aecbf3650c6dddbd427ccd7b3ee2cedad7c8e450cbcdc1ac938

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 17:17:18 GMT
content-encoding: gzip
last-modified: Wed, 16 Sep 2020 19:47:01 GMT
server: AmazonS3
age: 3192
etag: "7b409047676dccb3556b8c834322c582"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: UTjzQGJdPCWLDpHFnOTV2kkc4DzQ0IaY77MhVdemEif66iIEYLa6xw==
via: 1.1 8041ecf6e768a41bc9c64e0c75dc923d.cloudfront.net (CloudFront)

GET
H2 200 ccpa.js Show response
ccpa.sp-prod.net/ 54 KB
18 KB 116ms
46ms Script
application/javascript 143.204.94.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ccpa.sp-prod.net/ccpa.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.94.111 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-94-111.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b3be241d203ddc10730645993381cf8341eef547c398ee56c0eb4827436f916b

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 17:50:47 GMT
content-encoding: gzip
last-modified: Fri, 18 Sep 2020 17:41:39 GMT
server: AmazonS3
age: 1183
etag: "1f5c8db9be34979ef4216a34e49931ee"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: mBzsMzyqj28DkUnbFpdfUWNXKdlnbp1m2SJaCfHysqU0FNUEU5nlEQ==
via: 1.1 055d899361491602a9ef1eb0cdc5e337.cloudfront.net (CloudFront)

GET
H2 200 bridge-web.bundle.js Show response
assets.bwbx.io/s3/bridgeweb/v1/ 94 KB
27 KB 114ms
59ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/bridgeweb/v1/bridge-web.bundle.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

82af90c3f768db464e87133135b9bb71b98142b3659a300724bf3ce2358b14f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2ltli.RbUEqjH18jyi.yRNHCy3TPDWQg
content-encoding: gzip
etag: "e768b99aaaed9dc4dcfcd55561a0d573"
age: 19
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 27035
x-amz-id-2: 5/lf9Msxlp4bcF6lLYkAutXWLPm5282P8BVJONS3Rccpkg4Ll/+FgMQlWU9EaQEZMUnMP2CSpmM=
x-served-by: cache-sea4480-SEA, cache-hhn4056-HHN
last-modified: Thu, 17 Sep 2020 20:56:15 GMT
server: AmazonS3
x-timer: S1601057429.156362,VS0,VE1
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: B9DF32B633E72210
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=30
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 800, 1

GET
H2 200 ms.byzantium-core.bundle.js Show response
assets.bwbx.io/s3/byzantium/v5/ 114 KB
33 KB 86ms
32ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/byzantium/v5/ms.byzantium-core.bundle.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

22dd7088cef636c1099138bc561355f6288bcaffd81554d2a94cf2b0ffe41e0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: cdYXZLFeIRSj5TXDgR142LEkieDOFT7A
content-encoding: gzip
etag: "d2f1dbe33db8786f76a41a201e3b0a55"
age: 951816
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 33792
x-amz-id-2: DEZdOwLagCzv5Y+mahDIObSpdECA3H+Y7ZDN1yiot/iETlo0adlJeOM9j0iTKhiDKp44N8zQbfg=
x-served-by: cache-sea4459-SEA, cache-hhn4056-HHN
last-modified: Tue, 25 Aug 2020 13:41:20 GMT
server: AmazonS3
x-timer: S1601057429.156365,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 3B2DB38267E3BE3F
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 4, 2829

GET
H2 200 150x-1.jpg
assets.bwbx.io/images/users/iqjWHBFdfxIU/ieVzMbEanwh4/v1/ 4 KB
4 KB 117ms
115ms Image
image/jpeg 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/images/users/iqjWHBFdfxIU/ieVzMbEanwh4/v1/150x-1.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx/1.13.12 /

Resource Hash

c57368b866acfd060ad3c8b6d7f224e7bc8ab8d63b80ed864a979cf5df978e3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
via: 1.1 varnish, 1.1 varnish
age: 119261
x-cache-status: MISS
x-cache: HIT, MISS
status: 200
edge-control: !no-store,max-age=365d
content-length: 3993
x-served-by: cache-lga21930-LGA, cache-hhn4056-HHN
server: nginx/1.13.12
x-timer: S1601057429.262626,VS0,VE85
etag: "0046f89ae6da8986c0b561ab820982aab"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 0

GET
H2 200 100x-1.jpg
assets.bwbx.io/images/users/iqjWHBFdfxIU/ieVzMbEanwh4/v1/ 2 KB
3 KB 51ms
49ms Image
image/jpeg 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/images/users/iqjWHBFdfxIU/ieVzMbEanwh4/v1/100x-1.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx/1.13.12 /

Resource Hash

5faed683d93b161c611f86535a2e4613be5c9e2e2f7de88eecb3cefd90b0291f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
via: 1.1 varnish, 1.1 varnish
age: 768048
x-cache-status: MISS
x-cache: HIT, HIT
status: 200
edge-control: !no-store,max-age=365d
content-length: 2425
x-served-by: cache-lga21937-LGA, cache-hhn4056-HHN
server: nginx/1.13.12
x-timer: S1601057429.262606,VS0,VE1
etag: "09bc32cf75eecaf192a2aaf48baff5290"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 preact.umd.js Show response
cdnjs.cloudflare.com/ajax/libs/preact/10.3.2/ 9 KB
4 KB 18ms
15ms Script
application/javascript 2606:4700::6811:4e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/preact/10.3.2/preact.umd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4e6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abf9bf37c84a887572100cb6d2cc1a628574688b83d9ec375c00073da6382d25

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 2756639
x-via: cfworker/kv
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3449
cf-request-id: 05680eaefe0000d72909218200000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:38 GMT
server: cloudflare
etag: "5eb03faa-24c7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5d86b3c4cff0d729-FRA
expires: Wed, 15 Sep 2021 18:10:29 GMT

GET
H2 200 hooks.umd.js Show response
cdnjs.cloudflare.com/ajax/libs/preact/10.3.2/ 3 KB
1 KB 19ms
16ms Script
application/javascript 2606:4700::6811:4e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/preact/10.3.2/hooks.umd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4e6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6aeefdb969d5d2bdeaf54e75f26fd54a33c486bf4aebbf555fad2c058581ebe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 2757109
x-via: cfworker/kv
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1018
cf-request-id: 05680eaefe0000d72909219200000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:38 GMT
server: cloudflare
etag: "5eb03faa-ad6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5d86b3c4cff1d729-FRA
expires: Wed, 15 Sep 2021 18:10:29 GMT

GET
H2 200 compat.umd.js Show response
cdnjs.cloudflare.com/ajax/libs/preact/10.3.2/ 8 KB
3 KB 27ms
24ms Script
application/javascript 2606:4700::6811:4e6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/preact/10.3.2/compat.umd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4e6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c509777f5de0ccf4fef96cecfc51d8421b0960903ee1d09241db66853ceaa86e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 2756683
x-via: cfworker/kv
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2790
cf-request-id: 05680eaefe0000d7290921a200000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:38 GMT
server: cloudflare
etag: "5eb03faa-1e6f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5d86b3c4cff2d729-FRA
expires: Wed, 15 Sep 2021 18:10:29 GMT

GET
H2 200 header-7aa56254ad154fafc945.js Show response
assets.bwbx.io/s3/navi/js/ 464 KB
139 KB 36ms
34ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

b91a5ef8243ee8c9064be9d39b5ce5007d1262a339633bc96972801df942b2f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Gb6MiDeV_BGDUlTfez6jbmL6NlMcgFTI
content-encoding: gzip
etag: "f69dba16d4979a7f37ea99f44bf1d8af"
age: 10542
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 141839
x-amz-id-2: f+CqB4Ho8W4IoX79gv9JKcSuAL6AgRjXeT0/rJuFR+VRnnUEpYMYUM7vXayFty/vJKrIakfP5E0=
x-served-by: cache-sea4453-SEA, cache-hhn4056-HHN
last-modified: Fri, 25 Sep 2020 15:13:39 GMT
server: AmazonS3
x-timer: S1601057429.262618,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 1F1044CC7B837F51
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 12

GET
H2 200 polyfills-d9a9f7640b.sync.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/polyfills/ 42 KB
14 KB 35ms
32ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/polyfills/polyfills-d9a9f7640b.sync.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c5c7b0b2f0c81bd3b33ba86389e9c749a124fc4b3110a246fa1811621f8aec1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: KkxVDC_T5tXvxhu3gdGzsofrHmtOgHgD
content-encoding: gzip
etag: "d9a9f7640b82ea1a411d471c83685c33"
age: 7861113
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 14329
x-amz-id-2: GlTQhv4tQ6JB9CvyO+pmYZzL3SZvTpDP00rSElkQXum3aZqebQ46U//IkB0ggAc2/9ulu/XEt8I=
x-served-by: cache-sea4467-SEA, cache-hhn4056-HHN
last-modified: Fri, 26 Jun 2020 18:30:35 GMT
server: AmazonS3
x-timer: S1601057429.262467,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 1M5R0V0V0K0J8Y6W
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1210

GET
H2 200 event_bus-913f926f3e.sync.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/event_bus/ 1 KB
893 B 34ms
32ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/event_bus/event_bus-913f926f3e.sync.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2fc8ede3a6853490cf0b81c02f636b3708437d47dcbd87e3fe18d505c87621b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: nHWiCE0f1Pmn9qVCIDGOrfo8rbAhhZ15
content-encoding: gzip
etag: "913f926f3eacadcafa8842b43df690a4"
age: 12363074
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 508
x-amz-id-2: PbbkxH1Rjd9IFogxwZ5C/04Ld8aZJX2MurCDNIjS5KBDZyC7kibApYv4LE0B91NueLoYxZuD/iU=
x-served-by: cache-sea4446-SEA, cache-hhn4056-HHN
last-modified: Mon, 04 May 2020 18:12:13 GMT
server: AmazonS3
x-timer: S1601057429.262454,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 04EC3AFA16FE9A82
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1928, 1158

GET
H2 200 unsupportedBrowserMessage-b4af7c1728.async.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/unsupportedBrowserMessage/ 6 KB
3 KB 35ms
34ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/unsupportedBrowserMessage/unsupportedBrowserMessage-b4af7c1728.async.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5398cbdbc1cda4ed250f2cca60bafc45be628302814896a889c3b3b7f8c6945b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: xPBjCKW8NatTTMJB2o1Zv8Q6MMn72FuO
content-encoding: gzip
etag: "b4af7c17287e4bb64d609fcd97e2c9f3"
age: 3743424
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 2941
x-amz-id-2: kwn7soE4bJqBnT8fpG+PuKN2HNeC8CATgjskAA8EMaQz/yW/cKU2/pDLEgNLAiKQV7gIRxccfew=
x-served-by: cache-sea4436-SEA, cache-hhn4056-HHN
last-modified: Wed, 12 Aug 2020 23:44:10 GMT
server: AmazonS3
x-timer: S1601057429.262622,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 07E846CC9A8EE54F
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 3319, 1099

GET
H2 200 main-c2522a4b12.sync.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/gateway_mobile/main/ 47 KB
20 KB 32ms
29ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/gateway_mobile/main/main-c2522a4b12.sync.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

41aa5e6364e7f4ef529a923366c3be98c7b2e325642f76e968af9a8b52c6698a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: HWz5HX8evy6vqlZTw._e5Zp3J82NdUvX
content-encoding: gzip
etag: "c2522a4b122a689ae2f7cf00accb543f"
age: 849911
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 19859
x-amz-id-2: ohY9F+a+vpGmMgNLwJOUev7TXqyI1kfb34Pl4NgW6glYInKmISATwQ3Z1G1Nu3XfW+M4u4kKuVU=
x-served-by: cache-sea4439-SEA, cache-hhn4056-HHN
last-modified: Tue, 15 Sep 2020 22:03:56 GMT
server: AmazonS3
x-timer: S1601057429.262325,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: BE488FF618E4DC71
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 6947, 997

GET
H2 200 AvenirNextPForBBG-Regular-eb3bb1b816.woff2
assets.bwbx.io/s3/fontservice/fonts/ 36 KB
36 KB 59ms
58ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/AvenirNextPForBBG-Regular-eb3bb1b816.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

13f07e4a2a1699b8dfc0b0ee14014fba6e822a778155a62ac588225ff8fe068a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: xmHDAbWbvAY6rcfZXzKq_4F0vYjdCF8G
via: 1.1 varnish
etag: "eb3bb1b8161ef443e50d2b9dfbcaeaa8"
age: 8676498
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 36456
x-amz-id-2: asHq1OcRVs40ZY0/oc9CwB6P8auCHSplSBIEUssxmcjqiPeQk3JonPBXjD7Lee3X/BtE9ZHT4cI=
x-served-by: cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:23 GMT
server: AmazonS3
x-timer: S1601057429.187246,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: 1FE6EAC585B4520B
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 25718

GET
H2 200 Bloomberg%20Logotypes-Medium-0e53877b78.woff2
assets.bwbx.io/s3/fontservice/fonts/ 21 KB
21 KB 44ms
40ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/Bloomberg%20Logotypes-Medium-0e53877b78.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

69f0a19068eadca038756a250c791b2a552c4f9e7a949ff685c3f8a9998d1cb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: m9w6wYY_OrLmFYoDerjQcR43FIeqYGMU
via: 1.1 varnish, 1.1 varnish
etag: "0e53877b78a789f87b6576fd89bc7866"
age: 8676497
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 21156
x-amz-id-2: tsjkXxlu1ALkAFpotUIVsfC9GdoSqp1bfmcJRPViCJrQYMfLP9ogrORcfm9A75keJZE+QsOt7Gg=
x-served-by: cache-sea4433-SEA, cache-hhn4066-HHN
last-modified: Thu, 21 May 2020 18:25:24 GMT
server: AmazonS3
x-timer: S1601057429.218309,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: B932F81047EE1788
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 5798, 27427

GET
H2 200 Bloomberg-048eeffe56.woff2
assets.bwbx.io/s3/fontservice/fonts/ 6 KB
6 KB 42ms
40ms Font
font/woff2 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fontservice/fonts/Bloomberg-048eeffe56.woff2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a0cc8e47dccd139dc225337f04af6abb6b9f2d4bce6fb1404edf6ec0562231b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://www.bloomberg.com
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2GnBsNIeXvJOkGDVh7O_WQCJT9wRYd2C
via: 1.1 varnish, 1.1 varnish
etag: "048eeffe568726efe8c6a952d769aa33"
age: 12435296
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 6068
x-amz-id-2: 8kxHDXLh2msIPFyc/+uDlcfU5l1Ybk0ydS43dPr+ndWZTT4SVwvuMQpxjYnjrHRaO6zBTpZ2lnM=
x-served-by: cache-sea4479-SEA, cache-hhn4066-HHN
last-modified: Tue, 31 Mar 2020 15:31:54 GMT
server: AmazonS3
x-timer: S1601057429.218268,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: ACE282F3B7991B41
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: font/woff2
x-cache-hits: 1, 23198

GET
DATA 200
OK truncated
/ 113 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0604e1347945a5561c8176d5eb7ad5db2d70a3494ccd72267b572e99c6f07a3a

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 542 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8baed2039b7f621eac8fcebb89c159202493841f6aad9b48e128c61ee5e81e9a

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 390 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc193f6020a37e29ed2f5f9e9f631c78e304595d0ac47e3b2f1cc1d980aa2662

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 379 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b026da50fc169ef54c2afc989bc6c38a513aefed22fa11d195b1bf5f1f0e0344

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 hamburger-1f9c80b47c.svg
assets.bwbx.io/s3/navi/images/ 156 B
389 B 31ms
31ms Image
image/svg+xml 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/navi/images/hamburger-1f9c80b47c.svg

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/navi/css/components/en/bar/bar-14112fb5bc.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c768728f133b19853c539d97dbf9ae20430ee6d7b1e31051777808b7957d0441

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://assets.bwbx.io/s3/navi/css/components/en/bar/bar-14112fb5bc.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Dr5wbUMT.Ijgsd4hmBG0gd1NP4mkHScZ
content-encoding: gzip
etag: "1f9c80b47ca9269d10f967452a75739d"
age: 8676370
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 142
x-amz-id-2: u9FQl8bGGHKjkbuTD6+4EoGj0BkymS3mNa0Ii6UBegMFxZ61sTER01WgA5MDJwWgBKnj1CM1AcQ=
x-served-by: cache-sea4455-SEA, cache-hhn4056-HHN
last-modified: Wed, 17 Jun 2020 01:31:52 GMT
server: AmazonS3
x-timer: S1601057429.348121,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 7CE78362C49AF571
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 863, 2348

GET
H2 200 search-9b046e5e0c.svg
assets.bwbx.io/s3/navi/images/ 762 B
866 B 31ms
30ms Image
image/svg+xml 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/navi/images/search-9b046e5e0c.svg

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/navi/css/components/en/bar/bar-14112fb5bc.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

73bdc967f28ba0c614595fb4bd489e949adbc641fa71e3507cfd52acb7da7346

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://assets.bwbx.io/s3/navi/css/components/en/bar/bar-14112fb5bc.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 6gORHujmmxDsj0Lekr376GVt6.vqpryx
content-encoding: gzip
etag: "9b046e5e0c44112192f09da17d05f555"
age: 8676380
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 410
x-amz-id-2: 6W3fcR7glTkgjg5GVA29L5t4OdXrnY873bISo5k8PAm48hyLUg/xEgT3p96pbimlVNXADgHiDK0=
x-served-by: cache-sea4459-SEA, cache-hhn4056-HHN
last-modified: Wed, 17 Jun 2020 01:31:52 GMT
server: AmazonS3
x-timer: S1601057429.348095,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 5F8C4ABB742F5D31
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 2404, 1517

GET
H2 200 expand-black-1363a5cdaa.svg
assets.bwbx.io/s3/javelin/public/javelin/images/ 298 B
487 B 32ms
31ms Image
image/svg+xml 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/images/expand-black-1363a5cdaa.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9068c664a43fbf90b105a0007ef73b172e9a2ade602e928f04cbf8fc4109a9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 3dW_Csyvq3LNltuPjXtcZ0PgbTbFUx7A
content-encoding: gzip
etag: "1363a5cdaaaaec2ae9ecaf920460ca4e"
age: 8676492
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 233
x-amz-id-2: 1i2XIgBdg+Xu/CUm3PjC62JIAKu6BrH+FJuXJQLgPDZS7dE0y9ov6T3YZxd7w1K771y6ldvkt9I=
x-served-by: cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:07 GMT
server: AmazonS3
x-timer: S1601057429.358786,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 0890EAE8F456B68D
via: 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 32

GET
H2 200 article-facebook-black-c32ba8c934.svg
assets.bwbx.io/s3/javelin/public/javelin/images/ 324 B
658 B 35ms
33ms Image
image/svg+xml 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/images/article-facebook-black-c32ba8c934.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

93fb57762d4c93a95b907ad59d4d0453cb24f56dfc7197aec3323969dcd3b1d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: .oKZELNPzLgJ0guUQMsTu8kZvV_S4hMP
content-encoding: gzip
etag: "c32ba8c934abf7dc2e47da8ff5426a04"
age: 8676499
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 254
x-amz-id-2: +vqcNSGfuWXBwqOBbj7VzATTWs0H2MyfmFEPMfs/X2miZwM2EuVrGx/Jra0Nq8Kq1r+2Eal/PM4=
x-served-by: cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:06 GMT
server: AmazonS3
x-timer: S1601057429.362858,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: A5A7C6F362767C92
via: 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 1085

GET
H2 200 article-twitter-black-a1e46e5f97.svg
assets.bwbx.io/s3/javelin/public/javelin/images/ 1 KB
930 B 34ms
33ms Image
image/svg+xml 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/images/article-twitter-black-a1e46e5f97.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f348c6403ccac26b10078dbbe9041f10285c49d4e42b240eea31fbdb0d66302a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2vi9TUziGspXNmD_4hICcM.CG3wkvpbt
content-encoding: gzip
etag: "a1e46e5f97f8c741c1005a4bdea26600"
age: 8676376
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 667
x-amz-id-2: Dydwf0cXIf5T1cUtGEzDv/8lVCZIzVqk969jJ0WUsALZeEcgm/ErCt+a54vAy3DmrB7MkMmgDUU=
x-served-by: cache-sea4476-SEA, cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:06 GMT
server: AmazonS3
x-timer: S1601057429.362854,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: C3F13F80D29405FF
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 8992, 1074

GET
H2 200 article-linkedin-black-025aead055.svg
assets.bwbx.io/s3/javelin/public/javelin/images/ 669 B
576 B 34ms
33ms Image
image/svg+xml 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/images/article-linkedin-black-025aead055.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a5a323dd5b3b00dd8a88b560ef6e86b15940ba975da6576b8e9fa9b3973d68cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: KG9ccfa0n5NWk.oKH43sczrBvtNCvQc_
content-encoding: gzip
etag: "025aead055da559cd59b31d46112752d"
age: 8676377
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 367
x-amz-id-2: 9Fpd796F+AN425nljcSfvOd8a/nBoMqCsp8Kn53FOXsPnDom9ZIH25AmtNhX/DN0zepMxnXB0Po=
x-served-by: cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:06 GMT
server: AmazonS3
x-timer: S1601057429.362827,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 8342B11890C0ACB4
via: 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 1072

GET
H2 200 article-email-black-6351905586.svg
assets.bwbx.io/s3/javelin/public/javelin/images/ 213 B
572 B 33ms
33ms Image
image/svg+xml 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/images/article-email-black-6351905586.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cf0d6d3cc5edf22f3166477574054657cec2f7f71c43fa399897587e59452d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: slzVpdVFD8YDDS2y3Q3z8zxSOX7gXvrm
content-encoding: gzip
etag: "6351905586b5bee32143503d4283fb1b"
age: 8676376
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 190
x-amz-id-2: QmNarqVr4xKVA/7lihf3jsi6iWzLB/U2r3yPBhNNN71j14seFyGrhTTlzPoQOy1JDOtMMxE01Jw=
x-served-by: cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:06 GMT
server: AmazonS3
x-timer: S1601057429.362801,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: EA8FD81B4A718309
via: 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/svg+xml
x-cache-hits: 1071

GET
H2 206 QGT0L9T1UM0W1600386010233.mp3
assets.bwbx.io/s3/readings/ 128 KB
0 927ms
925ms Media
application/octet-stream 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/readings/QGT0L9T1UM0W1600386010233.mp3

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

x-amz-version-id: JAGwCqND2QUEWctIdfOfFKwxJtKW7C7H
via: 1.1 varnish, 1.1 varnish
etag: "068fc12f83ce7abfddc34f7726925d55"
age: 1
x-cache: HIT, HIT
status: 206
x-amz-replication-status: COMPLETED
Content-Length: 942647
x-amz-id-2: lXJqdcXPfllSrtbDxJaor1u/WWi+qC7AKJKEhDyU4dZQ2wfUwejc4ZFtdlW3fT6GO7+BualXMjQ=
x-served-by: cache-sea4458-SEA, cache-hhn4056-HHN
Content-Range: bytes 0-942646/942647
last-modified: Thu, 17 Sep 2020 23:40:21 GMT
server: AmazonS3
x-timer: S1601057429.393102,VS0,VE893
date: Fri, 25 Sep 2020 18:10:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: C904C3F77A9CDC31
accept-ranges: bytes, bytes
content-type: application/octet-stream
x-cache-hits: 1, 0

GET
H2 206 QGT0L9T1UM0W1600386010233.mp3
assets.bwbx.io/s3/readings/ 64 KB
0 926ms
924ms Media
application/octet-stream 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/readings/QGT0L9T1UM0W1600386010233.mp3

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

x-amz-version-id: JAGwCqND2QUEWctIdfOfFKwxJtKW7C7H
via: 1.1 varnish, 1.1 varnish
etag: "068fc12f83ce7abfddc34f7726925d55"
age: 1
x-cache: HIT, HIT
status: 206
x-amz-replication-status: COMPLETED
Content-Length: 942647
x-amz-id-2: lXJqdcXPfllSrtbDxJaor1u/WWi+qC7AKJKEhDyU4dZQ2wfUwejc4ZFtdlW3fT6GO7+BualXMjQ=
x-served-by: cache-sea4458-SEA, cache-hhn4056-HHN
Content-Range: bytes 0-942646/942647
last-modified: Thu, 17 Sep 2020 23:40:21 GMT
server: AmazonS3
x-timer: S1601057429.396162,VS0,VE890
date: Fri, 25 Sep 2020 18:10:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: C904C3F77A9CDC31
accept-ranges: bytes, bytes
content-type: application/octet-stream
x-cache-hits: 1, 0

GET
H2 206 QGT0L9T1UM0W1600386010233.mp3
assets.bwbx.io/s3/readings/ 64 KB
0 926ms
924ms Media
application/octet-stream 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/readings/QGT0L9T1UM0W1600386010233.mp3

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

x-amz-version-id: JAGwCqND2QUEWctIdfOfFKwxJtKW7C7H
via: 1.1 varnish, 1.1 varnish
etag: "068fc12f83ce7abfddc34f7726925d55"
age: 1
x-cache: HIT, HIT
status: 206
x-amz-replication-status: COMPLETED
Content-Length: 942647
x-amz-id-2: lXJqdcXPfllSrtbDxJaor1u/WWi+qC7AKJKEhDyU4dZQ2wfUwejc4ZFtdlW3fT6GO7+BualXMjQ=
x-served-by: cache-sea4458-SEA, cache-hhn4056-HHN
Content-Range: bytes 0-942646/942647
last-modified: Thu, 17 Sep 2020 23:40:21 GMT
server: AmazonS3
x-timer: S1601057429.396155,VS0,VE890
date: Fri, 25 Sep 2020 18:10:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: C904C3F77A9CDC31
accept-ranges: bytes, bytes
content-type: application/octet-stream
x-cache-hits: 1, 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 385 KB
65 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MNTH5N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5f02ae55075b9482bdf16fd5261fc018d3d1d92e7f041343d0819a632fb29275

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66515
x-xss-protection: 0
expires: Fri, 25 Sep 2020 18:10:29 GMT

GET
H/1.1 200
OK that.js Show response
www.bloomberg.com/tophat/assets/v2.5.1/ 9 KB
3 KB 33ms
33ms Script
application/javascript 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/tophat/assets/v2.5.1/that.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

nginx / BB Cache

Resource Hash

5dd17270071ae30f05d3853c3e629d583d98e0d5c4063127a764400ce4d31262

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
ETag: "223f-5a871ca0a5980-gzip"
Last-Modified: Fri, 19 Jun 2020 15:45:58 GMT
Server: nginx
X-Powered-By: BB Cache
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=27574518
Date: Fri, 25 Sep 2020 18:10:29 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2480
Expires: Tue, 10 Aug 2021 21:45:47 GMT

GET
H/1.1 200
OK init.js Show response
www.bloomberg.com/8FCGYgk4/ 77 KB
29 KB 50ms
49ms Script
application/javascript 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/8FCGYgk4/init.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e660ee07a821d40b584ecf18811feb7a5853fcaa037d07b2907f9c4a7cf3afc0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:29 GMT
Content-Encoding: gzip
ETag: W/"1353b-/v/hKsYipABkVdkuB8YTqz47GTM"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=262
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29230
Expires: Fri, 25 Sep 2020 18:14:51 GMT

GET
H2 200 right_rail-d12308f55b.desktop.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/layout/right_rail/ 4 KB
2 KB 54ms
42ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/layout/right_rail/right_rail-d12308f55b.desktop.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2e03e51fd56a4906e0a8ff9aa2b88318dd9d4ce24a5aa24b18a00697389ba491

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: WhxyDFKBXRk7IZVBsXJfFP..1aEYzFhf
content-encoding: gzip
etag: "d12308f55bc5161e4f5815407d0976fb"
age: 2621287
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1633
x-amz-id-2: P5KztwgJt4A8T5BEGcQTLKtnqirfsiGlDMkEbWCSygcGpCpra3q2ZEIh+FkVbO4O44lGF/7OpSM=
x-served-by: cache-sea4448-SEA, cache-hhn4056-HHN
last-modified: Tue, 25 Aug 2020 21:43:46 GMT
server: AmazonS3
x-timer: S1601057429.450538,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 77BB40DEECCA5FF6
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 206, 34

GET
H2 200 mini_player-054ea9a219.desktop.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/mini_player/ 3 KB
2 KB 54ms
42ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/mini_player/mini_player-054ea9a219.desktop.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2fef7eaa941cf41e2f0ec7e9c8dca35b6459d575d32dc1c121ca06822c175eb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: pdKlegzKkaZPqpx4VLjlfdIA3VoC_LEr
content-encoding: gzip
etag: "054ea9a219ba961bd537b49b1be65193"
age: 3736148
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1574
x-amz-id-2: J5+THNyOhsB0ENQjihVX9m6BeZYw9rKZLRX2Q/guuTIrGbOli79zuHoZp2wYyBSxkttxe+i/Ok0=
x-served-by: cache-sea4420-SEA, cache-hhn4056-HHN
last-modified: Wed, 12 Aug 2020 23:44:09 GMT
server: AmazonS3
x-timer: S1601057429.450508,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 59160DD29D2085C4
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 239, 28

GET
H2 200 image_viewer-86204d07dc.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/image_viewer/ 3 KB
1 KB 53ms
41ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/image_viewer/image_viewer-86204d07dc.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6463927d3579e6e4da275df7c07b60e6010d8a981b0d4463a6927f533dc922ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: NU._CmdvoYVGDFZWq4TnbYWTA.gsvBlj
content-encoding: gzip
etag: "86204d07dc336a51a9e4bb046693b259"
age: 8676381
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1131
x-amz-id-2: V4bPfNKRfbX+hM2wtWSj6W2qAOrBSgfs2vpVgQ1qw9ZDhErqPbh3UMXLvqbPgT5TEETEtewEfJc=
x-served-by: cache-sea4471-SEA, cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:18 GMT
server: AmazonS3
x-timer: S1601057429.450443,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 57DE3ABDD366965D
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 7748, 1054

GET
H2 200 initialize_sparkle-e986310fe9.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/initialize/ 158 KB
41 KB 53ms
41ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/initialize/initialize_sparkle-e986310fe9.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4cd235403fb67f8ada0e7ad0350eb866039e94bd9e02766998b75369ec04863d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: wj41WF_n43EBmRlZ2s6zHO8BcUhePU_f
content-encoding: gzip
etag: "e986310fe935764cd84ba0315b133139"
age: 337253
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 41402
x-amz-id-2: 9B1D4I4UsIRCqqXkCeaPukFh1HxiYD6m9PQbkGQhalGAVamIxRxsu7Z32bJU06VjyWWC7vYoPdw=
x-served-by: cache-sea4479-SEA, cache-hhn4056-HHN
last-modified: Mon, 21 Sep 2020 20:28:19 GMT
server: AmazonS3
x-timer: S1601057429.450433,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 4F92542BF12353D0
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1133

GET
H2 200 abba-85cca4a198.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/abba/ 355 KB
108 KB 53ms
41ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/abba/abba-85cca4a198.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

52e4128c67131ac27cbf6a7b17f8211701f2db361649fcadcd96eac1bbc9b58e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: EYA.ehFA9OhGaupKra5eHdINuq9Se4ug
content-encoding: gzip
etag: "85cca4a1986ebe377e03862178d63310"
age: 2680738
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 109909
x-amz-id-2: xGA0T5loSWC4okU9WrWDNc2jDy9UHptEvBOnSCgRpaI0HkeWPVAkDsLGalYC/Z5QMpNZjBfmOuA=
x-served-by: cache-sea4435-SEA, cache-hhn4056-HHN
last-modified: Tue, 25 Aug 2020 17:30:04 GMT
server: AmazonS3
x-timer: S1601057429.450382,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 04405D0B02D3E6C9
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1033

GET
H2 200 transporter-db290c625f.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/transporter/ 65 KB
21 KB 52ms
41ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/transporter/transporter-db290c625f.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

61e406410e258554e3b6091ca78f1d01d2e6cb95bcf52601b2a48d1f15598257

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: QbiX51IpbWwkFsxgKGfIMNPzhn9jlMwu
content-encoding: gzip
etag: "db290c625f6e9b9c9ab99e90399b88f1"
age: 179768
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 20781
x-amz-id-2: 22DeeZm37XdwBrjeuNBT1fFCCcUGSubAv3qPkJ4VEjyUWwCjV8T4do0RtZtwVHwJf3U+h/ikRzw=
x-served-by: cache-sea4434-SEA, cache-hhn4056-HHN
last-modified: Wed, 23 Sep 2020 16:13:06 GMT
server: AmazonS3
x-timer: S1601057429.450317,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: FZ8PCY5SFW9TCNCW
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1105

GET
H2 200 overlay-6148cf5ee6.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/overlay/ 843 B
670 B 52ms
41ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/overlay/overlay-6148cf5ee6.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

458616a44952673f11b71829ed175f779bc81b9c07813b7fa52b361faff5e5c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: MsqF0hQGcKq1Gzfoy._NG7HT2HFiINUH
content-encoding: gzip
etag: "6148cf5ee6d550fb726eca5560e710cc"
age: 8676377
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 433
x-amz-id-2: DtxxVGaUbQ/0qAw2/Ua64Dzi4OzLY+d5wd5t7QJrsqcTmqYN1wLetj3CrIXnBLQGiNHqxKW/cvA=
x-served-by: cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:20 GMT
server: AmazonS3
x-timer: S1601057429.450251,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: E46CB353832446DC
via: 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 997

GET
H2 200 outstream-2a192d8b37.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/outstream/ 1 KB
853 B 51ms
40ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/outstream/outstream-2a192d8b37.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5ab720dcbb4e7547f395bdf8483f5f7f9f030dfedac751704e709d5b86a04641

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: mg06lOZxS4T6bgRZFAJclBh8bkgyuCqS
content-encoding: gzip
etag: "2a192d8b371297d3408bd898eaa0789f"
age: 8676499
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 568
x-amz-id-2: um5Sq458DGjj6W9h7OEtoRImjuq9eCehcDsSuWWhbs03+47AHz8MhHkRGdXgu+5W38PYVGxcFbk=
x-served-by: cache-sea4474-SEA, cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:20 GMT
server: AmazonS3
x-timer: S1601057429.449806,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 62B006C5F645C576
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 3230, 940

GET
H2 200 lazy_images-f046c5ed02.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/lazy_images/ 2 KB
1 KB 51ms
40ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/lazy_images/lazy_images-f046c5ed02.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

350c16e33f84249456c66b31db96acea667cf04a97bd53eabbbf86b781fee81b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Hm289yG6uPspWJBGLZ74X5eVzt1r2mPB
content-encoding: gzip
etag: "f046c5ed02ad1b4c972cce91f978f0e0"
age: 7861114
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 831
x-amz-id-2: yxFdcGm24+6vejmM4OKfLYg2aUeGVfAjDmd9vJHgTWK2GlRfC21qmgnGdc2tZAnuI7qqV12yRmU=
x-served-by: cache-sea4474-SEA, cache-hhn4056-HHN
last-modified: Fri, 26 Jun 2020 18:30:33 GMT
server: AmazonS3
x-timer: S1601057429.449757,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: B9CC6EFF649F54E2
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1049

GET
H2 200 third_party_embeds-83ac161ba7.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/third_party_embeds/ 1 KB
961 B 50ms
40ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/third_party_embeds/third_party_embeds-83ac161ba7.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c716b836e06759c51d2b438d30d8c11ffb3fa2d3394bc9b5a76bd15ee3f32573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: npj1kro5odW2KqgfVWzv9yxRSuTC.kdc
content-encoding: gzip
etag: "83ac161ba7e3fe7a6f188dd81af2f781"
age: 943665
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 683
x-amz-id-2: 0Yspg9fdYehZBbdw67LFnqiiEsSMx9auXML5ez91z0cGdghl+StFciEZohnQWjTDcBFAR0KoVqM=
x-served-by: cache-sea4445-SEA, cache-hhn4056-HHN
last-modified: Mon, 14 Sep 2020 20:01:21 GMT
server: AmazonS3
x-timer: S1601057429.449736,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 1110623D4D5C439C
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1089

GET
H2 200 video_player-b4c4b2004f.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/video_player/ 6 KB
3 KB 49ms
39ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/video_player/video_player-b4c4b2004f.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

dfb21156f65312e7baf370d35e66b73ffb7f4454a5b933ac626687920a168470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 1T3ZghxBa1txEi4I70Z9eAbKEC2QPPvz
content-encoding: gzip
etag: "b4c4b2004fd4af5324f001b0d8c0423e"
age: 8551383
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 2385
x-amz-id-2: DeIOyCN+Zax+GxR8He10JkBwYvbJt+73Wl88NZxhu7fchTGE+8Hq8lygoQKYE8GHx/yQKNBghV0=
x-served-by: cache-sea4477-SEA, cache-hhn4056-HHN
last-modified: Thu, 18 Jun 2020 18:46:05 GMT
server: AmazonS3
x-timer: S1601057429.449340,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: CB58CB162B98D087
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1051

GET
H2 200 news_wallet_inline_tout-be5cdc5c1b.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/news_wallet_inline_tout/ 3 KB
2 KB 49ms
39ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/news_wallet_inline_tout/news_wallet_inline_tout-be5cdc5c1b.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

70dad2e007c709457ef13362f10063b458c0f57c25109a8f55042b7a6cebae1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: maLk1t_SOFztTQZFQFwgiNP.J.PycnHl
content-encoding: gzip
etag: "be5cdc5c1b6d6c647367be9dfa59654c"
age: 853830
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1406
x-amz-id-2: KPbm0DmGllPkxA7IjBHPQTTI9rr9kUahzpuvpbvf6NEwXP3w48vgL6korLguboNHIxYa8nMi4ug=
x-served-by: cache-sea4452-SEA, cache-hhn4056-HHN
last-modified: Tue, 15 Sep 2020 20:58:38 GMT
server: AmazonS3
x-timer: S1601057429.449297,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: D92A61C3BCD52DFD
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1022, 455

GET
H2 200 pianola-0c1f6c3fa7.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/pianola/ 75 KB
22 KB 49ms
39ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/pianola/pianola-0c1f6c3fa7.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

73b724042bd2a974f2922448d6c21daa3a1e61fb6a9740bc9a19b83111c62c59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: ocFbRJTc0kijrX6kmtwOpbvh1dgjVyy9
content-encoding: gzip
etag: "0c1f6c3fa702d44a425ac9c1575a518b"
age: 1922940
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 22722
x-amz-id-2: rl5Q/TCzElkN2zs9BKNvvPlzSxSTPox+y4AeSIosUzDpYAUjXtnDFu2Qr6jI/4lBFRcLrhys1Js=
x-served-by: cache-sea4439-SEA, cache-hhn4056-HHN
last-modified: Wed, 02 Sep 2020 23:07:24 GMT
server: AmazonS3
x-timer: S1601057429.449270,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 8H0W9YCR9Q8H8M8J
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 12463, 1019

GET
H2 200 timestamp-01f249088e.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/timestamp/ 9 KB
3 KB 48ms
39ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/timestamp/timestamp-01f249088e.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2b33c970740a7a47e42e700528757634dac34f14bfe3023a5c04f61ad7368fb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: zRZi16LFwj3hNHmxs5Uufix5rbwmIqhm
content-encoding: gzip
etag: "01f249088e2f49c66c9182b891b7e6ad"
age: 849914
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 3281
x-amz-id-2: jE16+c0P55ltQ+QX81bANQt4/TucWIDmgR+RuvdOMROe624kgX2Zs/CMz8LemmSrL5mIesw1aIo=
x-served-by: cache-sea4438-SEA, cache-hhn4056-HHN
last-modified: Tue, 15 Sep 2020 22:03:56 GMT
server: AmazonS3
x-timer: S1601057429.449210,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: AE27860EDD1C419A
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 458

GET
H2 200 headline_anchor-57cd8d11de.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/body/basic_redesign/ 1 KB
990 B 48ms
38ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/body/basic_redesign/headline_anchor-57cd8d11de.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a6d07db8a81099a43a8f9573d5069ea7ea0202933c4e5bc62f2ad16998c9523a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 15898100
x-cache: HIT, HIT
status: 200
content-length: 645
x-amz-id-2: /gZ1Ja0JKmF3hx1n34goXyKNu3jOTr0QoYIJDHklZkCy7Sk5qqpDL55eENElOL4kQShxgiic8hs=
x-served-by: cache-sea4439-SEA, cache-hhn4056-HHN
last-modified: Wed, 25 Mar 2020 18:00:39 GMT
server: AmazonS3
x-timer: S1601057429.449210,VS0,VE0
etag: "57cd8d11dedb2da17a379d3a296a12e2"
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 3A188B10C05CC5C0
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 5108, 911

GET
H2 200 transporter_teaser-54fac1f0b5.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/body/basic_redesign/ 2 KB
1 KB 47ms
38ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/body/basic_redesign/transporter_teaser-54fac1f0b5.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

24ef3b95681e9c84c0d6698d69b3f06d252d76d28d51dc81e71c9853cb918ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: bEUUsMy1t9DVkokRjx6uaKIRSx._fpTZ
content-encoding: gzip
etag: "54fac1f0b54c0ac1072f32203f36b75f"
age: 8676375
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1098
x-amz-id-2: LWzpAblu+qC9ZDnMxmUqw5q+oLzUnmfRaPxfmiGanMnqGHuZqUOYK1BR2DduzM2rBNXfrsM0iRw=
x-served-by: cache-sea4462-SEA, cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:18 GMT
server: AmazonS3
x-timer: S1601057429.449186,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: E45D92C86AE4151C
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 10686, 923

GET
H2 200 byzantiumMetadata-0c8fd667ec.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/byzantiumMetadata/ 2 KB
1 KB 46ms
38ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/byzantiumMetadata/byzantiumMetadata-0c8fd667ec.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

994a85a7ee7a5c5aa7832ec483d46a1d38b75fae782493c8de416b96a8d17a6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2pfQfCP15a13CMpyGx7ej8X7PU.MyaIO
content-encoding: gzip
etag: "0c8fd667ecb3b8df3399baabcc13dde6"
age: 956637
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 892
x-amz-id-2: s/3v8TaouyxLOF6pm+KMLXhRulETziXEC9pKT8stg1Xj7RXupbkPX+J5eclN0Q3BvArbmvPyXJk=
x-served-by: cache-sea4440-SEA, cache-hhn4056-HHN
last-modified: Mon, 14 Sep 2020 16:25:11 GMT
server: AmazonS3
x-timer: S1601057429.449150,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 4ABEAB18B546AFA3
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 1067

GET
H2 200 author_details-00fcf6e996.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/author_details/ 1 KB
881 B 64ms
56ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/author_details/author_details-00fcf6e996.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

00aaabb6830948b0953348d009dac13305dc3e7b9bf04a54b70582dafd0e7fcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: gt_w4ec_b7Epmp4UQm4Y65oFPXJUETzZ
content-encoding: gzip
etag: "00fcf6e996c3fc883888ea81f8473248"
age: 8676376
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 557
x-amz-id-2: z/CPGfaar+p8u4OnaEyQduoh6WpRpHiwsxokfXa4AgSQQ4TRfGTZB/fszMlv514iiS+cElR5VVo=
x-served-by: cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:18 GMT
server: AmazonS3
x-timer: S1601057429.458991,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 3D1E6576DBC35A8E
via: 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 990

GET
H2 200 recirc_redesign-c9196f68ff.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/recirc_redesign/ 8 KB
3 KB 64ms
55ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/recirc_redesign/recirc_redesign-c9196f68ff.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

941d7b9e8c1f693e41d8ee74d99eb6f5b08f99dedf7884f6fc5fde662099a487

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: UCtb95DqbdIWJApOaxq.PJ.yFNsXkoR_
content-encoding: gzip
etag: "c9196f68ff93691976ad30122026e5ed"
age: 849913
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 3101
x-amz-id-2: lps1tP0IJLY1M01fBoPa+mcnt6qrCtHUgb4Lx8+EPfGEOGQazJgZl7rtnamaiQMWzMPvKxRBFcg=
x-served-by: cache-sea4468-SEA, cache-hhn4056-HHN
last-modified: Tue, 15 Sep 2020 22:03:55 GMT
server: AmazonS3
x-timer: S1601057429.458994,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 50574FAEE6A54C66
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 2, 872

GET
H2 200 charts-afe6d09b46.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/charts/ 4 KB
2 KB 63ms
55ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/charts/charts-afe6d09b46.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

99d678cc516694db9cfb2f1c4b29044b3cf5177e46dc8c5ee10645cf664bd316

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: lXHk.kDjnpMO8Fw.ZFiAVYTlrswpTcZt
content-encoding: gzip
etag: "afe6d09b46bea4c35b24db70e3faba8b"
age: 7861116
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1455
x-amz-id-2: SO67chgamXcCjtzDEK+HXq2VNAnwTP2aIHfsa9pc2ezzn8oCOVf+Oyf6GAx9o+2uHGbpmPRRb9o=
x-served-by: cache-sea4442-SEA, cache-hhn4056-HHN
last-modified: Fri, 26 Jun 2020 18:30:33 GMT
server: AmazonS3
x-timer: S1601057429.458933,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 3F8A3200A0C16DBC
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 506

GET
H2 200 taboola-48baa8e15b.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/taboola/en/ 3 KB
2 KB 63ms
55ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/taboola/en/taboola-48baa8e15b.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

d24d95f31f8b8a92c4a107c83a5ef923d299e8b962f67c316bb7ed9504b3cd1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: v7KhdDAT8gZnsUWMRdMpQOO1i3JdiO5L
content-encoding: gzip
etag: "48baa8e15b92e0461b967e92ca3212ae"
age: 8676375
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1287
x-amz-id-2: YghJe7zuxS//esC25WjI/RNUY3yoOJXahG6lwacUapGu62ZI86CCpLx8QAR6kihOU3kSj8jYpuw=
x-served-by: cache-sea4469-SEA, cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:20 GMT
server: AmazonS3
x-timer: S1601057429.458913,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 652D0FB71CF9A2A7
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 557, 903

GET
H2 200 blens-fb2528f431.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/blens/ 3 KB
1 KB 62ms
55ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/blens/blens-fb2528f431.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c86fa16cb9f397dd76145683ce4e3e44aa5a9b0fee5fffbb95a2e3d0c3a31971

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: G.VxspNACjBzC36jB8eZxs8FTIGzFXIW
content-encoding: gzip
etag: "fb2528f4315ffa8d23dedd0973fd7fcd"
age: 784217
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1217
x-amz-id-2: SaakYQPwe5IPWxxNSLIEIP5g42fg4Ap1QiSoYhHQCtRFQN+FlfhMXTFKbnO0d4XN7BEhVPDtjow=
x-served-by: cache-sea4446-SEA, cache-hhn4056-HHN
last-modified: Wed, 16 Sep 2020 16:18:53 GMT
server: AmazonS3
x-timer: S1601057429.459322,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 8648CB4EC2A71FD8
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 945

GET
H2 200 storythread_tout-d53a539ffb.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/storythread_tout/ 3 KB
2 KB 62ms
55ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/storythread_tout/storythread_tout-d53a539ffb.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2840b8bb4e008090a8a5d53d0e20379dfcbbf408ed0df333b439352ff6518c12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: QVwsmetbjWwnpYBYHWHVrhbW7NLzoAVf
content-encoding: gzip
etag: "d53a539ffbdfd3faf40acc6c814ccdc9"
age: 4530405
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1504
x-amz-id-2: yGsJ/KGNuogE1OfTd7I2fPi/i4dWJMOIPUp0jsaLmCKlcWFW6ahaTZ1D6GCuYhd85X9XCm7bPXs=
x-served-by: cache-sea4476-SEA, cache-hhn4056-HHN
last-modified: Fri, 31 Jul 2020 17:03:39 GMT
server: AmazonS3
x-timer: S1601057429.458854,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 0070FDFC8551F7DA
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 6681, 985

GET
H2 200 geoip-21d535e0c2.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/analytics/geoip/ 27 KB
10 KB 61ms
54ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/analytics/geoip/geoip-21d535e0c2.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

92b066ac0ec1b15514acd7426a194259edf2864b0e374d52338ce9d2a0a9dfd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: J6vRV_T8A9ZmOwbJ46Z63X5Xtf4s2CQ0
content-encoding: gzip
etag: "21d535e0c2b523f09fc4193ee3b58afc"
age: 7861113
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 9561
x-amz-id-2: 2SExZTOQucz/+VAwMMp2AoVugSscsoouNUsXWuWBmBlXAxcFQJjiAiHz0T3eNXXaCSINvE6aVWE=
x-served-by: cache-sea4430-SEA, cache-hhn4056-HHN
last-modified: Fri, 26 Jun 2020 18:30:32 GMT
server: AmazonS3
x-timer: S1601057429.458145,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: CE2494E83F8A2EBD
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 944

GET
H2 200 dependencies-3d5a091347.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/dependencies/ 3 KB
1 KB 61ms
54ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/dependencies/dependencies-3d5a091347.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

fe8ce03cfbeed2d7ed7620f2b989ceba117c35a36093fd89f7de028a890945b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: IYhhAzjpu22CAldPVonYB9evjxEjtHL9
content-encoding: gzip
etag: "3d5a091347e1341bea6f84f150c4e2f9"
age: 12435305
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1148
x-amz-id-2: x9fJHUjEow8oeOsl7ZEeYr/Ylrk5vCZh/6/EpgK+6KuJCvrxIOwPYub4QP9A61UG1AaaqxMtmvg=
x-served-by: cache-sea4466-SEA, cache-hhn4056-HHN
last-modified: Mon, 04 May 2020 18:12:14 GMT
server: AmazonS3
x-timer: S1601057429.458039,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 812A8B3FE48991C4
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 10312, 1008

GET
H2 200 leaderboard-23e993a388.tablet-desktop.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/leaderboard/ 1 KB
939 B 61ms
54ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/leaderboard/leaderboard-23e993a388.tablet-desktop.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

bc2055521461ac6a5b67246c8bd4458118883b4c33c1337ea2e59a2ae3061d52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: kaxp_GgLsRqC_D1gscs7nNe8HFi7wnml
content-encoding: gzip
etag: "23e993a3881a9d6e3757ff28cc0addb6"
age: 8676497
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 629
x-amz-id-2: 2+pD5Ol9f7RmFhnuCiYufYLz+XBDuLYScBOguZ0BngL2uRgNpMZ2TdORYMem6I4Lz+Gw1LRXHN4=
x-served-by: cache-sea4431-SEA, cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:20 GMT
server: AmazonS3
x-timer: S1601057429.457972,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 5CF9FBBDE0449DFA
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 362, 33

GET
H2 200 text_to_speech-5e8e0728fb.tablet-desktop.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/text_to_speech/ 3 KB
1 KB 60ms
54ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/text_to_speech/text_to_speech-5e8e0728fb.tablet-desktop.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

09865360ac583fbc9a02b2dc28bbd5a632fc10ca5dd4affd3116e07c709adce5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: pJaiXkF41sVxctWx9JAsI2k4Knby3UYR
content-encoding: gzip
etag: "5e8e0728fbc8c50e16b4320c83d507f3"
age: 8676368
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1095
x-amz-id-2: iki3mhD7RD9mrhdnyHS7xXHTOLc7yGYKBkChO8ZsGMBuKy1M6ZusdC3QCwD3gt6cvvYWp9SDlR4=
x-served-by: cache-sea4435-SEA, cache-hhn4056-HHN
last-modified: Tue, 16 Jun 2020 23:01:19 GMT
server: AmazonS3
x-timer: S1601057429.457918,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 020E77DA20266C28
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 433, 33

GET
H2 200 share_article_button-bfe677eaf3.tablet-desktop.js Show response
assets.bwbx.io/s3/javelin/public/javelin/js/components/share_article_button/ 1 KB
857 B 60ms
53ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/js/components/share_article_button/share_article_button-bfe677eaf3.tablet-desktop.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

04864a1fb8441e20967ec9c1b183fbf6a2f1e247a0d3dc38caa718021c6e2e74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: v2Xf2JFCkZighFCs.grpV2jKTGDlKApQ
content-encoding: gzip
etag: "bfe677eaf33d0b12ba8c6fbc0ba2d502"
age: 3818103
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 581
x-amz-id-2: e309kF7Oc5mlvx9agHfHuJy/lBjQIU1+pDG33PMHUfgELZ4Y8U44+XkDW9KsHv/bveVwHaqUERw=
x-served-by: cache-sea4430-SEA, cache-hhn4056-HHN
last-modified: Wed, 12 Aug 2020 00:02:20 GMT
server: AmazonS3
x-timer: S1601057429.457905,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: C01F3D663755F7B3
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 4, 34

GET
H2 200 styles.css
assets.bwbx.io/s3/fence/v4/ 84 KB
14 KB 48ms
42ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fence/v4/styles.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

b11dff9282d54cc80505d328f3c2f5b0d4aa59f5079dc563ccce7d3719c24866

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 3JASwxxg_vCrsxsxwg8wbhbimmH8BZwI
content-encoding: gzip
etag: "ca01b3b8710a89275ca8d1db1164a287"
age: 2
x-cache: HIT, HIT
status: 200
x-amz-replication-status: PENDING
vary: Accept-Encoding
content-length: 14050
x-amz-id-2: OW5z1LlikHbJWlVWcQPY7iJoSpFQ5b51EyjgioRwcdK2qoWhAX8xvkOhri3nPGkgbg3g5Pm0YG0=
x-served-by: cache-sea4454-SEA, cache-hhn4056-HHN
last-modified: Mon, 21 Sep 2020 18:12:13 GMT
server: AmazonS3
x-timer: S1601057429.451023,VS0,VE1
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: E053B30C75197E7A
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=30
accept-ranges: bytes
content-type: text/css
x-cache-hits: 2, 1

GET
H2 200 font-face.css
assets.bwbx.io/font-service/css/BWHaasGrotesk-55Roman-Web,BWHaasGrotesk-75Bold-Web,Bloomberg/ 1 KB
904 B 48ms
42ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/font-service/css/BWHaasGrotesk-55Roman-Web,BWHaasGrotesk-75Bold-Web,Bloomberg/font-face.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

/ Express

Resource Hash

3d94e830e57298508f497d2671ba42c4aa83d5a1b534c9389750b634b0717a6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 481
x-powered-by: Express
x-cache: HIT, HIT
status: 200
content-length: 345
x-served-by: cache-lga21938-LGA, cache-hhn4056-HHN
x-timer: S1601057429.450579,VS0,VE0
etag: W/"568-7JNircZJxHA891e4a3tfik/mntY"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css; charset=utf-8
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=900
accept-ranges: bytes
link: <https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-55Roman-Web-5cf5733cd9.woff2>; rel=preload; as=font; crossorigin; nopush, <https://assets.bwbx.io/s3/fontservice/fonts/BWHaasGrotesk-75Bold-Web-de8c77cce2.woff2>; rel=preload; as=font; crossorigin; nopush, <https://assets.bwbx.io/s3/fontservice/fonts/Bloomberg-048eeffe56.woff2>; rel=preload; as=font; crossorigin; nopush
x-cache-hits: 1, 22

GET
H2 200 app.bundle.js Show response
assets.bwbx.io/s3/fence/v4/ 881 KB
250 KB 59ms
53ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/fence/v4/app.bundle.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

610e73f0f23a30a34f174414bb5b1eb3f45d7d5225b57a8adcdd82e62e4d53ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: HGxGSIw3VBwNRbvhw_ESt0z0JELhA.3x
content-encoding: gzip
etag: "5c83a632eac2759557500311a543eb94"
age: 7
x-cache: HIT, HIT
status: 200
x-amz-replication-status: PENDING
vary: Accept-Encoding
content-length: 255830
x-amz-id-2: AzGeNOu0VUlyqSMIpe5P7rhItTAAcCZ+KMI4v8Txx0yXORa2pWQetcbhfW+XAVx9u+8AAC/YwxY=
x-served-by: cache-sea4448-SEA, cache-hhn4056-HHN
last-modified: Mon, 21 Sep 2020 18:12:13 GMT
server: AmazonS3
x-timer: S1601057429.457865,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 8397670F790D18FB
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=30
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 2

GET
H2 200 query Show response
location.bloomberg.com/ 42 B
348 B 401ms
122ms Fetch
application/json 34.238.7.196
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://location.bloomberg.com/query

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/bridgeweb/v1/bridge-web.bundle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.238.7.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-238-7-196.compute-1.amazonaws.com

Software

Apache /

Resource Hash

0c1724e1aad9bff038e162b0a460401145f49895313f56ac55a775ea8ce0b248

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
status: 200
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://www.bloomberg.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 mini-player-poster-67626f2bff.jpg
assets.bwbx.io/s3/javelin/public/javelin/images/ 2 KB
2 KB 57ms
53ms Image
image/jpeg 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/javelin/public/javelin/images/mini-player-poster-67626f2bff.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

fa401cc2f2f4f5944180d38a30ac8eb6bb652ef8edf620f5edd9a490a6944caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Ij.dBgOnhsig49QFiyO9zP_i7Xd5qRxO
via: 1.1 varnish, 1.1 varnish
etag: "67626f2bff9197ea72a2c63a57d4fb01"
age: 1938317
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 1813
x-amz-id-2: fFeFSjHmA33bRjI9yGa13aRDXXcVtvYhyphLEeuO39404bvgLnQxxmiU3AwEzcYXrgl9mvjd5cc=
x-served-by: cache-sea4475-SEA, cache-hhn4056-HHN
last-modified: Wed, 02 Sep 2020 23:07:21 GMT
server: AmazonS3
x-timer: S1601057429.457856,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 6A0E7139E688C1FE
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/jpeg
x-cache-hits: 25, 30

GET
H2 200 ad_choices-62a535e263.png
assets.bwbx.io/s3/bbnav/public/images/ 1 KB
1 KB 56ms
52ms Image
image/png 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/s3/bbnav/public/images/ad_choices-62a535e263.png

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/bbnav/public/stylesheets/bb-global-footer-76035a1f00.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

ddba334df6c664a031ca10a932ea32be4a846953dcdf1cb93014f6b6bf42640f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://assets.bwbx.io/s3/bbnav/public/stylesheets/bb-global-footer-76035a1f00.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: kq6bcumbdrNq_v.VLPw1kCZboA5r7Z6L
via: 1.1 varnish, 1.1 varnish
etag: "62a535e263d490723717c46ae1bd8e88"
age: 1932790
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 1225
x-amz-id-2: 5rUqoYUwXJcqr4uxMRURCYI9pycrOOHawiRMw9gJPAmRiVDcHs4zbHaXC3DRCjv2+01gQ1ghcu8=
x-served-by: cache-sea4438-SEA, cache-hhn4056-HHN
last-modified: Thu, 27 Aug 2020 18:00:11 GMT
server: AmazonS3
x-timer: S1601057429.457827,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 420914BD9BBA475B
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: image/png
x-cache-hits: 20454, 2236

OPTIONS
H2 200 native-message
sourcepointcmp.bloomberg.com/wrapper/tcfv2/v1/gdpr/ Frame 0
0 124ms
80ms Other
text/html 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/wrapper/tcfv2/v1/gdpr/native-message?requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&hasCsp=true&env=prod&consentLanguage=browserDefault
Protocol: H2
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.bloomberg.com
Sec-Fetch-Mode: cors

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 4
date: Fri, 25 Sep 2020 18:10:29 GMT
x-powered-by: Express
access-control-allow-origin: https://www.bloomberg.com
access-control-allow-credentials: true
access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,SP_SCRIPT_VERSION
access-control-allow-methods: GET, PUT, POST, DELETE
cache-control: no-cache
allow: POST
etag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
x-cache: Miss from cloudfront
via: 1.1 315b8dfb52e5c49bd834510b0301e939.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: SyqBnJXjSa9VdOas3C0kwCqku-9lnnKliF4oAnAEeQiJ1Lx4eiaofQ==

POST
H2 200 native-message Show response
sourcepointcmp.bloomberg.com/wrapper/tcfv2/v1/gdpr/ 42 KB
43 KB 192ms
147ms XHR
application/json 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/wrapper/tcfv2/v1/gdpr/native-message?requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&hasCsp=true&env=prod&consentLanguage=browserDefault
Requested by: Host: cdn.privacy-mgmt.com
URL: https://cdn.privacy-mgmt.com/wrapperMessagingWithoutDetection.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: / Express
Resource Hash: 83359cd4f0c8219d1ace2ea58c6702f1cd81b30b1462ad3b08524dcfab326ba0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
via: 1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-powered-by: Express
x-cache: Miss from cloudfront
status: 200
content-length: 43283
etag: W/"a913-Zv9RSpKOtLgKAy1mAGZKwZO1T6k"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bloomberg.com
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, SP_SCRIPT_VERSION
x-amz-cf-id: LhxhxUnHVy2q56c3UrdYakiB0bl7LXjuUG1D35S_-INIVVbljFTPIg==

GET
H/1.1 200
OK user-info Show response
login.bloomberg.com/ 201 B
5 KB 454ms
120ms Script
text/javascript 69.187.26.120
BLOOMBERG-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.bloomberg.com/user-info?callback=__jp0

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

69.187.26.120 , United States, ASN10361 (BLOOMBERG-NET, US),

Reverse DNS

Software

Resource Hash

af09e9d58676a69832a301f1b365e0edfbf5e67ec7ec1f83d76ca1673f5377ed

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'; default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.bwbx.io img.en25.com https://s522772699.t.eloqua.com www.googletagmanager.com tagmanager.google.com www.google-analytics.com ssl.google-analytics.com www.google.com www.gstatic.com www.googleadservices.com googleads.g.doubleclick.net js-agent.newrelic.com bam.nr-data.net .optimizely.com optimizely.s3.amazonaws.com cdn-assets-prod.s3.amazonaws.com www.paypal.com client.perimeterx.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com a2.adform.net s2.adform.net bat.bing.com connect.facebook.net app.keywee.co cdn.keywee.co dc.ads.linkedin.com .liadm.com snap.licdn.com amplify.outbrain.com q.quora.com a.quora.com www.redditstatic.com sc-static.net platform.twitter.com static.ads-twitter.com analytics.twitter.com s.yimg.com sp.analytics.yahoo.com; style-src 'unsafe-inline' 'self' https://assets.bwbx.io tagmanager.google.com fonts.googleapis.com; font-src 'self' https://assets.bwbx.io fonts.gstatic.com data:; connect-src 'self' https://login.bloomberg.com https://www.bloomberg.com/javelin/api/abba/reg location.bloomberg.com personalization.bloomberg.com .api.edq.com api.edq.com www.google-analytics.com bam.nr-data.net logx.optimizely.com .optimizely.com www.paypal.com .perimeterx.net .px-cloud.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com dc.ads.linkedin.com .liadm.com snap.licdn.com s.yimg.com; img-src www.googletagmanager.com ssl.gstatic.com www.gstatic.com www.google-analytics.com googleads.g.doubleclick.net www.google.com cdn.optimizely.com data:; frame-src img.en25.com https://s522772699.t.eloqua.com www.google.com bid.g.doubleclick.net .fls.doubleclick.net app.optimizely.com a4368606971.cdn.optimizely.com www.sandbox.paypal.com www.paypal.com js.stripe.com www.facebook.com dc.ads.linkedin.com .liadm.com snap.licdn.com tr.snapchat.com data:
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Content-Type-Options: nosniff
ETag: W/"c9-Ga9KPplutnfxXjMEKVKGBQ"
Vary: Origin
Content-Type: text/javascript; charset=utf-8
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'none'; default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.bwbx.io img.en25.com https://s522772699.t.eloqua.com www.googletagmanager.com tagmanager.google.com www.google-analytics.com ssl.google-analytics.com www.google.com www.gstatic.com www.googleadservices.com googleads.g.doubleclick.net js-agent.newrelic.com bam.nr-data.net *.optimizely.com optimizely.s3.amazonaws.com cdn-assets-prod.s3.amazonaws.com www.paypal.com client.perimeterx.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com a2.adform.net s2.adform.net bat.bing.com connect.facebook.net app.keywee.co cdn.keywee.co dc.ads.linkedin.com *.liadm.com snap.licdn.com amplify.outbrain.com q.quora.com a.quora.com www.redditstatic.com sc-static.net platform.twitter.com static.ads-twitter.com analytics.twitter.com s.yimg.com sp.analytics.yahoo.com; style-src 'unsafe-inline' 'self' https://assets.bwbx.io tagmanager.google.com fonts.googleapis.com; font-src 'self' https://assets.bwbx.io fonts.gstatic.com data:; connect-src 'self' https://login.bloomberg.com https://www.bloomberg.com/javelin/api/abba/reg location.bloomberg.com personalization.bloomberg.com *.api.edq.com api.edq.com www.google-analytics.com bam.nr-data.net logx.optimizely.com *.optimizely.com www.paypal.com *.perimeterx.net *.px-cloud.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com dc.ads.linkedin.com *.liadm.com snap.licdn.com s.yimg.com; img-src * www.googletagmanager.com ssl.gstatic.com www.gstatic.com www.google-analytics.com googleads.g.doubleclick.net www.google.com cdn.optimizely.com data:; frame-src img.en25.com https://s522772699.t.eloqua.com www.google.com bid.g.doubleclick.net *.fls.doubleclick.net app.optimizely.com a4368606971.cdn.optimizely.com www.sandbox.paypal.com www.paypal.com js.stripe.com www.facebook.com dc.ads.linkedin.com *.liadm.com snap.licdn.com tr.snapchat.com data:
Content-Length: 201
Date: Fri, 25 Sep 2020 18:10:29 GMT
Expires: -1

GET
H2 200 breaking-news-app-94695c75d3db48de1996.js Show response
assets.bwbx.io/s3/navi/js/ 2 KB
1 KB 31ms
30ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/navi/js/breaking-news-app-94695c75d3db48de1996.js

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

268b144023aa4864bac4de593bb2f744153d90041623327d90d74adf73ee9221

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: NJh3Jn4dN.pnIP0IwZ.qzpvbgqqUKjvx
content-encoding: gzip
etag: "3c8e926e81ebf85090963d08188baea3"
age: 4306838
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 894
x-amz-id-2: rbas98OIWI61pjL4jnxfsOXg6FidrjuLas0f/ChEzWjE8q7OJCtSeVu7KxBKbtuIo2RkQPiYiKs=
x-served-by: cache-sea4460-SEA, cache-hhn4056-HHN
last-modified: Thu, 06 Aug 2020 21:47:46 GMT
server: AmazonS3
x-timer: S1601057430.547223,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 0CA60FFA9579B527
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 9209, 155

GET
H2 200 get_site_data Show response
sourcepointcmp.bloomberg.com/mms/ 19 B
409 B 35ms
34ms XHR
text/plain 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/mms/get_site_data?requestUUID=b54c5847-5f7c-46db-b90f-4240f92814e7&account_id=1425&href=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive
Requested by: Host: ccpa.sp-prod.net
URL: https://ccpa.sp-prod.net/ccpa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: Jetty(9.4.2.v20170220) /
Resource Hash: 8457010484c1c7b66831720c0a9ad0387464f1fa5eb525602fe2981530c84923

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
via: 1.1 315b8dfb52e5c49bd834510b0301e939.cloudfront.net (CloudFront)
x-sp-mms-node: mms-ayc.node.fra.consul
server: Jetty(9.4.2.v20170220)
x-amz-cf-pop: VIE50-C1
status: 200
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://www.bloomberg.com
cache-control: max-age=2592000
access-control-allow-credentials: true
x-cache: Miss from cloudfront
x-amz-cf-id: hLskj9LgF30DdhSqwda7MglcdZe_HBplczDK9nFrVnUWtwmfNBa7dw==

GET
H/1.1 200
OK alerts Show response
www.bloomberg.com/tophat/api/ 13 B
934 B 81ms
80ms XHR
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/tophat/api/alerts?site=bcom

Requested by

Host: www.bloomberg.com
URL: https://www.bloomberg.com/tophat/assets/v2.5.1/that.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f43c62200c7815091a6fe618461fbcb6ffd38e0f8ff7aaa9ee863ab0f5d47092

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' http: https: data: blob: wss: 'unsafe-inline' 'unsafe-eval', upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: default-src 'self' http: https: data: blob: wss: 'unsafe-inline' 'unsafe-eval', upgrade-insecure-requests
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Access-Control-Allow-Methods: GET, OPTIONS
Connection: keep-alive
Content-Length: 33
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
X-Frame-Options: SAMEORIGIN
Date: Fri, 25 Sep 2020 18:10:29 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; preload
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=807, s-maxage=1800
Access-Control-Allow-Headers: origin, content-type, accept
Expires: Fri, 25 Sep 2020 18:23:56 GMT

POST collector
collector-px8fcgygk4.px-cloud.net/api/v1/ 0
0

GET
H/1.1 200
OK prebid.js Show response
www.bloomberg.com/ads/scripts/ 209 KB
65 KB 159ms
158ms Script
application/javascript 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/ads/scripts/prebid.js
Requested by: Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/initialize/initialize_sparkle-e986310fe9.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 234c5911c544c5bc6215f14db6cf3fe713a3f97224b7e017ee07acf32fe2e4df

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:49:55 GMT
Server: nginx
ETag: "5f6e0393-344e8"
Vary: Accept-Encoding
Content-Type: application/javascript, application/javascript; charset=utf-8
Cache-Control: public, max-age=5
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 66536
Expires: Fri, 25 Sep 2020 18:10:34 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 53 KB
18 KB 119ms
44ms Script
text/javascript 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/initialize/initialize_sparkle-e986310fe9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

sffe /

Resource Hash

dc932022746959d6f8979f0dcb53ad638c72b60c4c7d693441ca8780171c6f1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "644 / 688 of 1000 / last-modified: 1601053527"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17837
x-xss-protection: 0
expires: Fri, 25 Sep 2020 18:10:29 GMT

GET
H/1.1 200
OK targets Show response
www.bloomberg.com/trigrservice/ 286 B
659 B 69ms
32ms XHR
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/trigrservice/targets

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/initialize/initialize_sparkle-e986310fe9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

755a8a0995741b1336a05aa1025d57596dda66417f3a70caed1765e7f86c1c62

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime: 0.001864
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Server: nginx
ETag: W/"755a8a0995741b1336a05aa1025d5759"
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30
Date: Fri, 25 Sep 2020 18:10:29 GMT
Connection: keep-alive
Content-Length: 184
X-Request-Id: 01F80614-5F6E31FA-2EC9389
Expires: Fri, 25 Sep 2020 18:10:59 GMT

GET
H2 200 message_url Show response
sourcepointcmp.bloomberg.com/mms/v2/ 0
1 KB 72ms
72ms XHR
application/json 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/mms/v2/message_url?requestUUID=b54c5847-5f7c-46db-b90f-4240f92814e7&account_id=1425&abp=false&href=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&consentUUID=undefined&loadedData=%5B%7B%22id%22%3A%22CONSENT%3Aendpoint%3Ahttps%3A%2F%2Fsourcepointcmp.bloomberg.com%3A9964%22%2C%22result%22%3A%22%7B%5C%22hasConsentData%5C%22%3Afalse%2C%5C%22consentedToAny%5C%22%3Afalse%2C%5C%22consentedToAll%5C%22%3Afalse%2C%5C%22rejectedAny%5C%22%3Afalse%7D%22%7D%5D&stage_campaign=false&cookie=%5B%5D&t[type]=CCPA
Requested by: Host: ccpa.sp-prod.net
URL: https://ccpa.sp-prod.net/ccpa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: Jetty(9.4.2.v20170220) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
via: 1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)
x-sp-mms-node: mms-at2.node.fra.consul
x-amz-cf-pop: VIE50-C1
x-cache: Miss from cloudfront
status: 200
x-sp-mms-env: 1
content-length: 0
pragma: no-cache
server: Jetty(9.4.2.v20170220)
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://www.bloomberg.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-amz-cf-id: AJMiHaF5P8NlQGZyrNLYQ5WBpRZDUNdmmzRDVt9HOHNXlDXAV96R4w==
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK global Show response
www.bloomberg.com/navi/api/v1/breaking-news/ 47 B
699 B 370ms
350ms Fetch
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/navi/api/v1/breaking-news/global

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

750c01314d6d8774ba04e0dbafbf74442e4d184837460b385aa18ff1e5c84366

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: upgrade-insecure-requests
Server: nginx
ETag: W/"2f-56oyTqHRYBfPUNwFuZfroR8S/RU"
Vary: Origin
Content-Type: application/json; charset=utf-8
Cache-Control: public, max-age=0, s-maxage=60
Date: Fri, 25 Sep 2020 18:10:30 GMT
Connection: keep-alive
Content-Length: 47
Expires: Fri, 25 Sep 2020 18:10:30 GMT

GET
H/1.1

200
OK

europe Show response
www.bloomberg.com/navi/api/v1/breaking-news/
Redirect Chain

https://www.bloomberg.com/navi/api/v1/breaking-news/regional
https://www.bloomberg.com/navi/api/v1/breaking-news/europe

10 KB
4 KB

484ms
484ms

Fetch
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/navi/api/v1/breaking-news/europe
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 977f5884716a9c1d7508f4d90807fca2f828dd3450840012b1a7d0c56dd27990

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 18:10:30 GMT
Content-Encoding: gzip
Server: AkamaiNetStorage
ETag: "4bf7f0bc6938599bd3f18844de003c31:1573675338.817136"
Vary: Accept-Encoding
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 3997
Expires: Fri, 25 Sep 2020 18:10:30 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: nginx
Date: Fri, 25 Sep 2020 18:10:29 GMT
Content-Type: text/html
Location: https://www.bloomberg.com/navi/api/v1/breaking-news/europe
Cache-Control: public, max-age=0, s-maxage=120
Connection: keep-alive
Content-Length: 154
Expires: Fri, 25 Sep 2020 18:10:29 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 118ms
44ms Script
text/javascript 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MNTH5N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11311
x-xss-protection: 0
server: cafe
etag: 12833363978352728442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 25 Sep 2020 18:10:29 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 90ms
29ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
age: 74288
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4068-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1601057430.844590,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2

200

trackpoint-async.js Show response
s2.adform.net/banners/scripts/st/
Redirect Chain

https://a2.adform.net/serving/scripts/trackpoint/async/
https://s2.adform.net/banners/scripts/st/trackpoint-async.js

80 KB
28 KB

160ms
54ms

Script
application/x-javascript

37.157.2.244
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.244 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 89334ba86873baccdb8c2b5ea18ed21cd75e480aae4d494bb276564f4879d488

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
last-modified: Thu, 27 Aug 2020 13:14:49 GMT
server: nginx
etag: W/"5f47b1c9-14076"
x-cache-status: HIT
status: 200
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

Redirect headers

status: 301
date: Fri, 25 Sep 2020 18:10:30 GMT
server: nginx
location: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 51ms
16ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 17:33:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2218
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
x-amz-request-id: 86FABC693DA47021
x-amz-id-2: dAAn3ozs4ukTDjbpn0y0R0xo1bhwZMYqD7lxA2zeppgUfoxkIBIzcNeaVUcR8qb/xa4erYhkEvU=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 30 Oct 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 24 Sep 2020 23:08:16 GMT
server: ATS
etag: "49db10c8315384e8dad2e92a6841ed81-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-version-id: swANRqp_TdPZf97XDKuCKoVnrp7c.h.0
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 5581
content-type: application/javascript

GET
H2 200 bat.js Show response
bat.bing.com/ 26 KB
8 KB 41ms
28ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref: Ref A: 9130606AB9C048FAA2E16F0C469B73BE Ref B: FRAEDGE1213 Ref C: 2020-09-25T18:10:29Z
status: 200
etag: "0e0bdafab5bd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8022

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:29 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=74443
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H2

200

s Show response
ads.avct.cloud/
Redirect Chain

https://ads.avocet.io/s?add=5adf6ad75f7614a66abb437a&ty=j
https://ads.avct.cloud/s?r=1&add=5adf6ad75f7614a66abb437a&ty=j
https://ads.avct.cloud/s?bounce=true&r=1&add=5adf6ad75f7614a66abb437a&ty=j

0
336 B

58ms
58ms

Script
application/javascript

34.240.2.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.avct.cloud/s?bounce=true&r=1&add=5adf6ad75f7614a66abb437a&ty=j
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 34.240.2.137 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-2-137.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 18:10:30 GMT
p3p: policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
content-type: application/javascript

Redirect headers

status: 302
date: Fri, 25 Sep 2020 18:10:30 GMT
p3p: policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 87
location: /s?bounce=true&r=1&add=5adf6ad75f7614a66abb437a&ty=j
content-type: text/html; charset=utf-8

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1194877/ 61 KB
21 KB 30ms
30ms Script
application/javascript 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1194877/tfa.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 753e77748eeda3818828e822ec2da8a4a1839216ed64069e782694953c491f52

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Q9.jwV6QnPTtZca.qovsqZK44kmInJs0
content-encoding: gzip
etag: "1e055e0bbfe237d3069a4cad5f509bdb"
age: 111
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 21099
x-amz-id-2: jYr5kgdoVpLop6KTX72Ghorn8agVw3lHpVt29OUVCdq2uvEvMUvUGOIG2iOoWzxrGXm54/KY8OA=
x-served-by: cache-hhn4079-HHN
last-modified: Tue, 18 Aug 2020 07:42:10 GMT
server: AmazonS3
x-timer: S1601057430.798564,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
vary: Accept-Encoding
x-amz-request-id: 4T3G1SDPDZ5XFV0W
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 8
x-cache-hits: 4

GET
H2 200 spritz.mjs Show response
assets.bwbx.io/s3/spritz/v1.0.0/ 3 KB
4 KB 31ms
30ms Script
binary/octet-stream 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/spritz/v1.0.0/spritz.mjs

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6e9b581e90a0da254f7fb65d5e442e40236939da6cbb08adee4d3bf6a92a7eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
via: 1.1 varnish, 1.1 varnish
etag: "9f1762f82eb5b75628df3b784cc62eb0"
age: 3060786
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 3523
x-amz-id-2: XlBSnQPugTN3HBtToSyScENvnH4Bu+lqEY2SE6i+TB/oQaP2P+eFwfqioUmIbZp7RbOQKb0diW4=
x-served-by: cache-sea4452-SEA, cache-hhn4056-HHN
last-modified: Fri, 07 Feb 2020 18:59:33 GMT
server: AmazonS3
x-timer: S1601057430.788866,VS0,VE0
date: Fri, 25 Sep 2020 18:10:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 7K7SAR7Y3Z2W7HFG
cache-control: max-age=31536000
accept-ranges: bytes
content-type: binary/octet-stream
x-cache-hits: 10486, 2823

GET
H2 200 bplayer.js Show response
cdn.gotraffic.net/projector/latest/ 326 KB
85 KB 135ms
39ms Script
application/javascript 151.101.129.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gotraffic.net/projector/latest/bplayer.js
Requested by: Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/javelin/public/javelin/js/components/mini_player/mini_player-054ea9a219.desktop.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.73 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 955ff6deae76e97682fc7214a3e76bf691eb83171e7c0f487b5e8589dbc061a2

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
content-encoding: gzip
age: 461
via: 1.1 varnish
x-cache: HIT
status: 200
fastly-restarts: 1
x-amz-id-2: pUpgO17ypbU9+/vDr3lyPyCykz4d+mSE16SBuypBuwuLniuYE3sATjmb1qCoEGvrx2HiBc5PWxE=
x-served-by: cache-cdg20732-CDG
accept-ranges: bytes
last-modified: Tue, 22 Sep 2020 20:17:48 GMT
server: AmazonS3
x-timer: S1601057430.899042,VS0,VE0
etag: "f42368498d218ebb7dab03c5d5deb13f"
vary: Accept-Encoding
x-amz-request-id: 94E52637C6B6C200
access-control-allow-origin: *
cache-control: max-age=900
content-length: 87087
content-type: application/javascript
x-cache-hits: 19

GET
H2 200 1000x-1.jpg
assets.bwbx.io/images/users/iqjWHBFdfxIU/ieVzMbEanwh4/v1/ 54 KB
55 KB 32ms
32ms Image
image/jpeg 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.bwbx.io/images/users/iqjWHBFdfxIU/ieVzMbEanwh4/v1/1000x-1.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx/1.13.12 /

Resource Hash

5de76dcf29d7f9b70473a6388dc3b898a6e57bf70c3d126eb2b0cd7b4cdac9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:29 GMT
via: 1.1 varnish, 1.1 varnish
age: 767977
x-cache-status: MISS
x-cache: HIT, HIT
status: 200
edge-control: !no-store,max-age=365d
content-length: 55685
x-served-by: cache-lga21946-LGA, cache-hhn4056-HHN
server: nginx/1.13.12
x-timer: S1601057430.808321,VS0,VE1
etag: "04e01a4a3b26cf277aeffaff21562f76a"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

OPTIONS
H/1.1 200
OK rate-plan-info
login.bloomberg.com/api/referrals/Hhue1scO/ Frame 0
0 360ms
126ms Other 69.187.26.120
BLOOMBERG-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.bloomberg.com/api/referrals/Hhue1scO/rate-plan-info

Protocol

HTTP/1.1

Server

69.187.26.120 , United States, ASN10361 (BLOOMBERG-NET, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type,x-csrf-token
Origin: https://www.bloomberg.com
Sec-Fetch-Mode: cors

Response headers

Strict-Transport-Security: max-age=15552000; includeSubDomains
Cache-Control: no-cache, no-store
Pragma: no-cache
Expires: -1
Access-Control-Allow-Origin: https://www.bloomberg.com
Vary: Origin, Access-Control-Request-Headers
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Headers: content-type,x-csrf-token
Content-Length: 0
Date: Fri, 25 Sep 2020 18:10:30 GMT

GET
H/1.1 200
OK rate-plan-info Show response
login.bloomberg.com/api/referrals/Hhue1scO/ 451 B
5 KB 227ms
226ms Fetch
application/json 69.187.26.120
BLOOMBERG-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.bloomberg.com/api/referrals/Hhue1scO/rate-plan-info

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/fence/v4/app.bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

69.187.26.120 , United States, ASN10361 (BLOOMBERG-NET, US),

Reverse DNS

Software

Resource Hash

00f82b8ec44397dad10fa2060f4cbdf69f1086320fadcdf0b7e6b370cde03c9b

Security Headers

Name

Value

Content-Security-Policy

frame-ancestors 'none'; default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.bwbx.io img.en25.com https://s522772699.t.eloqua.com www.googletagmanager.com tagmanager.google.com www.google-analytics.com ssl.google-analytics.com www.google.com www.gstatic.com www.googleadservices.com googleads.g.doubleclick.net js-agent.newrelic.com bam.nr-data.net *.optimizely.com optimizely.s3.amazonaws.com cdn-assets-prod.s3.amazonaws.com www.paypal.com client.perimeterx.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com a2.adform.net s2.adform.net bat.bing.com connect.facebook.net app.keywee.co cdn.keywee.co dc.ads.linkedin.com *.liadm.com snap.licdn.com amplify.outbrain.com q.quora.com a.quora.com www.redditstatic.com sc-static.net platform.twitter.com static.ads-twitter.com analytics.twitter.com s.yimg.com sp.analytics.yahoo.com; style-src 'unsafe-inline' 'self' https://assets.bwbx.io tagmanager.google.com fonts.googleapis.com; font-src 'self' https://assets.bwbx.io fonts.gstatic.com data:; connect-src 'self' https://login.bloomberg.com https://www.bloomberg.com/javelin/api/abba/reg location.bloomberg.com personalization.bloomberg.com *.api.edq.com api.edq.com www.google-analytics.com bam.nr-data.net logx.optimizely.com *.optimizely.com www.paypal.com *.perimeterx.net *.px-cloud.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com dc.ads.linkedin.com *.liadm.com snap.licdn.com s.yimg.com; img-src * www.googletagmanager.com ssl.gstatic.com www.gstatic.com www.google-analytics.com googleads.g.doubleclick.net www.google.com cdn.optimizely.com data:; frame-src img.en25.com https://s522772699.t.eloqua.com www.google.com bid.g.doubleclick.net *.fls.doubleclick.net app.optimizely.com a4368606971.cdn.optimizely.com www.sandbox.paypal.com www.paypal.com js.stripe.com www.facebook.com dc.ads.linkedin.com *.liadm.com snap.licdn.com tr.snapchat.com data:

Strict-Transport-Security

max-age=15552000; includeSubDomains

Request headers

Accept: application/json
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
x-csrf-token: undefined
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=15552000; includeSubDomains
ETag: W/"1c3-zxW/KEgP+CiwxjF6TlPIkg"
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bloomberg.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'none'; default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.bwbx.io img.en25.com https://s522772699.t.eloqua.com www.googletagmanager.com tagmanager.google.com www.google-analytics.com ssl.google-analytics.com www.google.com www.gstatic.com www.googleadservices.com googleads.g.doubleclick.net js-agent.newrelic.com bam.nr-data.net *.optimizely.com optimizely.s3.amazonaws.com cdn-assets-prod.s3.amazonaws.com www.paypal.com client.perimeterx.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com a2.adform.net s2.adform.net bat.bing.com connect.facebook.net app.keywee.co cdn.keywee.co dc.ads.linkedin.com *.liadm.com snap.licdn.com amplify.outbrain.com q.quora.com a.quora.com www.redditstatic.com sc-static.net platform.twitter.com static.ads-twitter.com analytics.twitter.com s.yimg.com sp.analytics.yahoo.com; style-src 'unsafe-inline' 'self' https://assets.bwbx.io tagmanager.google.com fonts.googleapis.com; font-src 'self' https://assets.bwbx.io fonts.gstatic.com data:; connect-src 'self' https://login.bloomberg.com https://www.bloomberg.com/javelin/api/abba/reg location.bloomberg.com personalization.bloomberg.com *.api.edq.com api.edq.com www.google-analytics.com bam.nr-data.net logx.optimizely.com *.optimizely.com www.paypal.com *.perimeterx.net *.px-cloud.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com dc.ads.linkedin.com *.liadm.com snap.licdn.com s.yimg.com; img-src * www.googletagmanager.com ssl.gstatic.com www.gstatic.com www.google-analytics.com googleads.g.doubleclick.net www.google.com cdn.optimizely.com data:; frame-src img.en25.com https://s522772699.t.eloqua.com www.google.com bid.g.doubleclick.net *.fls.doubleclick.net app.optimizely.com a4368606971.cdn.optimizely.com www.sandbox.paypal.com www.paypal.com js.stripe.com www.facebook.com dc.ads.linkedin.com *.liadm.com snap.licdn.com tr.snapchat.com data:
Content-Length: 451
Date: Fri, 25 Sep 2020 18:10:30 GMT
Expires: -1

OPTIONS
H2 200 display-dns
sourcepointcmp.bloomberg.com/ccpa/consent/9964/ Frame 0
0 349ms
349ms Other
text/html 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/ccpa/consent/9964/display-dns?requestUUID=b54c5847-5f7c-46db-b90f-4240f92814e7
Protocol: H2
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.bloomberg.com
Sec-Fetch-Mode: cors

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 4
date: Fri, 25 Sep 2020 18:10:30 GMT
access-control-allow-origin: https://www.bloomberg.com
access-control-allow-credentials: true
access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE
cache-control: no-cache
allow: POST
x-cache: Miss from cloudfront
via: 1.1 315b8dfb52e5c49bd834510b0301e939.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: Qn9xUDDpztg6HJ0IJ2jbNy5Yk5x8W_aVNsL9slUKjZY1VLSJ7UDFeg==

POST
H2 200 display-dns Show response
sourcepointcmp.bloomberg.com/ccpa/consent/9964/ 567 B
1002 B 183ms
182ms XHR
application/json 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/ccpa/consent/9964/display-dns?requestUUID=b54c5847-5f7c-46db-b90f-4240f92814e7
Requested by: Host: ccpa.sp-prod.net
URL: https://ccpa.sp-prod.net/ccpa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: /
Resource Hash: 31c7c8bbc637de46572e374a6a6d4f1119dcfbdba7a8524952da22766042a63f

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
via: 1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
status: 200
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bloomberg.com
cache-control: no-cache
access-control-allow-credentials: true
x-cache: Miss from cloudfront
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length: 567
x-amz-cf-id: VYdjOyrWzbQAOtzYmDUw1xdCGY-Z1y4tGlPzfScBpiWtesAn-u4Meg==

GET
H2 200 index.html Show response
sourcepointcmp.bloomberg.com/ Frame BBF0 4 KB
2 KB 27ms
26ms Document
text/html 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
Requested by: Host: cdn.privacy-mgmt.com
URL: https://cdn.privacy-mgmt.com/wrapperMessagingWithoutDetection.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4a7a7a7ea181235c8976b8026775fe5589ee7bd2204d3d1207284f56dfe19fc2

Request headers

:method: GET
:authority: sourcepointcmp.bloomberg.com
:scheme: https
:path: /index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: _sp_v1_uid=1:909:d96733f9-2363-438d-b86c-378ac8892664; _sp_v1_data=2:197212:1601057429:0:1:0:1:0:0:b0d7d095-805b-4c51-a4de-e26d5e615674:-1; _sp_v1_ss=1:H4sIAAAAAAAAAItWqo5RKimOUbKKxmDklebk6MQopSKxS8AS1bW1sSRLKOlgWkWWDUqxAPK1Ytu1AAAA; _sp_v1_opt=1:; _sp_v1_consent=1!-1:-1:-1:-1; _sp_v1_csv=null; _sp_v1_lt=1:; _gcl_au=1.1.498437788.1601057430; _reg-csrf=s%3A7JkMQmtwbIJ0_XzfvifNFlcP.A8B1CGA5dmbGWUKSK1CoJpjXySJTlM0DupPyrdPe99g; _reg-csrf-token=catZMQQG-pjkLY6jk3blOtUXsZFjr58e-qKA; agent_id=450fd463-4589-41d2-87e0-ed704f7da749; session_id=033aa840-f145-486c-9f5a-cd9463a30ace; session_key=abec322c82e4331a31f0c18a390f78e099724b94; _user-status=anonymous; _sp_krux=false
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive

Response headers

status: 200
content-type: text/html
date: Fri, 25 Sep 2020 17:14:17 GMT
last-modified: Thu, 10 Sep 2020 23:46:04 GMT
etag: W/"05aaabceb2d130ddd9c70e290012646d"
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: d56fBNqLZUJXLSN5w6nNx3FUe5VHEWB7H8ZQQfrHz3HicgrMw9Ix2Q==
age: 3373

GET
H/1.1 200
OK insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:30 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Sep 2020 20:29:41 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=83049
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H3-Q050 200 pubads_impl_2020091601.js Show response
securepubads.g.doubleclick.net/gpt/ 263 KB
93 KB 91ms
50ms Script
text/javascript 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

sffe /

Resource Hash

3be81ab15cc2905d3ef54418cd0fa664e85d19c4a5550e28b071a39bd1316070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Sep 2020 08:40:34 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 94378
x-xss-protection: 0
expires: Fri, 25 Sep 2020 18:10:30 GMT

GET
H/1.1 200
OK 184795-45553530326378.js Show response
js-sec.indexww.com/ht/p/ 115 KB
33 KB 805ms
731ms Script
text/javascript 95.100.197.53
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/184795-45553530326378.js
Requested by: Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/spritz/v1.0.0/spritz.mjs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.197.53 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b4fe07cf9acd45fcb108002a389f098cd514117ccac6f92113d3896a441bf534

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:30 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 18:06:45 GMT
Server: Apache
ETag: "da4a9d-1cbcd-5b0272dfea890"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3547
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 33048
Expires: Fri, 25 Sep 2020 19:09:37 GMT

GET
H2 204 0
bat.bing.com/action/ 0
148 B 29ms
28ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5820275&Ver=2&mid=50c4547f-fcdd-1986-cbf5-85e4042e0952&sid=7985d2d275d4a30a27a3cd29cce16f4e&vid=718fe39887d88aaef8dd1030b02776d2&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&kw=CITIGROUP%20INC,Federal%20Bureau%20of%20Investigation,New%20Jersey,Apps,Artificial%20Intelligence,Government,Donald%20John%20Trump,Politics,Finance,Americas,business,politics&p=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&r=&lt=1573&evt=pageLoad&msclkid=N&sv=1&rn=238982
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 25 Sep 2020 18:10:29 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 8310E1342BD2433EBA0BB7D8C5135896 Ref B: FRAEDGE1213 Ref C: 2020-09-25T18:10:30Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5820275&Ver=2&mid=50c4547f-fcdd-1986-cbf5-85e4042e0952&sid=7985d2d275d4a30a27a3cd29cce16f4e&vid=718fe39887d88aaef8dd1030b02776d2&vids=0&ec=metering&ea=impression&el=pay-meter&evt=custom&msclkid=N&rn=107145
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 25 Sep 2020 18:10:29 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 9E276BDCBEAC4D63AAD3C9AEA5253A96 Ref B: FRAEDGE1213 Ref C: 2020-09-25T18:10:30Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10048438.json Show response
s.yimg.com/wi/config/ 2 B
458 B 56ms
20ms XHR
application/json 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10048438.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 17:21:21 GMT
x-content-type-options: nosniff
age: 2949
status: 200
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: 2E787FA97EAF375E
x-amz-id-2: xSTjb/MqA3CuE15CzWGWxlGKSIa1qj7cFoIRvwGpVRymaI+YZhsn4roBlgu7mv6njlh82pWR2f4=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 data.json Show response
assets.bwbx.io/s3/mediaservices/superelastic/ 78 KB
24 KB 33ms
33ms Fetch
binary/octet-stream 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/mediaservices/superelastic/data.json

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/byzantium/v5/ms.byzantium-core.bundle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

b163d7405b86fc249da09ecae8c8a5a834ae5f1eb05a3cf188a8e7ae47299e1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: m0_BfTf8kcu2Is75cGALmHJ4sk_YoqZV
content-encoding: gzip
etag: "658ed41a61117d578082187091825310"
age: 488
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 23781
x-amz-id-2: 3CY5uLxRrdUgGcOGHHkV4gqsalfr3o9G7NkhXiEqSUO4FW6Y9kpS+TlMbo8HKdhHbSwEJzJkDNI=
x-served-by: cache-sea4463-SEA, cache-hhn4066-HHN
access-control-allow-origin: *
last-modified: Fri, 25 Sep 2020 14:27:16 GMT
server: AmazonS3
x-timer: S1601057430.118698,VS0,VE0
date: Fri, 25 Sep 2020 18:10:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, HEAD
x-amz-request-id: F3533AB19D3903E6
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-type: binary/octet-stream
x-cache-hits: 18, 2

GET
H/1.1 200
OK user-info
login.bloomberg.com/ 203 B
0 111ms
110ms Fetch
text/javascript 69.187.26.120
BLOOMBERG-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.bloomberg.com/user-info?callback=unused&withSubscriberData=true

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/fence/v4/app.bundle.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

69.187.26.120 , United States, ASN10361 (BLOOMBERG-NET, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'; default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.bwbx.io img.en25.com https://s522772699.t.eloqua.com www.googletagmanager.com tagmanager.google.com www.google-analytics.com ssl.google-analytics.com www.google.com www.gstatic.com www.googleadservices.com googleads.g.doubleclick.net js-agent.newrelic.com bam.nr-data.net .optimizely.com optimizely.s3.amazonaws.com cdn-assets-prod.s3.amazonaws.com www.paypal.com client.perimeterx.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com a2.adform.net s2.adform.net bat.bing.com connect.facebook.net app.keywee.co cdn.keywee.co dc.ads.linkedin.com .liadm.com snap.licdn.com amplify.outbrain.com q.quora.com a.quora.com www.redditstatic.com sc-static.net platform.twitter.com static.ads-twitter.com analytics.twitter.com s.yimg.com sp.analytics.yahoo.com; style-src 'unsafe-inline' 'self' https://assets.bwbx.io tagmanager.google.com fonts.googleapis.com; font-src 'self' https://assets.bwbx.io fonts.gstatic.com data:; connect-src 'self' https://login.bloomberg.com https://www.bloomberg.com/javelin/api/abba/reg location.bloomberg.com personalization.bloomberg.com .api.edq.com api.edq.com www.google-analytics.com bam.nr-data.net logx.optimizely.com .optimizely.com www.paypal.com .perimeterx.net .px-cloud.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com dc.ads.linkedin.com .liadm.com snap.licdn.com s.yimg.com; img-src www.googletagmanager.com ssl.gstatic.com www.gstatic.com www.google-analytics.com googleads.g.doubleclick.net www.google.com cdn.optimizely.com data:; frame-src img.en25.com https://s522772699.t.eloqua.com www.google.com bid.g.doubleclick.net .fls.doubleclick.net app.optimizely.com a4368606971.cdn.optimizely.com www.sandbox.paypal.com www.paypal.com js.stripe.com www.facebook.com dc.ads.linkedin.com .liadm.com snap.licdn.com tr.snapchat.com data:
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Content-Type-Options: nosniff
ETag: W/"cb-IwthotUDL5CHlpKNA2E0bg"
Vary: Origin
Content-Type: text/javascript; charset=utf-8
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Content-Security-Policy: frame-ancestors 'none'; default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://assets.bwbx.io img.en25.com https://s522772699.t.eloqua.com www.googletagmanager.com tagmanager.google.com www.google-analytics.com ssl.google-analytics.com www.google.com www.gstatic.com www.googleadservices.com googleads.g.doubleclick.net js-agent.newrelic.com bam.nr-data.net *.optimizely.com optimizely.s3.amazonaws.com cdn-assets-prod.s3.amazonaws.com www.paypal.com client.perimeterx.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com a2.adform.net s2.adform.net bat.bing.com connect.facebook.net app.keywee.co cdn.keywee.co dc.ads.linkedin.com *.liadm.com snap.licdn.com amplify.outbrain.com q.quora.com a.quora.com www.redditstatic.com sc-static.net platform.twitter.com static.ads-twitter.com analytics.twitter.com s.yimg.com sp.analytics.yahoo.com; style-src 'unsafe-inline' 'self' https://assets.bwbx.io tagmanager.google.com fonts.googleapis.com; font-src 'self' https://assets.bwbx.io fonts.gstatic.com data:; connect-src 'self' https://login.bloomberg.com https://www.bloomberg.com/javelin/api/abba/reg location.bloomberg.com personalization.bloomberg.com *.api.edq.com api.edq.com www.google-analytics.com bam.nr-data.net logx.optimizely.com *.optimizely.com www.paypal.com *.perimeterx.net *.px-cloud.net services.sheerid.com services-sandbox.sheerid.com js.stripe.com dc.ads.linkedin.com *.liadm.com snap.licdn.com s.yimg.com; img-src * www.googletagmanager.com ssl.gstatic.com www.gstatic.com www.google-analytics.com googleads.g.doubleclick.net www.google.com cdn.optimizely.com data:; frame-src img.en25.com https://s522772699.t.eloqua.com www.google.com bid.g.doubleclick.net *.fls.doubleclick.net app.optimizely.com a4368606971.cdn.optimizely.com www.sandbox.paypal.com www.paypal.com js.stripe.com www.facebook.com dc.ads.linkedin.com *.liadm.com snap.licdn.com tr.snapchat.com data:
Content-Length: 203
Date: Fri, 25 Sep 2020 18:10:30 GMT
Expires: -1

GET
H2 200 json Show response
trc.taboola.com/1194877/trc/3/ 814 B
635 B 45ms
43ms Script
application/javascript 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1194877/trc/3/json?tim=1601057430151&data=%7B%22id%22%3A813%2C%22ii%22%3A%22%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1601057430143%2C%22cv%22%3A%2220200818-2-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Diquanti-bloomberg-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22supv%22%3Atrue%2C%22mpv%22%3Atrue%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1194877/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: d0697fda3606d362d1a524934a3ad611ab5c42c9d9a4e0dd794cf60761515664

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 13
date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
access-control-allow-origin: *
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 200
x-served-by: cache-hhn4079-HHN
server: nginx
x-timer: S1601057430.172150,VS0,VE13
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/759744127/ 3 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759744127/?random=1601057430161&cv=9&fst=1601057430161&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74c97a4524fbda3dc83d66f62c17a6ab36bd8e290648ba30fd4970a024ecb0a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1182
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1063184170/ 3 KB
1 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1063184170/?random=1601057430167&cv=9&fst=1601057430167&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cdf26d0fada59d255be00f4d68e5e5ff851b0895986eeaedc60d1729c09b3cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1181
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
www.googleadservices.com/pagead/conversion/1063184170/ 2 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1063184170/?random=1601057430168&cv=9&fst=1601057430168&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&bttype=purchase&us_privacy=error&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecb5c17ee12595c3d153d376ffa403471b00d1a7d9cf9924ad1df263c1991d15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1351
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
www.googleadservices.com/pagead/conversion/759744127/ 2 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/759744127/?random=1601057430170&cv=9&fst=1601057430170&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&bttype=purchase&us_privacy=error&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b6f9d23da71227dd4d19aa8d49e322962bd10774f17970d9a031f87ad039e63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1351
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1063184170/ 3 KB
1 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1063184170/?random=1601057430172&cv=9&fst=1601057430172&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5143d14ad653d26462cb7046044bba8c7623cddc3c309ab4e9e5c0f11ac6893e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1180
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 info Show response
personalization.bloomberg.com/user/ 793 B
522 B 488ms
145ms Fetch
application/json 3.20.41.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://personalization.bloomberg.com/user/info?limit=100

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/byzantium/v5/ms.byzantium-core.bundle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.20.41.86 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-20-41-86.us-east-2.compute.amazonaws.com

Software

Apache /

Resource Hash

d2e5ecf559c5617db1b1681ddf77fc9b3e8e37ea7dfa533aec62808bb88b830c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Apache
status: 200
x-frame-options: DENY
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.bloomberg.com
cache-control: max-age=0
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK targets Show response
www.bloomberg.com/trigrservice/ 286 B
659 B 33ms
32ms Fetch
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/trigrservice/targets

Requested by

Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

755a8a0995741b1336a05aa1025d57596dda66417f3a70caed1765e7f86c1c62

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime: 0.001864
Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Server: nginx
ETag: W/"755a8a0995741b1336a05aa1025d5759"
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=29
Date: Fri, 25 Sep 2020 18:10:30 GMT
Connection: keep-alive
Content-Length: 184
X-Request-Id: 01F80614-5F6E31FA-2EC9389
Expires: Fri, 25 Sep 2020 18:10:59 GMT

GET
H2 200 moatheader.js Show response
z.moatads.com/bloombergprebidheader853620778109/ 217 KB
75 KB 111ms
37ms Script
application/x-javascript 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/bloombergprebidheader853620778109/moatheader.js
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 738bd4902074f833106b1515554d06dcbc383768d4a3e74fbd095eac4d01f826

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 16:31:25 GMT
server: AmazonS3
x-amz-request-id: CE65A0707D784C70
etag: "e37217ed675d30a3eb6f94558e348abd"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=58741
accept-ranges: bytes
content-length: 76852
x-amz-id-2: xOSuctGEAw82qhB1wSc/ATbFkDjKOrCZ410x4xkvlTcrDo2wyiL0Oyh2QaSbGPYObq88/b9jEDI=

GET
H2 200 vans-adapter-google-ima.js Show response
static.adsafeprotected.com/ 19 KB
7 KB 33ms
9ms Script
application/javascript 2600:9000:2182:5600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/vans-adapter-google-ima.js
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:5600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b7aa714a4418a8e3d269a472e0ba2168cca963243ce2c94ad32315cd239fd245

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: FmW9GCwMGDcYuvST0fbMtlt7Sr3UNohQ
content-encoding: gzip
etag: "90eaad1daab4870a6a4ed031687aa680"
age: 235624
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
last-modified: Mon, 16 Dec 2019 18:23:25 GMT
server: AmazonS3
date: Wed, 23 Sep 2020 00:43:27 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 0c17d43ed0068cac968c920774378b84.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: eGm_BeKz7H9q1-VUXoEu5HDl4MZtJbVinZTwvnmlPNNMhwHLa37DLQ==

GET
H2 200 bvp.css
cdn.gotraffic.net/projector/v0.11.194/ 102 KB
24 KB 38ms
38ms Stylesheet
text/css 151.101.129.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gotraffic.net/projector/v0.11.194/bvp.css
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.73 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e09a8727a411877f96d02d31e0c0c11d89bee29e536525c9bd444a93efe01055

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
age: 251426
via: 1.1 varnish
x-cache: HIT
status: 200
fastly-restarts: 1
x-amz-id-2: VdFK4vqSteqE47gZnQXd5GfHyqErL6H9CfTi/nfSqFVNrxDMjHWnIdrAn2klYrUq8yGLpB6rVYk=
x-served-by: cache-cdg20732-CDG
accept-ranges: bytes
last-modified: Tue, 22 Sep 2020 20:17:44 GMT
server: AmazonS3
x-timer: S1601057430.246984,VS0,VE0
etag: "d5c29648b1c9354a344dee319c8c90e7"
vary: Accept-Encoding
x-amz-request-id: 9PEP5Z6TCJES9WFJ
access-control-allow-origin: *
cache-control: max-age=31536000
content-length: 24604
content-type: text/css
x-cache-hits: 717

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 296 KB
102 KB 36ms
15ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7db90d988f2d569ee665c1666e383f3ccb226e4532320946bb42d09702c6ed8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104172
x-xss-protection: 0
expires: Fri, 25 Sep 2020 18:10:30 GMT

GET
H2 200 vendor.js Show response
cdn.gotraffic.net/projector/v0.11.194/ 855 KB
228 KB 41ms
41ms Script
application/javascript 151.101.129.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.73 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c96b02874509fbf27f45a72d80b9fe5a15e17bb5b426f2d633128fe99cf3acc

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
age: 251435
via: 1.1 varnish
x-cache: HIT
status: 200
fastly-restarts: 1
x-amz-id-2: B+2Wnmr0SFthzEydiRardqFsseGoFnZ4hwzAbZEYFwhM/yFxMu4mqQJX8wew28fSDA7RgjTXDjA=
x-served-by: cache-cdg20732-CDG
accept-ranges: bytes
last-modified: Tue, 22 Sep 2020 20:17:44 GMT
server: AmazonS3
x-timer: S1601057430.248018,VS0,VE0
etag: "12cc67a21bd66c68f002760b779596c2"
vary: Accept-Encoding
x-amz-request-id: 9E2733873FEE6517
access-control-allow-origin: *
cache-control: max-age=31536000
content-length: 232717
content-type: application/javascript
x-cache-hits: 875

GET
H2 200 ima3_dai.js Show response
imasdk.googleapis.com/js/sdkloader/ 313 KB
107 KB 41ms
21ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3_dai.js

Requested by

Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bdb507e23aebde59d1885b28ddee501743e8ab8d57e4f92800064a6210adf43a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109473
x-xss-protection: 0
expires: Fri, 25 Sep 2020 18:10:30 GMT

GET
H/1.1

200
OK

beta.js Show response
aka.spotxcdn.com/integration/directsdk/v1/directsdk/
Redirect Chain

https://js.spotx.tv/directsdk/v1/236177.js
https://aka.spotxcdn.com/integration/directsdk/v1/directsdk/beta.js

482 KB
177 KB

121ms
45ms

Script
text/javascript

95.100.196.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://aka.spotxcdn.com/integration/directsdk/v1/directsdk/beta.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.125 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-196-125.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c91a940c0c38e37bae3da2a3e2be95386d8a14954efb37a14e83a2cfbec8bd03

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 17:47:07 UTC
Server: nginx
Access-Control-Allow-Headers
ETag: b8c5390c75f5d474c99b06bf6266e280
Vary: Accept-Encoding
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, OPTIONS
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=171
Connection: keep-alive
Timing-Allow-Origin: *
X-SpotX-Build-Version: 1.40.0-20200909.1652
Content-Length: 180798

Redirect headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 18:10:30 GMT
Last-Modified: Fri, 25 Sep 2020 18:10:30 UTC
Server: nginx
Location: //aka.spotxcdn.com/integration/directsdk/v1/directsdk/beta.js
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: post-check=0, pre-check=0, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 37
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 spritz.js Show response
assets.bwbx.io/s3/spritz/v1.0.0/ 52 KB
19 KB 35ms
34ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/spritz/v1.0.0/spritz.js

Requested by

Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

100a7cdb7f97df6f52d696c863edaf1bb8836f805f076425a5c62e9eb8a0e64f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
etag: "71e069c4cf3c579fedf5ab75bddd897d"
age: 12435305
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 18839
x-amz-id-2: FCNJ2uuu17tdEKnCUF6MhiSKsOWtTbIsqTQ+cxC6ikUclR08jNZzln877uIeOk7PSJE3/i1v4ws=
x-served-by: cache-sea4467-SEA, cache-hhn4056-HHN
last-modified: Fri, 07 Feb 2020 18:59:32 GMT
server: AmazonS3
x-timer: S1601057430.248943,VS0,VE0
date: Fri, 25 Sep 2020 18:10:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 446FBEA3EB70A4CE
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 2094

GET
H2 200 adsct
t.co/i/ 43 B
448 B 242ms
165ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nzex3&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Fri, 25 Sep 2020 18:10:30 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: cd3222274975bdc70387c874ad83cf77
x-transaction: 0081576c00777aaf
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H/1.1 200
OK collector Show response
www.bloomberg.com/8FCGYgk4/xhr/api/v1/ 1 KB
1 KB 225ms
225ms XHR
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/8FCGYgk4/xhr/api/v1/collector
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/8FCGYgk4/init.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74ecc2ed26ffded407a0e68802072c078c9e14bf4284088d46ba0f40f7f374db

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Fri, 25 Sep 2020 18:10:30 GMT
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bloomberg.com
Cache-Control: max-age=6
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 1070
Expires: Fri, 25 Sep 2020 18:10:36 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=403593&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DH...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D403593%26url%3Dhttps%253A%252F%252Fwww.bloomberg.com%252Fnews%252Farticles%252F20...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=403593&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DH...

0
58 B

131ms
131ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=403593&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&time=1601057430255&liSync=true
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: HELSGEAZOBZAIOe1LysAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: pmX4EEAZOBbgM49jgCsAAA==
pragma: no-cache
x-li-pop: afd-prod-edc2
x-msedge-ref: Ref A: EA8C0FDDA7884F1DBA3096F4368D977D Ref B: FRAEDGE0806 Ref C: 2020-09-25T18:10:30Z
x-frame-options: sameorigin
date: Fri, 25 Sep 2020 18:10:30 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=403593&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&time=1601057430255&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 Notice.e0347.css
sourcepointcmp.bloomberg.com/ Frame BBF0 25 KB
5 KB 24ms
23ms Stylesheet
text/css 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/Notice.e0347.css
Requested by: Host: sourcepointcmp.bloomberg.com
URL: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 34637930d2503a6ad23a9430d2ebcd6f846d205437de97939ec1db47c5f8011f

Request headers

Referer: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 17:29:14 GMT
content-encoding: gzip
last-modified: Thu, 10 Sep 2020 23:46:03 GMT
server: AmazonS3
age: 2477
etag: W/"aa0dc0571309daedf27bced2295f176e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
status: 200
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: XuDtgDw9DOCvvuPrTRbQyQGTvtB16yLKRw1aPrNv8hTGqsIUZJu65g==
via: 1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)

GET
H2 200 /
www.google.com/pagead/1p-user-list/759744127/ 42 B
107 B 20ms
19ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/759744127/?random=1601057430161&cv=9&fst=1601056800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&async=1&fmt=3&is_vtc=1&random=1978955756&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/759744127/ 42 B
107 B 29ms
27ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/759744127/?random=1601057430161&cv=9&fst=1601056800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&async=1&fmt=3&is_vtc=1&random=1978955756&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1063184170/ 42 B
107 B 35ms
34ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1063184170/?random=1601057430167&cv=9&fst=1601056800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&async=1&fmt=3&is_vtc=1&random=4108056358&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1063184170/ 42 B
107 B 20ms
20ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1063184170/?random=1601057430167&cv=9&fst=1601056800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&async=1&fmt=3&is_vtc=1&random=4108056358&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

/
www.google.de/pagead/1p-conversion/1063184170/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...
https://www.google.com/pagead/1p-conversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd...
https://www.google.de/pagead/1p-conversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=...

42 B
538 B

43ms
28ms

Image
image/gif

2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX8nxCuzZ7_UPjcSL2Aw&cid=CAQSKQCNIrLMuatj8N2t4z3ql8Tow8WZIzD8xXeaHHQvU-wB8RiWoPbhMwyG&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb6L4gvtg6mOBx6dr4LDIwICBT-Eyawvjiw&random=3951719484&resp=GooglemKTybQhCsO&ipr=y

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/1063184170/?random=181787006&cv=9&fst=*&num=1&value=0&label=6VpQCOnp7YkBEKrO-_oD&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX8nxCuzZ7_UPjcSL2Aw&cid=CAQSKQCNIrLMuatj8N2t4z3ql8Tow8WZIzD8xXeaHHQvU-wB8RiWoPbhMwyG&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb6L4gvtg6mOBx6dr4LDIwICBT-Eyawvjiw&random=3951719484&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

/
www.google.de/pagead/1p-conversion/759744127/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...
https://www.google.com/pagead/1p-conversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd...
https://www.google.de/pagead/1p-conversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=...

42 B
65 B

46ms
30ms

Image
image/gif

2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX6b_CvK17_UP2oaEiAM&cid=CAQSKQCNIrLMCDZWzDbi7f37EaVdSeiG8jK5NkV2XPIfMMNlBvZoOpNKFccr&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb4QlbhwnZbNnkM9eq7SLaYYvxJSvTK-HTQ&random=1197797392&resp=GooglemKTybQhCsO&ipr=y

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/759744127/?random=1063357754&cv=9&fst=*&num=1&value=0&label=NPt6CL6b_JYBEP-Mo-oC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue:%25202020-09-17%2520Banking%2520Dive%2520%255Bissue:29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&hn=www.googleadservices.com&us_privacy=error&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=ljJuX6b_CvK17_UP2oaEiAM&cid=CAQSKQCNIrLMCDZWzDbi7f37EaVdSeiG8jK5NkV2XPIfMMNlBvZoOpNKFccr&eitems=ChAI8Kq2-wUQl_P39uLBtegCEh0AlugYb4QlbhwnZbNnkM9eq7SLaYYvxJSvTK-HTQ&random=1197797392&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/1063184170/ 42 B
538 B 46ms
33ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1063184170/?random=1601057430172&cv=9&fst=1601056800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&async=1&fmt=3&is_vtc=1&random=2901100825&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1063184170/ 42 B
107 B 25ms
22ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1063184170/?random=1601057430172&cv=9&fst=1601056800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&tiba=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&async=1&fmt=3&is_vtc=1&random=2901100825&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 polyfills.c4fd4.js Show response
sourcepointcmp.bloomberg.com/ Frame BBF0 5 KB
2 KB 24ms
22ms Script
application/javascript 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/polyfills.c4fd4.js
Requested by: Host: sourcepointcmp.bloomberg.com
URL: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: addb97debb6f14f5bb8c9e63a3449e184d911fd50f2e9dbf73e64d5f62c55da2

Request headers

Referer: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 17:44:32 GMT
content-encoding: gzip
last-modified: Thu, 10 Sep 2020 23:46:04 GMT
server: AmazonS3
age: 1559
etag: "d33730eb6a8d287c1caaadf5ed611f52"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: PwBDRKM3IwoIqrreBruFCQFvr8MeBYa4bpv_-yXhNDSRNfgVhuUJeQ==
via: 1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)

GET
H2 200 Notice.37f67.js Show response
sourcepointcmp.bloomberg.com/ Frame BBF0 127 KB
29 KB 31ms
29ms Script
application/javascript 99.86.243.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sourcepointcmp.bloomberg.com/Notice.37f67.js
Requested by: Host: sourcepointcmp.bloomberg.com
URL: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-21.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: edcf9e078dbd83bbc3736dc0d32da6733fb8c21b7137c59edbc9ef95ad60041c

Request headers

Referer: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 17:45:23 GMT
content-encoding: gzip
last-modified: Thu, 10 Sep 2020 23:46:03 GMT
server: AmazonS3
age: 1508
etag: "0f147d530234f8144dcc0cff2ae68eb1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: Ozrg3uapFvL7X-wtfqs0VoHHdNJZheQIPF_t7JmiJ_9HBpuMeFebxA==
via: 1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)

GET
H/1.1 200
OK data Show response
a-fds.youborafds01.com/ 106 B
454 B 65ms
19ms XHR
application/json 2001:1af8:4700:b214::100
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://a-fds.youborafds01.com/data?apiVersion=v7&outputformat=json&system=bloomberg&pluginVersion=6.5.20-adapterless&requestNumber=0.2489774694988005&timemark=1601057430535
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:1af8:4700:b214::100 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: NiceFastDataServer/1.1 (Youbora 3.0) /
Resource Hash: c3fc5a8420c5bd21d96f6099bd42cee5a288ee31ca725e4fdd4a97da0e8ffb41

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:30 GMT
Last-Modified: Fri, 25 Sep 2020 18:10:30 GMT
Server: NiceFastDataServer/1.1 (Youbora 3.0)
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate
Access-Control-Allow-Headers: *
Content-Length: 106
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 /
d2p3zdq8vjvnxd.cloudfront.net/ Frame BBF0 26 B
367 B 122ms
43ms Image
image/gif 2600:9000:206e:8200:13:7ad6:7840:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p3zdq8vjvnxd.cloudfront.net/?s_id=9964&m_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:8200:13:7ad6:7840:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://sourcepointcmp.bloomberg.com/index.html?message_id=244702&consentUUID=1dfac0d6-4f01-42a0-ba5d-5a4dafae4038&requestUUID=0900dc50-96c8-494b-ac59-f4add206eb8f&preload_message=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:31 GMT
via: 1.1 f1944380c787841c28b16df91c1ec34e.cloudfront.net (CloudFront)
last-modified: Wed, 10 Apr 2019 18:39:37 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-C1
etag: "6a43099d5c8fe991a7aa7ebaca53069d"
x-cache: Miss from cloudfront
content-type: image/gif
status: 200
cache-control: no-cache,no-store
accept-ranges: bytes
content-length: 26
x-amz-cf-id: TgGUTcpXwIkML5Bzyk7Fth88BjONQHRbEk5Utm-PJCOBpQt6WbJq-g==

GET
H2 200 v2 Show response
mb.moatads.com/yi/ 350 B
525 B 175ms
74ms Script
text/html 3.9.96.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi/v2?qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3321063859&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB41kNBBBBBBBBBBBBBhcjG6BBJMhLeBk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&pcode=bloombergprebidheader853620778109&callback=MoatNadoAllJsonpRequest_9002069
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/bloombergprebidheader853620778109/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.9.96.171 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: TornadoServer/4.5.3 /
Resource Hash: fe3b0bcd28be1cf04e1903eb9a448ec2ab0c04b3448ff7cd2f9eb7160cb81e02

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
server: TornadoServer/4.5.3
etag: "9147d33409030792354c73bec4b18826b6527856"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 350

GET
H2 200 n.js Show response
geo.moatads.com/ 111 B
287 B 188ms
61ms Script
text/html 34.251.197.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3321063859&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB41kNBBBBBBBBBBBBBhcjG6BBJMhLeBk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&pcode=bloombergprebidheader853620778109&ql=&qo=0&i=BLOOMBERG_PREBID_HEADER1&hp=1&wf=1&vb=0&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1601057430644&de=483850077984&rx=683467741163&m=0&ar=15e5b57-clean&iw=4ecfb8f&q=1&cb=0&cu=1601057430644&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zMoatGAMSize=-&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&id=1&ii=4&bo=undefined&bd=undefined&gw=bloombergprebidheader853620778109&fd=1&ac=1&it=500&pe=1%3A1445%3A1445%3A0%3A1570&fs=185355&na=283638310&cs=0&callback=DOMlessLLDcallback_9002069
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/bloombergprebidheader853620778109/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.197.102 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-197-102.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 8ed01fbcf9ca1555bfde42a9d39eaf284d90c49af584e3e7f0f2490a6ad84296

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
server: TornadoServer/4.5.3
etag: "b230f57aecfedb3f43266b7db42f37fd5fbe57f6"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 111

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 38ms
35ms Image
image/gif 95.100.197.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&t=1601057430644&de=184738735587&d=BLOOMBERG_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=15e5b57-clean&iw=4ecfb8f&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=bloomberg.com&bd=bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave&ac=1&bq=11&f=0&na=2114923977&cs=0
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.197.246 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-197-246.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:30 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Fri, 25 Sep 2020 18:10:30 GMT

GET
H2 200 breaking-news-64cd60756e.css
assets.bwbx.io/s3/navi/css/components/en/breaking-news/ 5 KB
1 KB 31ms
30ms Stylesheet
text/css 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/navi/css/components/en/breaking-news/breaking-news-64cd60756e.css

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2f7d9fdb5c4a202c37622ec3a3c55f72ba89e2434417d2e8200bf94c9e5ff6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: N90S82eB0XmlKYRiO1FPJlz13ZSmwYWC
content-encoding: gzip
etag: "64cd60756e56dfefebf463d7c3867b3b"
age: 5110443
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 1157
x-amz-id-2: sBjCAWdYukl9j/3gS2Sce8EVwz7hT5ls++uTkEMwRcjTSWEMZG77YxWQTZFx3TiEo+QxJPlZS1I=
x-served-by: cache-sea4450-SEA, cache-hhn4056-HHN
last-modified: Tue, 28 Jul 2020 14:05:24 GMT
server: AmazonS3
x-timer: S1601057431.755501,VS0,VE0
date: Fri, 25 Sep 2020 18:10:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: A11CA4E78A7B9B39
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: text/css
x-cache-hits: 1107, 1945

GET
H2 200 breaking-news-208de4d3f4a49d747cb4.js Show response
assets.bwbx.io/s3/navi/js/ 14 KB
5 KB 31ms
30ms Script
application/javascript 151.101.113.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.bwbx.io/s3/navi/js/breaking-news-208de4d3f4a49d747cb4.js

Requested by

Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.73 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4d27e8a84fa4c46454c95e2836facc979fee492671ab77ba64f60a7a08a2a286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: ZnbxPAkHo.1yu_bThWECrlmTHP6DsTcl
content-encoding: gzip
etag: "83f8249410134b370d771acec1340287"
age: 4306838
x-cache: HIT, HIT
status: 200
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 4368
x-amz-id-2: fhzLY///wD/ahNh6gAu/APqr9ot/DZ9Ih97lP6lpOp7oty5GgulF+mmcOU0tt6iOkkuU5qM9xhI=
x-served-by: cache-sea4444-SEA, cache-hhn4056-HHN
last-modified: Thu, 06 Aug 2020 21:47:46 GMT
server: AmazonS3
x-timer: S1601057431.756691,VS0,VE0
date: Fri, 25 Sep 2020 18:10:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: B03F80AD3AAEAC88
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000, immutable
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1, 141

GET
H2 200 app.js Show response
cdn.gotraffic.net/projector/v0.11.194/ 510 KB
112 KB 39ms
39ms Script
application/javascript 151.101.129.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gotraffic.net/projector/v0.11.194/app.js
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/latest/bplayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.73 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9bc72f80764916ada6cc33745a55a734fdee68e901667aa693e02a102facfc98

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
age: 251397
via: 1.1 varnish
x-cache: HIT
status: 200
fastly-restarts: 1
x-amz-id-2: fksEwvZjNcZ8uXJOzdnMupcFjoz1FvWQ8H1i9+fX3Uw66PQYQOujjagp4LWgGgib6lO5C5e4q6Q=
x-served-by: cache-cdg20732-CDG
accept-ranges: bytes
last-modified: Tue, 22 Sep 2020 20:17:43 GMT
server: AmazonS3
x-timer: S1601057431.808318,VS0,VE0
etag: "d4d7c8920b3224c551cd3d301404fbaf"
vary: Accept-Encoding
x-amz-request-id: 51BE34101525ED27
access-control-allow-origin: *
cache-control: max-age=31536000
content-length: 114000
content-type: application/javascript
x-cache-hits: 817

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/markets/modules/datastrip.json?version=2&theme=blens&tickers=C:US
https://www.bloomberg.com/tosv.html?url=L21hcmtldHMvbW9kdWxlcy9kYXRhc3RyaXAuanNvbj90aGVtZT1ibGVucyZ2ZXJzaW9uPTImdGlja2Vycz1DJTNBVVM=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea...

12 KB
5 KB

151ms
151ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21hcmtldHMvbW9kdWxlcy9kYXRhc3RyaXAuanNvbj90aGVtZT1ibGVucyZ2ZXJzaW9uPTImdGlja2Vycz1DJTNBVVM=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:31 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:56 GMT
Server: nginx
ETag: "5f6e040c-30ab"
Vary: Accept-Encoding
Content-Type: text/html, text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:31 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: nginx
Date: Fri, 25 Sep 2020 18:10:30 GMT
Content-Type: text/html
Location: /tosv.html?url=L21hcmtldHMvbW9kdWxlcy9kYXRhc3RyaXAuanNvbj90aGVtZT1ibGVucyZ2ZXJzaW9uPTImdGlja2Vycz1DJTNBVVM=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=5
Connection: keep-alive
Content-Length: 180
Expires: Fri, 25 Sep 2020 18:10:35 GMT

GET
H2 200 config.min.json Show response
cdn.gotraffic.net/projector/latest/assets/config/ 21 KB
4 KB 116ms
39ms Fetch
application/json 151.101.129.73
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gotraffic.net/projector/latest/assets/config/config.min.json?v=1
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/app.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.73 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2e1f840b0392ee0449f2d2e7f44123efaebe36e476d35be346ec6634ef0367fc

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: gzip
age: 397
via: 1.1 varnish
x-cache: HIT
status: 200
fastly-restarts: 1
x-amz-id-2: +x9gzfNYDuWtKZTbg2hVybHWFujkr7qM1UyjZM3GrBHYR9juT5bdzbBXEn2PCAXsPd9LbB7onjs=
x-served-by: cache-cdg20720-CDG
accept-ranges: bytes
last-modified: Thu, 30 Jul 2020 19:55:24 GMT
server: AmazonS3
x-timer: S1601057431.970934,VS0,VE0
etag: "d7e1368f6b282b385e856032d71961aa"
vary: Accept-Encoding
x-amz-request-id: 517E613AE686EEDE
access-control-allow-origin: *
cache-control: max-age=900
content-length: 4185
content-type: application/json
x-cache-hits: 7

GET
H2 204 idsv2 Show response
mid.rkdms.com/ 0
159 B 369ms
121ms XHR
text/plain 3.215.9.17
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=BLOOMBERG
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/184795-45553530326378.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.9.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

status: 204
date: Fri, 25 Sep 2020 18:10:31 GMT
access-control-allow-credentials: true
server: nginx/1.16.1
access-control-allow-origin: https://www.bloomberg.com
access-control-allow-methods: GET, HEAD, OPTIONS

GET
H2 451 identity Show response
api.rlcdn.com/api/ 0
223 B 112ms
49ms XHR
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope&cv=CO6QbtEO6QbtEAGABCENA4CgAAAAAGPAAACYAAALzgGAAhAC-AI4AgcBBwEIAIiARYAuoBgQDXgHUAXmAOMgBACOAXmEgAgCOFQAgBHALzHQAgBHAHUIQAwBHAEDAOoSgBACOAOoUgAgHUAA.YAAAAAAAAAAA&ct=4
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/184795-45553530326378.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Fri, 25 Sep 2020 18:10:31 GMT
via: 1.1 google
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
status: 451
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.bloomberg.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
652 B 222ms
149ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nzex3&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Fri, 25 Sep 2020 18:10:31 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: e3fbdd09896a5d7ddbd416260a639534
x-transaction: 00fa12e300a3d78f
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 EMEA.js Show response
cdn.brandmetrics.com/tag/002bd45403b64f0698cb2579a9094574/ 9 KB
3 KB 37ms
16ms Script
text/javascript 2606:4700:20::ac43:45f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/tag/002bd45403b64f0698cb2579a9094574/EMEA.js
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:45f7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 850233c0e37e99e62a6927db641550362ee8ef05e2fa7449cb1a9dd8f2760420

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 591
cf-polished: origSize=9042
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
status: 200
cache-control: public, max-age=3600
cf-ray: 5d86b3cf8f322b71-FRA
cf-request-id: 05680eb5b000002b71ae0e0200000001
request-context: appId=cid-v1:7126f420-a837-47d2-af02-43eb3f5f1993

GET
H2 200 680511.js Show response
cdn.brandmetrics.com/scripts/bundle/ 33 KB
10 KB 14ms
13ms Script
text/javascript 2606:4700:20::ac43:45f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/scripts/bundle/680511.js
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/tag/002bd45403b64f0698cb2579a9094574/EMEA.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:45f7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c30e1ee38b2a521c96f84a75cfb0683f7decdd597cd47c4b0ac5457c9aaad405

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:30 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 597
cf-polished: origSize=33410
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
status: 200
cache-control: public, max-age=3600
cf-ray: 5d86b3cf9f982b71-FRA
cf-request-id: 05680eb5c100002b71ae0e5200000001
request-context: appId=cid-v1:7126f420-a837-47d2-af02-43eb3f5f1993

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

12 KB
5 KB

137ms
137ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:31 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:56 GMT
Server: nginx
ETag: "5f6e040c-30ab"
Vary: Accept-Encoding
Content-Type: text/html, text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:31 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: nginx
Date: Fri, 25 Sep 2020 18:10:31 GMT
Content-Type: text/html
Location: /tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=5
Connection: keep-alive
Content-Length: 180
Expires: Fri, 25 Sep 2020 18:10:36 GMT

GET
H2 200 c.js Show response
collector.brandmetrics.com/ 0
122 B 148ms
48ms Script
text/javascript 52.166.113.188
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.brandmetrics.com/c.js?siteid=6ca8328c-e264-428f-bdc0-df9cda8f2dc8&toploc=www.bloomberg.com&rnd=3329535
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/scripts/bundle/680511.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.166.113.188 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 18:10:30 GMT
request-context: appId=cid-v1:7126f420-a837-47d2-af02-43eb3f5f1993
content-length: 0
content-type: text/javascript;charset=utf-8

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

12 KB
5 KB

149ms
149ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:31 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:56 GMT
Server: nginx
ETag: "5f6e040c-30ab"
Vary: Accept-Encoding
Content-Type: text/html, text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:31 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: nginx
Date: Fri, 25 Sep 2020 18:10:31 GMT
Content-Type: text/html
Location: /tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=5
Connection: keep-alive
Content-Length: 180
Expires: Fri, 25 Sep 2020 18:10:36 GMT

POST
H/1.1 200
OK collector Show response
www.bloomberg.com/8FCGYgk4/xhr/api/v1/ 795 B
1 KB 198ms
197ms XHR
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/8FCGYgk4/xhr/api/v1/collector
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/8FCGYgk4/init.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fc80a3e7d5aec8ab0cb9a9ce523d1472d918213789d65b84486f4ca7ed0e6f65

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Fri, 25 Sep 2020 18:10:31 GMT
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bloomberg.com
Cache-Control: max-age=6
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 795
Expires: Fri, 25 Sep 2020 18:10:37 GMT

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/media-manifest/streams/us.m3u8?group=backup&profile=mini
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

12 KB
5 KB

156ms
156ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:31 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:56 GMT
Server: nginx
ETag: "5f6e040c-30ab"
Vary: Accept-Encoding
Content-Type: text/html, text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:31 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: openresty
Date: Fri, 25 Sep 2020 18:10:31 GMT
Content-Type: text/html
Location: /tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=5
Connection: keep-alive
Content-Length: 168
Expires: Fri, 25 Sep 2020 18:10:36 GMT

GET
H/1.1 200
OK init Show response
infinity-c6.youboranqs01.com/ 0
218 B 64ms
13ms XHR
text/plain 2001:1af8:4700:b081::104
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://infinity-c6.youboranqs01.com/init?accountCode=bloomberg&username=033aa840-f145-486c-9f5a-cd9463a30ace&player=videojs-hlsjs&title=LIVE_US_MINI&live=true&mediaResource=https%3A%2F%2Fwww.bloomberg.com%2Fmedia-manifest%2Fstreams%2Fus.m3u8%3Fprofile%3Dmini&playerVersion=6.13.0&param1=v0.11.194&param2=true&param3=September%2025%2C%202020&param4=long-form&param5=N%2FA&param6=www.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave&param7=LIVE_US_MINI&param9=unsubscribed&param11=WEB&obfuscateIp=false&pluginVersion=6.5.10-videojs-js&pluginInfo=%7B%22lib%22%3A%226.5.20%22%2C%22adapter%22%3A%226.5.10-videojs-js%22%2C%22adAdapter%22%3Anull%7D&referer=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&adsExpected=false&deviceUUID=13db5731130bf5ed3699496c62493117&libVersion=6.5.20&playbackType=Live&timemark=1601057431102&system=bloomberg&sessionRoot=U_19160_a53rp1n3ad9jict1_1601057431098&code=U_19160_a53rp1n3ad9jict1_1601057431098
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:1af8:4700:b081::104 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: NQSInfinity/8.25.4 (v8.25.4) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: 1601057431464
Last-Modified: 1601057431464
Server: NQSInfinity/8.25.4 (v8.25.4)
Access-Control-Allow-Headers: *
Content-Length: 0
Content-Type: text/plain

GET
H2 204 unip Show response
trc-events.taboola.com/1194877/log/3/ 0
294 B 39ms
39ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1194877/log/3/unip?en=pre_d_eng_tb&tos=1501&scd=39&ssd=1&est=1601057430148&ver=27&isls=true&src=i&invt=1500&tim=1601057431651&vi=1601057430143&ri=bf816f969f9b9f7c1c9e339063428673&sd=v2_7e31f3bfc57117b854369ba9872d5a4c_9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816_1601057430_1601057430_CNawjgYQ_fZIGP-01rPMLiABKAEwDzjpmQdA_4UQSOWG2ANQ____________AVgBYABo4qaqkbKtl-Jw&ui=9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816&ref=null&cv=20200818-2-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1194877/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:31 GMT
server: nginx
x-fastly-to-nlb-rtt: 25082
status: 204
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.bloomberg.com
cache-control: no-cache
access-control-allow-credentials: true
tbl-x-upstream: 10.41.30.18:10213

POST
H/1.1 200
OK collector Show response
www.bloomberg.com/8FCGYgk4/xhr/api/v1/ 782 B
1 KB 84ms
83ms XHR
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/8FCGYgk4/xhr/api/v1/collector
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/8FCGYgk4/init.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b460287ef0b7723fa5ee67d7810c23fd3f727abaea97cde61a268b8346ef2deb

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Fri, 25 Sep 2020 18:10:32 GMT
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bloomberg.com
Cache-Control: max-age=6
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 782
Expires: Fri, 25 Sep 2020 18:10:38 GMT

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

12 KB
5 KB

135ms
135ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:32 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:56 GMT
Server: nginx
ETag: "5f6e040c-30ab"
Vary: Accept-Encoding
Content-Type: text/html, text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:32 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: nginx
Date: Fri, 25 Sep 2020 18:10:32 GMT
Content-Type: text/html
Location: /tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=4
Connection: keep-alive
Content-Length: 180
Expires: Fri, 25 Sep 2020 18:10:36 GMT

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/media-manifest/streams/us.m3u8?group=backup&profile=mini
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

12 KB
5 KB

151ms
150ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:33 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:56 GMT
Server: nginx
ETag: "5f6e040c-30ab"
Vary: Accept-Encoding
Content-Type: text/html, text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:33 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: openresty
Date: Fri, 25 Sep 2020 18:10:32 GMT
Content-Type: text/html
Location: /tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=4
Connection: keep-alive
Content-Length: 168
Expires: Fri, 25 Sep 2020 18:10:36 GMT

POST
H/1.1 200
OK collector Show response
www.bloomberg.com/8FCGYgk4/xhr/api/v1/ 782 B
1 KB 111ms
111ms XHR
application/json 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/8FCGYgk4/xhr/api/v1/collector
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/8FCGYgk4/init.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 28f611ea2851c54eccda0ac7fe2982c718a90b9d39235a0fc0e680fe67aa7663

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Fri, 25 Sep 2020 18:10:33 GMT
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.bloomberg.com
Cache-Control: max-age=6
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 782
Expires: Fri, 25 Sep 2020 18:10:39 GMT

GET
H2 204 unip Show response
trc-events.taboola.com/1194877/log/3/ 0
294 B 37ms
36ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1194877/log/3/unip?en=pre_d_eng_tb&tos=4503&scd=39&ssd=1&est=1601057430148&ver=27&isls=true&src=i&invt=3000&tim=1601057434652&vi=1601057430143&ri=bf816f969f9b9f7c1c9e339063428673&sd=v2_7e31f3bfc57117b854369ba9872d5a4c_9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816_1601057430_1601057430_CNawjgYQ_fZIGP-01rPMLiABKAEwDzjpmQdA_4UQSOWG2ANQ____________AVgBYABo4qaqkbKtl-Jw&ui=9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816&ref=null&cv=20200818-2-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1194877/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:34 GMT
server: nginx
x-fastly-to-nlb-rtt: 23676
status: 204
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.bloomberg.com
cache-control: no-cache
access-control-allow-credentials: true
tbl-x-upstream: 10.41.24.10:10213

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

12 KB
5 KB

133ms
133ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:35 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:56 GMT
Server: nginx
ETag: "5f6e040c-30ab"
Vary: Accept-Encoding
Content-Type: text/html, text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:35 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: nginx
Date: Fri, 25 Sep 2020 18:10:35 GMT
Content-Type: text/html
Location: /tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9wcm9maWxlPW1pbmk=&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=1
Connection: keep-alive
Content-Length: 180
Expires: Fri, 25 Sep 2020 18:10:36 GMT

GET
H/1.1

200
OK

tosv.html Show response
www.bloomberg.com/
Redirect Chain

https://www.bloomberg.com/media-manifest/streams/us.m3u8?group=backup&profile=mini
https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593

12 KB
5 KB

401ms
401ms

XHR
text/html

104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bloomberg.com/tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-39-139.deploy.static.akamaitechnologies.com
Software: openresty /
Resource Hash: cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:35 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Sep 2020 14:51:26 GMT
Server: openresty
ETag: "5f6e03ee-30ab"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Cache-Control: public, private, no-cache, no-store, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4894
Expires: Fri, 25 Sep 2020 18:10:35 GMT

Redirect headers

Content-Security-Policy: upgrade-insecure-requests
Server: openresty
Date: Fri, 25 Sep 2020 18:10:35 GMT
Content-Type: text/html
Location: /tosv.html?url=L21lZGlhLW1hbmlmZXN0L3N0cmVhbXMvdXMubTN1OD9ncm91cD1iYWNrdXAmcHJvZmlsZT1taW5p&uuid=6511db30-ff5a-11ea-baac-212831cb3e33&vid=645716b1-ff5a-11ea-b5c5-ab830e320593
Cache-Control: public, max-age=1
Connection: keep-alive
Content-Length: 168
Expires: Fri, 25 Sep 2020 18:10:36 GMT

GET
H/1.1 200
OK us.m3u8 Show response
www.bloomberg.com/media-manifest/streams/ 178 B
777 B 217ms
216ms XHR
application/vnd.apple.mpegurl 104.108.39.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bloomberg.com/media-manifest/streams/us.m3u8?profile=mini

Requested by

Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.39.139 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-39-139.deploy.static.akamaitechnologies.com

Software

openresty /

Resource Hash

2b5c00c3a83ef371a7f16f678ff8ded85a9f286462a4244a474a7ef13eb88a1c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: upgrade-insecure-requests
Content-Encoding: gzip
Server: openresty
ETag: W/"b2-396Cl8HOhKEzuSZzrLY4KLlQ2kk"
Vary: Accept-Encoding
Content-Type: application/vnd.apple.mpegurl; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=300
Date: Fri, 25 Sep 2020 18:10:39 GMT
Connection: keep-alive
Content-Length: 182
Expires: Fri, 25 Sep 2020 18:15:39 GMT

GET
H2 200 loader.js Show response
cdn.taboola.com/libtrc/bloomberg/ 377 KB
41 KB 31ms
30ms Script
application/javascript 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/bloomberg/loader.js
Requested by: Host: assets.bwbx.io
URL: https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/taboola/en/taboola-48baa8e15b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b6470bbd45ef9a9b33579972f46b056c3577c77cccf420961a1e5b617bc07ff1

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: FVzeU9eBlHofsnDxiDTg9zEaZsLB5EWD
content-encoding: gzip
etag: "ee995de70d99d93c8d4520e104a87f3c"
age: 38
x-cache: HIT
status: 200
content-length: 41439
x-amz-id-2: 1XEy/F2O2KsOR1bGWWT8WqZdHl3bFI0Q1MOy2QySIMrYHNlYIUxOQg8Xu+AmtyvIU1+UzX/H08Y=
x-served-by: cache-hhn4079-HHN
last-modified: Thu, 24 Sep 2020 13:46:25 GMT
server: AmazonS3
x-timer: S1601057440.717032,VS0,VE1
date: Fri, 25 Sep 2020 18:10:39 GMT
vary: Accept-Encoding
x-amz-request-id: 23BBF1997B0C5332
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 56
x-cache-hits: 1

GET
H2 200 load.js Show response
widget.perfectmarket.com/bloomberg/ 3 KB
2 KB 126ms
40ms Script
application/javascript 151.101.1.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/bloomberg/load.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/bloomberg/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.181 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 208a937d171175f31e566e0f8bbb0ee28ceb054bea28d4a2cf3d91b339222c06

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Thoq7Xf7v1f_mEc.g26fmMXXAN49HSAG
content-encoding: gzip
etag: "b2f3e40c7f23d25fbe9fdcbc884f2412"
age: 231
x-cache: HIT, HIT
status: 200
content-length: 1156
x-amz-id-2: 4uCRDdFzqyvHENzfEjaJn7jVDOCL3HUXuiHE3cnunSM1yDcL/YGgkPrEVtDGM0LX2yR/0vZzE7M=
x-served-by: cache-lax8638-LAX, cache-cdg20749-CDG
last-modified: Fri, 27 Mar 2020 07:23:47 GMT
server: AmazonS3
x-timer: S1601057440.918947,VS0,VE1
date: Fri, 25 Sep 2020 18:10:39 GMT
vary: Accept-Encoding,,
x-amz-request-id: CF77AFFF20E6B011
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=300
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
x-cache-hits: 1, 1

GET
H2 200 impl.20200924-16-RELEASE.js Show response
cdn.taboola.com/libtrc/ 443 KB
126 KB 33ms
30ms Script
application/javascript 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20200924-16-RELEASE.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/bloomberg/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b3c7fc0cf7be713a4e97298f59db197355a9bdbd1d55944e6d8a4006f1a01cf6

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: a9hIErR8tUfR5NJzCLK.m8.JA9ROZFL7
content-encoding: gzip
etag: "88a18abc6991654efbee3cb01d168553"
age: 118
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 128167
x-amz-id-2: bRwAi7c4TJ+u6PjUioSgbctjpLckduQBy29V6Dy3MTt9avvieYI6Q45+F7tMUyvSOttjFvqfqmU=
x-served-by: cache-hhn4079-HHN
last-modified: Thu, 24 Sep 2020 13:17:47 GMT
server: AmazonS3
x-timer: S1601057440.830700,VS0,VE0
date: Fri, 25 Sep 2020 18:10:39 GMT
vary: Accept-Encoding
x-amz-request-id: 717334C291FF5E8B
via: 1.1 varnish
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 8
x-cache-hits: 1321

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 94ms
31ms Script
application/x-javascript 2.19.34.195
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/bloomberg/loader.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.34.195 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-19-34-195.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:39 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 884
Expires: Sat, 26 Sep 2020 18:10:39 GMT

GET
H/1.1 200
OK Source-USTV-34-1_live.m3u8 Show response
liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/ 329 B
1 KB 132ms
36ms XHR
application/x-mpegurl 2.20.142.234
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1_live.m3u8
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.20.142.234 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-20-142-234.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 933a80da0bb0c4ccbbd539d68434c7d3f600fd7042e96361ded8700c283df122

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
x-amz-request-id: 363F5C65C847F274
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,h3-Q048=":443"; ma=93600,h3-Q046=":443"; ma=93600,h3-Q043=":443"; ma=93600,quic=":443"; ma=93600; v="50,48,46,43"
Content-Length: 169
x-amz-id-2: 0rjYA2w+SM1xCgc4Yzpdf/l4TOyvOYb1iBwje6q9iLeAhyyJajsdLNwZfUKNJZpBT855Sm3Xb94=
Pragma: no-cache
Akamai-Mon-Iucid-Del: 528286
Last-Modified: Fri, 25 Sep 2020 18:10:34 GMT
Server: AmazonS3
ETag: "167e7260afc50f681910ed79a30e51d8"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: origin,range,hdntl,hdnts
Expires: Fri, 25 Sep 2020 18:10:40 GMT

GET
H/1.1

200
OK

p2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=6961552&ns_site=bloomberg-stream-test&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=c&ns_st_id=1601057431006_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns...
https://sb.scorecardresearch.com/p2?c1=2&c2=6961552&ns_site=bloomberg-stream-test&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=c&ns_st_id=1601057431006_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&n...

43 B
589 B

74ms
30ms

Image
image/gif

2.19.34.195
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=6961552&ns_site=bloomberg-stream-test&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=c&ns_st_id=1601057431006_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=0&ns_st_pb=1&ns_st_mp=BPlayer&ns_st_mv=v0.11.194&ns_st_pn=1&ns_st_tp=1&ns_st_li=1&ns_st_ci=LIVE_US_MINI&ns_ts=1601057440045&ns_st_ca=0&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pl=LIVE_US_MINI&ns_st_ep=LIVE_US_MINI&ns_st_ty=Live%20US%20Mini&ns_st_ct=vc13&ns_st_dt=N%2FA&ns_st_pu=Bloomberg&c4=BBG&c5=02&c6=*null&c7=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&c8=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&c9=&bss_user_action=1&bss_iframe=0&playerId=US_MINI&bss_auto_play=1&bss_cont_play=0&bss_vid_type=Live%20US%20Mini&bss_pl_num=0&cs_ak_ss=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.34.195 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-19-34-195.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 18:10:40 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/p2?c1=2&c2=6961552&ns_site=bloomberg-stream-test&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=c&ns_st_id=1601057431006_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=0&ns_st_pb=1&ns_st_mp=BPlayer&ns_st_mv=v0.11.194&ns_st_pn=1&ns_st_tp=1&ns_st_li=1&ns_st_ci=LIVE_US_MINI&ns_ts=1601057440045&ns_st_ca=0&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pl=LIVE_US_MINI&ns_st_ep=LIVE_US_MINI&ns_st_ty=Live%20US%20Mini&ns_st_ct=vc13&ns_st_dt=N%2FA&ns_st_pu=Bloomberg&c4=BBG&c5=02&c6=*null&c7=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&c8=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&c9=&bss_user_action=1&bss_iframe=0&playerId=US_MINI&bss_auto_play=1&bss_cont_play=0&bss_vid_type=Live%20US%20Mini&bss_pl_num=0&cs_ak_ss=1
Pragma: no-cache
Date: Fri, 25 Sep 2020 18:10:40 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content b
sb.scorecardresearch.com/ 0
528 B 44ms
33ms Image
text/plain 2.19.34.195
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1601057440091&ns_c=UTF-8&cv=3.5&c8=Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%20-%20Bloomberg&c7=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&c9=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.34.195 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-19-34-195.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 18:10:40 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pmk-202002191.203.js Show response
widget.perfectmarket.com/bloomberg/ 111 KB
30 KB 48ms
38ms Script
application/javascript 151.101.1.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/bloomberg/pmk-202002191.203.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/bloomberg/load.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.181 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 106029003636faa09b2779ca96fb0321bd1f650dfc361ff30049e50e0a67a477

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: oVO1h4ZRLT_GxQ9EwsFilYGp_ui2ys7M
content-encoding: gzip
etag: "d56e8164766727d6ff063747215104d4"
age: 15763612
x-cache: HIT, HIT
status: 200
content-length: 30926
x-amz-id-2: eCctKLV0JuS0bVpEoElbKhYqLIcKwU9B1SIghJie6L1YJQwhCzhRx11rp7XXFHNWF6WYkpNnhh4=
x-served-by: cache-lax8647-LAX, cache-cdg20749-CDG
last-modified: Fri, 27 Mar 2020 07:23:47 GMT
server: AmazonS3
x-timer: S1601057440.140037,VS0,VE0
date: Fri, 25 Sep 2020 18:10:40 GMT
vary: Accept-Encoding,,
x-amz-request-id: 26608FCD3915A43E
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
x-cache-hits: 1, 3208

GET
H3-Q050 200 11782857.ts Show response
liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/ 95 KB
95 KB 161ms
116ms XHR
video/mp2t 2.20.142.234
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/11782857.ts
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2.20.142.234 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-20-142-234.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 524eebf47205be80cf673de92d5bccfc58fdb6892f01bcdb68f7228fe2479428

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:40 GMT
x-amz-request-id: 0B1B95645F968BDF
status: 200
akamai-mon-iucid-del: 528286
alt-svc: h3-Q050=":443"; ma=93600,h3-Q048=":443"; ma=93600,h3-Q046=":443"; ma=93600,h3-Q043=":443"; ma=93600,quic=":443"; ma=93600; v="50,48,46,43"
content-length: 97008
x-amz-id-2: vI4XqT/lI7v0Wqo3Bd5uUPEXFNjojA5VJZ832dT6xDb4/4giAE/uBwontDNhln0qx5VVBZriAU0=
last-modified: Fri, 25 Sep 2020 18:10:04 GMT
server: AmazonS3
etag: "f58fb0b44abcafa7a629667b2cf6f9f0"
access-control-max-age: 3000
access-control-allow-methods: GET,POST,OPTIONS
content-type: video/MP2T
access-control-allow-origin: *
access-control-expose-headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del
cache-control: max-age=86322
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: origin,range,hdntl,hdnts
quic-version: Q050

GET
BLOB 200
OK a1664738-8048-4c51-9be5-3af8968aa9ac
https://www.bloomberg.com/ 60 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.bloomberg.com/a1664738-8048-4c51-9be5-3af8968aa9ac
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e678ab0c5edda133f834c7266f97f851563a0c16e393f636b19d93b1de30bab

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 61254
Content-Type: text/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/bloomberg/pmk-202002191.203.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 5819
date: Fri, 25 Sep 2020 16:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 25 Sep 2020 18:33:41 GMT

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 39ms
31ms Script
application/x-javascript 2.19.34.195
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/bloomberg/pmk-202002191.203.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.34.195 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-19-34-195.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 18:10:40 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 884
Expires: Sat, 26 Sep 2020 18:10:40 GMT

GET
H3-Q050 200 11782858.ts Show response
liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/ 87 KB
87 KB 119ms
119ms XHR
video/mp2t 2.20.142.234
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/11782858.ts
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2.20.142.234 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-20-142-234.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 317234f4d3a2d4ee60adf9d72ceea55b7b4d193a94e6d2bbea5f94f721d8f74d

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:40 GMT
x-amz-request-id: 375E089F276C0DC8
status: 200
akamai-mon-iucid-del: 528286
alt-svc: h3-Q050=":443"; ma=93600,h3-Q048=":443"; ma=93600,h3-Q046=":443"; ma=93600,h3-Q043=":443"; ma=93600,quic=":443"; ma=93600; v="50,48,46,43"
content-length: 88924
x-amz-id-2: pYQxB5O5dZ42K9VcrctjAMlRikMSfsmOViwIYlarwWlxIT4kLBX6dNSDtAcC6KV5yLPujkbHafI=
last-modified: Fri, 25 Sep 2020 18:10:14 GMT
server: AmazonS3
etag: "88eb59cdcf8793bac6815f50692d1c44"
access-control-max-age: 3000
access-control-allow-methods: GET,POST,OPTIONS
content-type: video/MP2T
access-control-allow-origin: *
access-control-expose-headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del
cache-control: max-age=86327
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: origin,range,hdntl,hdnts
quic-version: Q050

GET
H/1.1 200
OK start Show response
infinity-c6.youboranqs01.com/ 0
218 B 39ms
13ms XHR
text/plain 2001:1af8:4700:b081::104
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://infinity-c6.youboranqs01.com/start?accountCode=bloomberg&username=033aa840-f145-486c-9f5a-cd9463a30ace&rendition=320x180%4034Kbps&player=videojs-hlsjs&title=LIVE_US_MINI&live=true&mediaResource=https%3A%2F%2Fwww.bloomberg.com%2Fmedia-manifest%2Fstreams%2Fus.m3u8%3Fprofile%3Dmini&playerVersion=6.13.0&param1=v0.11.194&param2=true&param3=September%2025%2C%202020&param4=long-form&param5=N%2FA&param6=www.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave&param7=LIVE_US_MINI&param8=https%3A%2F%2Fwww.bloomberg.com%2Fmedia-manifest%2Fstreams%2Fus.m3u8%3Fprofile%3Dmini&param9=unsubscribed&param11=WEB&obfuscateIp=false&pluginVersion=6.5.10-videojs-js&pluginInfo=%7B%22lib%22%3A%226.5.20%22%2C%22adapter%22%3A%226.5.10-videojs-js%22%2C%22adAdapter%22%3A%226.5.10-videojs-ads%22%7D&referer=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive&adsExpected=false&deviceUUID=13db5731130bf5ed3699496c62493117&libVersion=6.5.20&playbackType=Live&timemark=1601057440454&system=bloomberg&sessionRoot=U_19160_a53rp1n3ad9jict1_1601057431098&pingTime=15&code=U_19160_a53rp1n3ad9jict1_1601057431098
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:1af8:4700:b081::104 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: NQSInfinity/8.25.4 (v8.25.4) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: 1601057440489
Last-Modified: 1601057440489
Server: NQSInfinity/8.25.4 (v8.25.4)
Access-Control-Allow-Headers: *
Content-Length: 0
Content-Type: text/plain

GET
H/1.1 200
OK joinTime Show response
infinity-c6.youboranqs01.com/ 0
218 B 39ms
13ms XHR
text/plain 2001:1af8:4700:b081::104
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://infinity-c6.youboranqs01.com/joinTime?joinDuration=9355&timemark=1601057440455&system=bloomberg&sessionRoot=U_19160_a53rp1n3ad9jict1_1601057431098&code=U_19160_a53rp1n3ad9jict1_1601057431098
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:1af8:4700:b081::104 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: NQSInfinity/8.25.4 (v8.25.4) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: 1601057440489
Last-Modified: 1601057440489
Server: NQSInfinity/8.25.4 (v8.25.4)
Access-Control-Allow-Headers: *
Content-Length: 0
Content-Type: text/plain

GET
H3-Q050 200 11782859.ts Show response
liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/ 81 KB
81 KB 116ms
115ms XHR
video/mp2t 2.20.142.234
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/11782859.ts
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2.20.142.234 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-20-142-234.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2adae0d4a15ebce5dcad1fd35a90acffe71ea3c8fe24209132211066b7503b54

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:40 GMT
x-amz-request-id: 98F1F3AAD47CF35C
status: 200
akamai-mon-iucid-del: 528286
alt-svc: h3-Q050=":443"; ma=93600,h3-Q048=":443"; ma=93600,h3-Q046=":443"; ma=93600,h3-Q043=":443"; ma=93600,quic=":443"; ma=93600; v="50,48,46,43"
content-length: 82908
x-amz-id-2: Dtqi/WCM+Zb93GOJT77pAorfHPawxQAwaDkdn0PDxCILlCtdaW2YxV99P4Hcb4gOGVhYdqQ2pio=
last-modified: Fri, 25 Sep 2020 18:10:24 GMT
server: AmazonS3
etag: "1626ac20e2ca768a4e54dec657dcba50"
access-control-max-age: 3000
access-control-allow-methods: GET,POST,OPTIONS
content-type: video/MP2T
access-control-allow-origin: *
access-control-expose-headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del
cache-control: max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: origin,range,hdntl,hdnts
quic-version: Q050

GET
H2 204 unip Show response
trc-events.taboola.com/1194877/log/3/ 0
293 B 37ms
36ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1194877/log/3/unip?en=pre_d_eng_tb&tos=10508&scd=39&ssd=1&est=1601057430148&ver=27&isls=true&src=i&invt=6000&tim=1601057440657&vi=1601057430143&ri=bf816f969f9b9f7c1c9e339063428673&sd=v2_7e31f3bfc57117b854369ba9872d5a4c_9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816_1601057430_1601057430_CNawjgYQ_fZIGP-01rPMLiABKAEwDzjpmQdA_4UQSOWG2ANQ____________AVgBYABo4qaqkbKtl-Jw&ui=9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816&ref=null&cv=20200818-2-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1194877/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:40 GMT
server: nginx
x-fastly-to-nlb-rtt: 23107
status: 204
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.bloomberg.com
cache-control: no-cache
access-control-allow-credentials: true
tbl-x-upstream: 10.40.20.9:10213

GET
H2

200

/ Show response
a2.adform.net/Serving/TrackPoint/
Redirect Chain

https://a2.adform.net/Serving/TrackPoint/?pm=1118168&ADFdivider=%7C&ord=930850173237&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&loc=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-...
https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1118168&ADFdivider=%7C&ord=930850173237&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&loc=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F202...

152 B
652 B

113ms
113ms

Script
text/javascript

185.167.164.51
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1118168&ADFdivider=%7C&ord=930850173237&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&loc=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on&us_privacy=1YNN

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.51 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

74ab92b3b4c50b0f2b319b59f939a33093aa660bfc33a167f9a89fb317dbe1b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:40 GMT
content-encoding: gzip
server: nginx
status: 200
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 246
expires: -1

Redirect headers

pragma: no-cache
date: Fri, 25 Sep 2020 18:10:40 GMT
server: nginx
status: 302
location: https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1118168&ADFdivider=%7C&ord=930850173237&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&loc=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on&us_privacy=1YNN
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html; charset=utf-8
expires: -1

GET
H2 200 json Show response
trc.taboola.com/bloomberg/trc/3/ 12 KB
5 KB 229ms
229ms Script
application/javascript 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/bloomberg/trc/3/json?tim=20%3A10%3A40.765&lti=deflated&data=%7B%22id%22%3A190%2C%22ii%22%3A%22https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3A%229cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816%22%2C%22uifp%22%3Anull%2C%22lbt%22%3A1600955174843%2C%22vi%22%3A1601057430143%2C%22cv%22%3A%2220200924-16-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A0%2C%22ga%22%3Atrue%2C%22tcs%22%3A%22CO6QbtEO6QbtEAGABCENA4CgAAAAAGPAAACYAAALzgGAAhAC-AI4AgcBBwEIAIiARYAuoBgQDXgHUAXmAOMgBACOAXmEgAgCOFQAgBHALzHQAgBHAHUIQAwBHAEDAOoSgBACOAOoUgAgHUAA.YAAAAAAAAAAA%22%2C%22gwto%22%3Atrue%2C%22ccpa_ps%22%3A%221---%22%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A3004%2C%22qs%22%3A%22%3Fsref%3DHhue1scO%26utm_source%3DSailthru%26utm_medium%3Demail%26utm_campaign%3DIssue%3A%25202020-09-17%2520Banking%2520Dive%2520%255Bissue%3A29713%255D%26utm_term%3DBanking%2520Dive%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2v%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-d%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A2910.1875%2C%22mw%22%3A830%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200924-16-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 3972ace3fbe26223b4af30e9bc26f4488a2f4ba820c1db1cd7ea2d4f831c5f46

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 199
date: Fri, 25 Sep 2020 18:10:40 GMT
content-encoding: gzip
access-control-allow-origin: *
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 200
x-served-by: cache-hhn4079-HHN
server: nginx
x-timer: S1601057441.784438,VS0,VE199
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H3-Q050 200 11782860.ts Show response
liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/ 87 KB
88 KB 121ms
119ms XHR
video/mp2t 2.20.142.234
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://liveproduseast.akamaized.net/us/Channel-USTV-AWS-virginia-1/Source-USTV-34-1/11782860.ts
Requested by: Host: cdn.gotraffic.net
URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2.20.142.234 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-20-142-234.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1f6da73cc75cd743e73caa8a7cebaf7a86fe0a64851d31d711b86d4d9542f7c8

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:40 GMT
x-amz-request-id: 15776B19C2828E61
status: 200
akamai-mon-iucid-del: 528286
alt-svc: h3-Q050=":443"; ma=93600,h3-Q048=":443"; ma=93600,h3-Q046=":443"; ma=93600,h3-Q043=":443"; ma=93600,quic=":443"; ma=93600; v="50,48,46,43"
content-length: 89488
x-amz-id-2: W0ZCmksdM4v+hGH4dGM4SMWs1Qr07uQRcZmb3LYbE7X0BzDr31CG4nBVGHFIDaNvukAb+Z3v4BA=
last-modified: Fri, 25 Sep 2020 18:10:34 GMT
server: AmazonS3
etag: "c1ce4820e01e246a8df57ae20714838f"
access-control-max-age: 3000
access-control-allow-methods: GET,POST,OPTIONS
content-type: video/MP2T
access-control-allow-origin: *
access-control-expose-headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del
cache-control: max-age=86392
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: origin,range,hdntl,hdnts
quic-version: Q050

GET
H2 200 tb Show response
15.taboola.com/ 4 KB
3 KB 45ms
42ms Script
text/html 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://15.taboola.com/tb?oid=15&pubnm=bloomberg&unitType=226&tbloc=&pageType=text&pstn=Below%20Article%20Thumbnails&uuip=&cisrf=&cirf=https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave&encoded=1&uid=9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816&variant=570735|23&callback=TRC.videoTagCallbacks.videoCallback1&cb=1601057441079&tagid=&cntry=AT&platform=1&normp=7&sesid=aa8480ee5c863749ace9b3c99ab71356&itemid=https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave&viewid=1601057430143&geolat=&geoing=&deviceifa=&appid=&sd=v2_aa8480ee5c863749ace9b3c99ab71356_9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816_1601057440_1601057440_CNawjgYQxAEY_7TWs8wuIAEoBDAPOOmZB0D_hRBI5YbYA1D___________8BWAFgAGjipqqRsq2X4nA&ri=cad2a0d6acd508a0be19d53f02a2d24b&appname=&cdb=CO6QbtEO6QbtEAGABCENA4CgAAAAAGPAAACYAAALzgGAAhAC-AI4AgcBBwEIAIiARYAuoBgQDXgHUAXmAOMgBACOAXmEgAgCOFQAgBHALzHQAgBHAHUIQAwBHAEDAOoSgBACOAOoUgAgHUAA.YAAAAAAAAAAA&gdprApplies=true&rid=&sii=7587735682195027024&oee=true&tpubid=196&uis=4&fagg=1&ccpaDns=false&ccpaPrivacy=1---&region=9&hasGDPRConsent=false&tcfVersion=2&cmpStatus=0
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200924-16-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 24cd4901483590fb2b46bb243afb2bdf1bdbfc2e46217f26110d1e3effe68135

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:41 GMT
content-encoding: gzip
machineid: 1416
x-cache: MISS
status: 200
x-cache-hits: 0
x-served-by: cache-hhn4079-HHN
pragma: no-cache
server: nginx
x-timer: S1601057441.099687,VS0,VE13
vary: Accept-Encoding
content-type: text/html;charset=ISO-8859-1
via: 1.1 varnish
cache-control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
accept-ranges: bytes
link: <https://am-wf.taboola.com>; rel=preconnect
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 204 social
trc.taboola.com/bloomberg/log/3/ 0
249 B 52ms
48ms Image
image/gif 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/bloomberg/log/3/social?route=AM:AM:V&tvi2=3454&lti=deflated&ri=cad2a0d6acd508a0be19d53f02a2d24b&sd=v2_aa8480ee5c863749ace9b3c99ab71356_9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816_1601057440_1601057440_CNawjgYQxAEY_7TWs8wuIAEoBDAPOOmZB0D_hRBI5YbYA1D___________8BWAFgAGjipqqRsq2X4nA&ui=9cfd8753-a4a1-45a0-b8b7-2331cebee771-tuct667b816&pi=https%3A//www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave&wi=7587735682195027024&pt=text&vi=1601057430143&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.bloomberg.com%2Fnews%2Farticles%2F2020-09-16%2Fcitigroup-employee-who-operated-qanon-website-on-paid-leave%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22%22%2C%22hdl%22%3A%22Citigroup%20Employee%20Who%20Operated%20QAnon%20Website%20on%20Leave%22%2C%22sec%22%3A%22business%22%2C%22aut%22%3A%5B%22William%20Turton%22%2C%22Jennifer%20Surane%22%5D%2C%22img%22%3A%22https%3A%2F%2Fassets.bwbx.io%2Fimages%2Fusers%2FiqjWHBFdfxIU%2FieVzMbEanwh4%2Fv1%2F1200x800.jpg%22%2C%22v%22%3A15%2C%22pw%22%3Afalse%7D%5D%7D&tim=20%3A10%3A41.089&id=6961&llvl=1&cv=20200924-16-RELEASE&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 204
x-served-by: cache-hhn4079-HHN
pragma: no-cache
server: nginx
x-timer: S1601057441.122639,VS0,VE9
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 d80ccfd2d1588ab6856dc482528ab290.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 23 KB
23 KB 38ms
34ms Image
image/jpeg 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d80ccfd2d1588ab6856dc482528ab290.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 997cc8e91d015750e25d4013eb4dfacf869dde4b21664ad53265cd0bdc9cc704

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 4948799
edge-cache-tag: 315230801992530787157955754224955330622,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d80ccfd2d1588ab6856dc482528ab290.png
content-length: 23111
x-request-id: f7a51e7150fc1d63c5fc0f103f8b2179
x-served-by: cache-dca17768-DCA, cache-dca17754-DCA, cache-hhn4079-HHN
last-modified: Thu, 07 May 2020 14:35:44 GMT
server: cloudinary
x-timer: S1601057441.124091,VS0,VE1
etag: "716159aab5e543990049bd15fd1a89cb"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 1

GET
H2 200 9c81ab97ce3b97cbd3e79c67f5ee4fd3.jpg
images.taboola.com/taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_600,y_519/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 38 KB
38 KB 42ms
39ms Image
image/jpeg 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_600,y_519/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9c81ab97ce3b97cbd3e79c67f5ee4fd3.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f2c4c540c58fc5ff231605b7cc2a6951cd9de3bc77726a116923b91f99c6e3e3

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 100452
edge-cache-tag: 330692812114857104601061048538399215153,310378507630422936931725226023176136423,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sun, 27 Sep 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_600,y_519/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9c81ab97ce3b97cbd3e79c67f5ee4fd3.jpg
content-length: 38422
x-served-by: cache-dca17752-DCA, cache-dca17760-DCA, cache-hhn4079-HHN
last-modified: Thu, 27 Aug 2020 15:35:48 GMT
server: cloudinary
x-timer: S1601057441.124089,VS0,VE1
etag: "21e2dc25708a6e8547561231bebda46d"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1

GET
H2 200 f474365cff6e89cb4df22ae1e68116da.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 23 KB
23 KB 40ms
36ms Image
image/jpeg 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f474365cff6e89cb4df22ae1e68116da.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 60db6a006ecbf9e8bd5d5e92c9ea12416e31f195e919fff8b5ade64f9ecf1e0a

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 6416484
edge-cache-tag: 496545423169548874064755903911186646119,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f474365cff6e89cb4df22ae1e68116da.jpg
content-length: 23510
x-request-id: 53a57b45f58fac936fdb9a22f092e3ba
x-served-by: cache-dca17746-DCA, cache-dca17754-DCA, cache-hhn4079-HHN
last-modified: Thu, 02 Jul 2020 10:16:51 GMT
server: cloudinary
x-timer: S1601057441.124129,VS0,VE1
etag: "eefc45c7c2e37a9f9a6e9e61d7486136"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1

GET
H2 200 c6729bb4b4e9935d453b71c087a1fc1d.jpg
images.taboola.com/taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_580,y_247/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 34 KB
34 KB 34ms
31ms Image
image/jpeg 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_580,y_247/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6729bb4b4e9935d453b71c087a1fc1d.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 581ea5092433dac719d02dfe810f9cf048b09c9ed0d99482db1719fecd228183

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 1333106
edge-cache-tag: 524641542150083079984288753916762817050,527416689876274310757745448266265808885,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 02 Oct 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, MISS, HIT
x-debug: /taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_580,y_247/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6729bb4b4e9935d453b71c087a1fc1d.jpg
content-length: 34574
x-served-by: cache-dca17752-DCA, cache-dca17779-DCA, cache-hhn4079-HHN
last-modified: Tue, 01 Sep 2020 13:23:10 GMT
server: cloudinary
x-timer: S1601057441.124154,VS0,VE0
etag: "5267cebfac65cd783e3be1fd9173e919"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 65

GET
H2 200 e7f2dc9bb5bff0b7cf7f2a89c7077a94.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 16 KB
16 KB 37ms
34ms Image
image/jpeg 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e7f2dc9bb5bff0b7cf7f2a89c7077a94.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 4afeb9726ded7093a438b77ed66b1feb4a50b0f7d3a4aad785b3f2eebef54989

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 5865408
edge-cache-tag: 599269604718071095157781445453133414981,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e7f2dc9bb5bff0b7cf7f2a89c7077a94.jpg
content-length: 16337
x-request-id: 821f64b07382b13a2895cda45f9aef98
x-served-by: cache-dca17760-DCA, cache-dca17775-DCA, cache-hhn4079-HHN
last-modified: Sat, 18 Jul 2020 11:10:41 GMT
server: cloudinary
x-timer: S1601057441.124215,VS0,VE1
etag: "5562602cdfeafe9492c9971c3aecf264"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1

GET
H2 200 1f7e0ee38ac5e7f75f28f4edbf3452c9.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 49 KB
49 KB 41ms
38ms Image
image/jpeg 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1f7e0ee38ac5e7f75f28f4edbf3452c9.jpeg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 23aea1002be69f94bca1074535fa4cf8233316cc51ab898eb3265164ac29823f

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 1
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 5570516
edge-cache-tag: 522371784233386667397516713562002035343,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 14 Aug 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1f7e0ee38ac5e7f75f28f4edbf3452c9.jpeg
content-length: 49809
x-served-by: cache-dca17735-DCA, cache-dca17745-DCA, cache-hhn4079-HHN
last-modified: Tue, 14 Jul 2020 07:57:39 GMT
server: cloudinary
x-timer: S1601057441.124190,VS0,VE1
etag: "0878223cea4023d63fee1ec5d4f24535"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 1

GET
H2 200 UnitWidgetItemDesktop.min.js Show response
vidstat.taboola.com/lite-unit/1.4.0/ 79 KB
24 KB 38ms
33ms Script
application/javascript 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/lite-unit/1.4.0/UnitWidgetItemDesktop.min.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200924-16-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e92552bc193c8bae835c7b6db6eea8a39593fa14fb75a227f738c415330cc84e

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 d76fac2b5a2f460a1cbffb76189f59ef.cloudfront.net (CloudFront), 1.1 varnish
age: 2436658
x-cache: Miss from cloudfront, HIT
status: 200
content-encoding: gzip
content-length: 23743
x-served-by: cache-hhn4079-HHN
last-modified: Tue, 31 Mar 2020 13:14:35 GMT
server: AmazonS3
x-timer: S1601057441.149820,VS0,VE0
etag: "b683c290896a82c974838a04b4ea4aff"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA54
accept-ranges: bytes
access-control-allow-headers: *
x-amz-cf-id: rWThPURkOAKBpP7XHI7BAIYUdutJp3HVfT3e6u8bbILB24yOvOuQTQ==
x-cache-hits: 56906

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d80ccfd2d1588ab6856dc482528ab290.png
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 997cc8e91d015750e25d4013eb4dfacf869dde4b21664ad53265cd0bdc9cc704

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 4948799
edge-cache-tag: 315230801992530787157955754224955330622,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d80ccfd2d1588ab6856dc482528ab290.png
content-length: 23111
x-request-id: f7a51e7150fc1d63c5fc0f103f8b2179
x-served-by: cache-dca17768-DCA, cache-dca17754-DCA, cache-hhn4079-HHN
last-modified: Thu, 07 May 2020 14:35:44 GMT
server: cloudinary
x-timer: S1601057441.167005,VS0,VE0
etag: "716159aab5e543990049bd15fd1a89cb"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f474365cff6e89cb4df22ae1e68116da.jpg
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 60db6a006ecbf9e8bd5d5e92c9ea12416e31f195e919fff8b5ade64f9ecf1e0a

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 6416484
edge-cache-tag: 496545423169548874064755903911186646119,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f474365cff6e89cb4df22ae1e68116da.jpg
content-length: 23510
x-request-id: 53a57b45f58fac936fdb9a22f092e3ba
x-served-by: cache-dca17746-DCA, cache-dca17754-DCA, cache-hhn4079-HHN
last-modified: Thu, 02 Jul 2020 10:16:51 GMT
server: cloudinary
x-timer: S1601057441.166976,VS0,VE0
etag: "eefc45c7c2e37a9f9a6e9e61d7486136"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_580,y_247/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6729bb4b4e9935d453b71c087a1fc1d.jpg
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 581ea5092433dac719d02dfe810f9cf048b09c9ed0d99482db1719fecd228183

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 1333106
edge-cache-tag: 524641542150083079984288753916762817050,527416689876274310757745448266265808885,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 02 Oct 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, MISS, HIT
x-debug: /taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_580,y_247/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6729bb4b4e9935d453b71c087a1fc1d.jpg
content-length: 34574
x-served-by: cache-dca17752-DCA, cache-dca17779-DCA, cache-hhn4079-HHN
last-modified: Tue, 01 Sep 2020 13:23:10 GMT
server: cloudinary
x-timer: S1601057441.167017,VS0,VE0
etag: "5267cebfac65cd783e3be1fd9173e919"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0, 66

GET
H2 200 e7f2dc9bb5bff0b7cf7f2a89c7077a94.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 16 KB
17 KB 35ms
35ms Image
image/jpeg 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e7f2dc9bb5bff0b7cf7f2a89c7077a94.jpg
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 4afeb9726ded7093a438b77ed66b1feb4a50b0f7d3a4aad785b3f2eebef54989

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 5865408
edge-cache-tag: 599269604718071095157781445453133414981,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200, 200 OK
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e7f2dc9bb5bff0b7cf7f2a89c7077a94.jpg
content-length: 16337
x-request-id: 821f64b07382b13a2895cda45f9aef98
x-served-by: cache-dca17760-DCA, cache-dca17775-DCA, cache-hhn4079-HHN
last-modified: Sat, 18 Jul 2020 11:10:41 GMT
server: cloudinary
x-timer: S1601057441.166955,VS0,VE0
etag: "5562602cdfeafe9492c9971c3aecf264"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_600,y_519/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9c81ab97ce3b97cbd3e79c67f5ee4fd3.jpg
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f2c4c540c58fc5ff231605b7cc2a6951cd9de3bc77726a116923b91f99c6e3e3

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 100452
edge-cache-tag: 330692812114857104601061048538399215153,310378507630422936931725226023176136423,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sun, 27 Sep 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/h_225,w_400,c_fill,g_xy_center,x_600,y_519/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9c81ab97ce3b97cbd3e79c67f5ee4fd3.jpg
content-length: 38422
x-served-by: cache-dca17752-DCA, cache-dca17760-DCA, cache-hhn4079-HHN
last-modified: Thu, 27 Aug 2020 15:35:48 GMT
server: cloudinary
x-timer: S1601057441.179765,VS0,VE0
etag: "21e2dc25708a6e8547561231bebda46d"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1f7e0ee38ac5e7f75f28f4edbf3452c9.jpeg
Requested by: Host: www.bloomberg.com
URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 23aea1002be69f94bca1074535fa4cf8233316cc51ab898eb3265164ac29823f

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Fri, 25 Sep 2020 18:10:41 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
age: 5570516
edge-cache-tag: 522371784233386667397516713562002035343,509885950225721390403752075998018931079,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 14 Aug 2020 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_225%2Cw_400%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1f7e0ee38ac5e7f75f28f4edbf3452c9.jpeg
content-length: 49809
x-served-by: cache-dca17735-DCA, cache-dca17745-DCA, cache-hhn4079-HHN
last-modified: Tue, 14 Jul 2020 07:57:39 GMT
server: cloudinary
x-timer: S1601057441.179926,VS0,VE0
etag: "0878223cea4023d63fee1ec5d4f24535"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1, 2

POST
H2 204 bulk Show response
trc.taboola.com/bloomberg/log/3/ 0
316 B 40ms
39ms XHR
image/gif 151.101.113.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/bloomberg/log/3/bulk?tvi2=3454&route=AM%3AAM%3AV&lti=deflated&bulkSize=1
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20200924-16-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-vcl-time-ms: 9
date: Fri, 25 Sep 2020 18:10:42 GMT
via: 1.1 varnish
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 204
x-served-by: cache-hhn4079-HHN
pragma: no-cache
server: nginx
x-timer: S1601057442.119979,VS0,VE9
content-type: image/gif
access-control-allow-origin: https://www.bloomberg.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: collector-px8fcgygk4.px-cloud.net
URL: https://collector-px8fcgygk4.px-cloud.net/api/v1/collector

Verdicts & Comments Add Verdict or Comment

225 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

36 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sourcepointcmp.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_lt Value: 1:
sourcepointcmp.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_ss Value: 1:H4sIAAAAAAAAAItWqo5RKimOUbKKxmDklebk6MQopSKxS8AS1bW1sSRLKOlgWkWWDUqxAPK1Ytu1AAAA
.bloomberg.com/	1970-01-19 21:29:53	Name: signedLspa Value: false
.bloomberg.com/	1970-01-19 21:29:53	Name: ccpaApplies Value: true
sourcepointcmp.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_consent Value: 1!-1:-1:-1:-1
.bloomberg.com/	1970-01-19 21:29:53	Name: dnsDisplayed Value: true
.bloomberg.com/	1970-01-19 21:29:53	Name: ccpaUUID Value: 27456f1d-b654-4119-92fe-82789953b2f5
sourcepointcmp.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_uid Value: 1:909:d96733f9-2363-438d-b86c-378ac8892664
www.bloomberg.com/	1970-01-19 12:44:17	Name: _pxff_cc Value: U2FtZVNpdGU9TGF4Ow==
.bloomberg.com/	1970-01-19 21:29:53	Name: _pxvid Value: 645716b1-ff5a-11ea-b5c5-ab830e320593
www.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_consent Value: 1!0:-1:-1:-1
.bloomberg.com/	1970-01-19 13:07:41	Name: _uetvid Value: 718fe39887d88aaef8dd1030b02776d2
.bloomberg.com/	1969-12-31 23:59:59	Name: _reg-csrf-token Value: CM273GjR-2_J2YRcMElT55wQy9w1aBRJB55A
www.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_lt Value: 1:
www.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_csv Value: null
.bloomberg.com/	1970-01-19 12:45:43	Name: _uetsid Value: 7985d2d275d4a30a27a3cd29cce16f4e
www.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_data Value: 2:197212:1601057429:0:1:0:1:0:0:_:-1
.bloomberg.com/	1970-01-19 12:44:17	Name: _px3 Value: 7397b8866b1baecb94e5c1d18e8d9e0bbb6f347debf618a41dfb85c118ae0bf1:ZKP/sasMZUm6BH44UfuhhBImp6bblQPAVNyVk3PDwkRXDDLWC4nOFTkhDiiRJNSwYlznoH9wwMYHUgkCpAlbvQ==:1000:MDXj6jX42r1CEEgkUqnLXPqdzzgm8e/CRSPR7ZsDYrNaaf/OKQVL7m0Xh2S8dHAEptI1gtLuZ5GHreNKpKOSD27+A5lBv4saFcMdvndNGq6SbMZrFkNazX28aH7X6GkfxtDdk0HnGc+5OoJ0/6MWtZwLBgBjYmOPRgkYT3DiTSY=
.bloomberg.com/	1970-01-19 14:53:53	Name: _gcl_au Value: 1.1.498437788.1601057430
.bloomberg.com/	1970-01-19 12:44:17	Name: _pxde Value: 09130abeacb798ff5b665b5b7904d8f31092c34bc49d35f6a3c8d7aed11a67d7:eyJ0aW1lc3RhbXAiOjE2MDEwNTc0MzA0NTAsImZfa2IiOjAsImlwY19pZCI6W119
.bloomberg.com/	1970-01-19 12:44:17	Name: _px2 Value: eyJ1IjoiNjUxMWRiMzAtZmY1YS0xMWVhLWJhYWMtMjEyODMxY2IzZTMzIiwidiI6IjY0NTcxNmIxLWZmNWEtMTFlYS1iNWM1LWFiODMwZTMyMDU5MyIsInQiOjE2MDEwNTc3MzA0NDksImgiOiI2ZDJmOGM5N2EyMTJiN2EwNzZmZmFmMjhhM2VkOGEzNGFhMGYzMDI5YjQ5NmYzZjA5ODFlZmMzMzMzNDIwYWNlIn0=
www.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_opt Value: 1:
sourcepointcmp.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_data Value: 2:197212:1601057429:0:1:0:1:0:0:b0d7d095-805b-4c51-a4de-e26d5e615674:-1
www.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_uid Value: 1:527:a0c68c1b-1b15-4ace-8568-e8c4f3fcbd8e
.bloomberg.com/	1970-01-19 21:29:53	Name: session_id Value: 033aa840-f145-486c-9f5a-cd9463a30ace
.bloomberg.com/	1970-01-19 14:53:53	Name: _sp_krux Value: false
.www.bloomberg.com/	1970-01-19 21:29:53	Name: bb_geo_info Value: {"country":"AT","region":"Europe"}\|1601662230098
.bloomberg.com/	1969-12-31 23:59:59	Name: _user-status Value: anonymous
www.bloomberg.com/	1970-01-19 21:29:53	Name: consentUUID Value: 1dfac0d6-4f01-42a0-ba5d-5a4dafae4038
www.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_ss Value: 1:H4sIAAAAAAAAAItWqo5RKimOUbKKxsrIAzEMamN1YpRSQcy80pwcILsErKC6lgwJpVgAEA5-UnQAAAA%3D
.bloomberg.com/	1970-01-19 21:29:53	Name: session_key Value: abec322c82e4331a31f0c18a390f78e099724b94
sourcepointcmp.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_opt Value: 1:
.bloomberg.com/	1970-01-19 21:29:53	Name: agent_id Value: 450fd463-4589-41d2-87e0-ed704f7da749
sourcepointcmp.bloomberg.com/	1970-01-19 13:27:29	Name: _sp_v1_csv Value: null
.bloomberg.com/	1969-12-31 23:59:59	Name: _reg-csrf Value: s%3A7JkMQmtwbIJ0_XzfvifNFlcP.A8B1CGA5dmbGWUKSK1CoJpjXySJTlM0DupPyrdPe99g
www.bloomberg.com/	1969-12-31 23:59:59	Name: _pxhd Value: 3e2795f5122adf941b4e7e069802974931e81d2d6620d62cbfbe2b1dab96013a:645716b1-ff5a-11ea-b5c5-ab830e320593

17 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://assets.bwbx.io/s3/javelin/public/javelin/js/sparkle/initialize/initialize_sparkle-e986310fe9.js(Line 20) Message: [ms.consent] Called `waitForUserConsent` V2 [object Object]
console-api	warning	URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive(Line 245) Message: [navi/cmp] CMP UI is shown, waiting for user consent
console-api	log	URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive(Line 340) Message: [navi/cmp] Successfully injected footer link [object HTMLButtonElement]
console-api	log	URL: https://cdn.privacy-mgmt.com/wrapperMessagingWithoutDetection.js(Line 1) Message: Messaging without detection successfully executed.
console-api	log	URL: https://assets.bwbx.io/s3/fence/v4/app.bundle.js(Line 28) Message: FENCE:iUBE=true;sD=undefined;
console-api	log	URL: https://cdn.gotraffic.net/projector/latest/bplayer.js(Line 1) Message: Geo IP client is already intialized.
console-api	log	URL: https://cdn.gotraffic.net/projector/latest/bplayer.js(Line 1) Message: [ms.consent] Called `waitForUserConsent` V2 [object Object]
console-api	log	URL: https://cdn.gotraffic.net/projector/v0.11.194/vendor.js(Line 1) Message: Geo IP client is already intialized.
console-api	log	URL: https://ccpa.sp-prod.net/ccpa.js(Line 1) Message: CCPA script successfully executed.
console-api	error	URL: https://assets.bwbx.io/s3/navi/js/breaking-news-app-94695c75d3db48de1996.js(Line 1) Message: SyntaxError: Unexpected token < in JSON at position 0
console-api	warning	URL: https://www.bloomberg.com/news/articles/2020-09-16/citigroup-employee-who-operated-qanon-website-on-paid-leave?sref=Hhue1scO&utm_source=Sailthru&utm_medium=email&utm_campaign=Issue:%202020-09-17%20Banking%20Dive%20%5Bissue:29713%5D&utm_term=Banking%20Dive(Line 343) Message: [navi/cmp] Footer link was not found or was already injected [object HTMLButtonElement]
console-api	error	URL: https://cdn.gotraffic.net/projector/latest/bplayer.js(Line 1) Message: [BVP] DaiUtil: Dai plugin will not be initialized. DAI asset key not present
console-api	error	URL: https://cdn.gotraffic.net/projector/latest/bplayer.js(Line 1) Message: [BVP] DaiUtil: Dai plugin will not be initialized. DAI asset key not present
console-api	log	URL: https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js(Line 11) Message: ServiceWorker registration successful with scope: https://www.bloomberg.com/
console-api	log	URL: https://assets.bwbx.io/s3/navi/js/header-7aa56254ad154fafc945.js(Line 8) Message: Notification is not supported
console-api	log	URL: https://assets.bwbx.io/s3/javelin/public/javelin/js/components/blens/blens-fb2528f431.js(Line 1) Message: TypeError: Cannot read property 'snippets' of undefined
console-api	error	URL: https://cdn.gotraffic.net/projector/latest/bplayer.js(Line 1) Message: [BVP] SuperBurst: Error retrieving superburst data Error: Promise timeout

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' http://.bloomberg.com https://.bloomberg.com upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

15.taboola.com
a-fds.youborafds01.com
a2.adform.net
ads.avct.cloud
ads.avocet.io
aka.spotxcdn.com
analytics.twitter.com
api.rlcdn.com
assets.bwbx.io
bat.bing.com
ccpa.sp-prod.net
cdn.brandmetrics.com
cdn.gotraffic.net
cdn.privacy-mgmt.com
cdn.taboola.com
cdnjs.cloudflare.com
collector-px8fcgygk4.px-cloud.net
collector.brandmetrics.com
d2p3zdq8vjvnxd.cloudfront.net
geo.moatads.com
googleads.g.doubleclick.net
images.taboola.com
imasdk.googleapis.com
infinity-c6.youboranqs01.com
js-sec.indexww.com
js.spotx.tv
link.bankingdive.com
liveproduseast.akamaized.net
location.bloomberg.com
login.bloomberg.com
mb.moatads.com
mid.rkdms.com
personalization.bloomberg.com
px.ads.linkedin.com
px.moatads.com
s.yimg.com
s2.adform.net
sb.scorecardresearch.com
securepubads.g.doubleclick.net
snap.licdn.com
sourcepointcmp.bloomberg.com
static.ads-twitter.com
static.adsafeprotected.com
t.co
trc-events.taboola.com
trc.taboola.com
vidstat.taboola.com
widget.perfectmarket.com
www.bloomberg.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
collector-px8fcgygk4.px-cloud.net
104.108.39.139
104.244.42.195
104.244.42.69
141.226.228.48
143.204.94.111
151.101.1.181
151.101.112.157
151.101.113.44
151.101.113.73
151.101.129.73
172.217.21.226
172.217.23.162
185.167.164.51
185.94.180.127
2.19.34.195
2.20.142.234
2001:1af8:4700:b081::104
2001:1af8:4700:b214::100
2600:9000:206e:8200:13:7ad6:7840:21
2600:9000:2182:5600:8:48e:53c0:93a1
2606:4700:20::681a:447
2606:4700:20::ac43:45f7
2606:4700::6811:4e6b
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:800::2002
2a00:1450:4001:802::2002
2a00:1450:4001:802::200a
2a00:1450:4001:809::2008
2a00:1450:4001:818::2003
2a00:1450:4001:820::200e
2a00:1450:4001:824::2004
2a02:26f0:10c:582::25ea
2a05:f500:10:101::b93f:9105
3.20.41.86
3.215.9.17
3.9.96.171
34.238.7.196
34.240.2.137
34.251.197.102
35.244.174.68
37.157.2.244
52.166.113.188
69.187.26.120
95.100.196.125
95.100.197.246
95.100.197.53
99.86.243.21
99.86.243.79
00aaabb6830948b0953348d009dac13305dc3e7b9bf04a54b70582dafd0e7fcd
00f82b8ec44397dad10fa2060f4cbdf69f1086320fadcdf0b7e6b370cde03c9b
04864a1fb8441e20967ec9c1b183fbf6a2f1e247a0d3dc38caa718021c6e2e74
0604e1347945a5561c8176d5eb7ad5db2d70a3494ccd72267b572e99c6f07a3a
09865360ac583fbc9a02b2dc28bbd5a632fc10ca5dd4affd3116e07c709adce5
0c1724e1aad9bff038e162b0a460401145f49895313f56ac55a775ea8ce0b248
0e678ab0c5edda133f834c7266f97f851563a0c16e393f636b19d93b1de30bab
100a7cdb7f97df6f52d696c863edaf1bb8836f805f076425a5c62e9eb8a0e64f
106029003636faa09b2779ca96fb0321bd1f650dfc361ff30049e50e0a67a477
13f07e4a2a1699b8dfc0b0ee14014fba6e822a778155a62ac588225ff8fe068a
1957282ebd27f3a96f88ce696c39994823162808b499210e5aaaf3695cf1c524
1f6da73cc75cd743e73caa8a7cebaf7a86fe0a64851d31d711b86d4d9542f7c8
208a937d171175f31e566e0f8bbb0ee28ceb054bea28d4a2cf3d91b339222c06
22dd7088cef636c1099138bc561355f6288bcaffd81554d2a94cf2b0ffe41e0b
234c5911c544c5bc6215f14db6cf3fe713a3f97224b7e017ee07acf32fe2e4df
23aea1002be69f94bca1074535fa4cf8233316cc51ab898eb3265164ac29823f
24cd4901483590fb2b46bb243afb2bdf1bdbfc2e46217f26110d1e3effe68135
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
24ef3b95681e9c84c0d6698d69b3f06d252d76d28d51dc81e71c9853cb918ede
268b144023aa4864bac4de593bb2f744153d90041623327d90d74adf73ee9221
27ab02fc09609aecbf3650c6dddbd427ccd7b3ee2cedad7c8e450cbcdc1ac938
2840b8bb4e008090a8a5d53d0e20379dfcbbf408ed0df333b439352ff6518c12
28f611ea2851c54eccda0ac7fe2982c718a90b9d39235a0fc0e680fe67aa7663
2adae0d4a15ebce5dcad1fd35a90acffe71ea3c8fe24209132211066b7503b54
2b33c970740a7a47e42e700528757634dac34f14bfe3023a5c04f61ad7368fb2
2b5c00c3a83ef371a7f16f678ff8ded85a9f286462a4244a474a7ef13eb88a1c
2e03e51fd56a4906e0a8ff9aa2b88318dd9d4ce24a5aa24b18a00697389ba491
2e1f840b0392ee0449f2d2e7f44123efaebe36e476d35be346ec6634ef0367fc
2f7d9fdb5c4a202c37622ec3a3c55f72ba89e2434417d2e8200bf94c9e5ff6a8
2fc8ede3a6853490cf0b81c02f636b3708437d47dcbd87e3fe18d505c87621b0
2fef7eaa941cf41e2f0ec7e9c8dca35b6459d575d32dc1c121ca06822c175eb1
317234f4d3a2d4ee60adf9d72ceea55b7b4d193a94e6d2bbea5f94f721d8f74d
31c7c8bbc637de46572e374a6a6d4f1119dcfbdba7a8524952da22766042a63f
34637930d2503a6ad23a9430d2ebcd6f846d205437de97939ec1db47c5f8011f
350c16e33f84249456c66b31db96acea667cf04a97bd53eabbbf86b781fee81b
36ce7e2a8573961b9d4eb7377f293a1487af673156a2d47c3f212de3f306e380
374fa3ad95eab7210f5d8d93138ea4e294ef2c2e8baeb3e46580aa6f8652819f
3972ace3fbe26223b4af30e9bc26f4488a2f4ba820c1db1cd7ea2d4f831c5f46
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3be81ab15cc2905d3ef54418cd0fa664e85d19c4a5550e28b071a39bd1316070
3c96b02874509fbf27f45a72d80b9fe5a15e17bb5b426f2d633128fe99cf3acc
3d94e830e57298508f497d2671ba42c4aa83d5a1b534c9389750b634b0717a6b
403572c0908420a46398abc4ce265baa05cc5216e86c8a4e44cc4702a56779a5
41aa5e6364e7f4ef529a923366c3be98c7b2e325642f76e968af9a8b52c6698a
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
458616a44952673f11b71829ed175f779bc81b9c07813b7fa52b361faff5e5c9
49ded0b7452c5a72c085bf827a174776516e16aba8c6405034667e9da15a3030
4a7a7a7ea181235c8976b8026775fe5589ee7bd2204d3d1207284f56dfe19fc2
4afeb9726ded7093a438b77ed66b1feb4a50b0f7d3a4aad785b3f2eebef54989
4b77569a515f522bbfe719742ae791aefbf7b48540461b0660fdc78183d2de28
4cd235403fb67f8ada0e7ad0350eb866039e94bd9e02766998b75369ec04863d
4d27e8a84fa4c46454c95e2836facc979fee492671ab77ba64f60a7a08a2a286
4d6f4b49a31c43a76d5fb6e08431ec59336962b0454dd61228df343005f46120
4f00b7c9097ac1c7661f126d5fcc494efec22745d53a1d5294027db2a7c382ab
5143d14ad653d26462cb7046044bba8c7623cddc3c309ab4e9e5c0f11ac6893e
524eebf47205be80cf673de92d5bccfc58fdb6892f01bcdb68f7228fe2479428
52e4128c67131ac27cbf6a7b17f8211701f2db361649fcadcd96eac1bbc9b58e
5398cbdbc1cda4ed250f2cca60bafc45be628302814896a889c3b3b7f8c6945b
581ea5092433dac719d02dfe810f9cf048b09c9ed0d99482db1719fecd228183
5ab720dcbb4e7547f395bdf8483f5f7f9f030dfedac751704e709d5b86a04641
5af27ea6d562e2008bcc88d1aed3d4dd7dc6f5b27485e5627d56757e5c450f1c
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5d9e5a4f49925ca2d0a2801abe9c715483c801a5364e9cf155346c4fcd273707
5dd17270071ae30f05d3853c3e629d583d98e0d5c4063127a764400ce4d31262
5de76dcf29d7f9b70473a6388dc3b898a6e57bf70c3d126eb2b0cd7b4cdac9a5
5f02ae55075b9482bdf16fd5261fc018d3d1d92e7f041343d0819a632fb29275
5faed683d93b161c611f86535a2e4613be5c9e2e2f7de88eecb3cefd90b0291f
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
60db6a006ecbf9e8bd5d5e92c9ea12416e31f195e919fff8b5ade64f9ecf1e0a
610e73f0f23a30a34f174414bb5b1eb3f45d7d5225b57a8adcdd82e62e4d53ba
61e406410e258554e3b6091ca78f1d01d2e6cb95bcf52601b2a48d1f15598257
63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478
6463927d3579e6e4da275df7c07b60e6010d8a981b0d4463a6927f533dc922ae
68059a851de1dd7aa643366554af5b5f08f0c8f1a6d69eda1042a05bdd75aa1c
68b77b6ce4483e660a432e50e175ff2676d3a9d1381e2f699f89b6eb28d8802c
694caab4d44df324c9903efa250d6d4f465bcc92294831e3fd7d77d3a9728fff
69f0a19068eadca038756a250c791b2a552c4f9e7a949ff685c3f8a9998d1cb2
6aeefdb969d5d2bdeaf54e75f26fd54a33c486bf4aebbf555fad2c058581ebe8
6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b
6e9b581e90a0da254f7fb65d5e442e40236939da6cbb08adee4d3bf6a92a7eae
70dad2e007c709457ef13362f10063b458c0f57c25109a8f55042b7a6cebae1b
738bd4902074f833106b1515554d06dcbc383768d4a3e74fbd095eac4d01f826
73b724042bd2a974f2922448d6c21daa3a1e61fb6a9740bc9a19b83111c62c59
73bdc967f28ba0c614595fb4bd489e949adbc641fa71e3507cfd52acb7da7346
749e2675e3613c6b36394312229caf79169c3a0b2e12461c833d6e5dd007982d
74ab92b3b4c50b0f2b319b59f939a33093aa660bfc33a167f9a89fb317dbe1b9
74c97a4524fbda3dc83d66f62c17a6ab36bd8e290648ba30fd4970a024ecb0a7
74ecc2ed26ffded407a0e68802072c078c9e14bf4284088d46ba0f40f7f374db
750c01314d6d8774ba04e0dbafbf74442e4d184837460b385aa18ff1e5c84366
753e77748eeda3818828e822ec2da8a4a1839216ed64069e782694953c491f52
755a8a0995741b1336a05aa1025d57596dda66417f3a70caed1765e7f86c1c62
7cdf26d0fada59d255be00f4d68e5e5ff851b0895986eeaedc60d1729c09b3cd
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
82af90c3f768db464e87133135b9bb71b98142b3659a300724bf3ce2358b14f4
83359cd4f0c8219d1ace2ea58c6702f1cd81b30b1462ad3b08524dcfab326ba0
8457010484c1c7b66831720c0a9ad0387464f1fa5eb525602fe2981530c84923
850233c0e37e99e62a6927db641550362ee8ef05e2fa7449cb1a9dd8f2760420
89334ba86873baccdb8c2b5ea18ed21cd75e480aae4d494bb276564f4879d488
8baed2039b7f621eac8fcebb89c159202493841f6aad9b48e128c61ee5e81e9a
8ed01fbcf9ca1555bfde42a9d39eaf284d90c49af584e3e7f0f2490a6ad84296
9068c664a43fbf90b105a0007ef73b172e9a2ade602e928f04cbf8fc4109a9bf
92b066ac0ec1b15514acd7426a194259edf2864b0e374d52338ce9d2a0a9dfd2
933a80da0bb0c4ccbbd539d68434c7d3f600fd7042e96361ded8700c283df122
93fb57762d4c93a95b907ad59d4d0453cb24f56dfc7197aec3323969dcd3b1d8
941d7b9e8c1f693e41d8ee74d99eb6f5b08f99dedf7884f6fc5fde662099a487
955ff6deae76e97682fc7214a3e76bf691eb83171e7c0f487b5e8589dbc061a2
977f5884716a9c1d7508f4d90807fca2f828dd3450840012b1a7d0c56dd27990
994a85a7ee7a5c5aa7832ec483d46a1d38b75fae782493c8de416b96a8d17a6b
997cc8e91d015750e25d4013eb4dfacf869dde4b21664ad53265cd0bdc9cc704
99d678cc516694db9cfb2f1c4b29044b3cf5177e46dc8c5ee10645cf664bd316
9b6f9d23da71227dd4d19aa8d49e322962bd10774f17970d9a031f87ad039e63
9bc72f80764916ada6cc33745a55a734fdee68e901667aa693e02a102facfc98
9f82c676337a2b66619893a1d4cb24bb71e1566dd820dce476982484b7d7b682
a0cc8e47dccd139dc225337f04af6abb6b9f2d4bce6fb1404edf6ec0562231b2
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a5a323dd5b3b00dd8a88b560ef6e86b15940ba975da6576b8e9fa9b3973d68cb
a6d07db8a81099a43a8f9573d5069ea7ea0202933c4e5bc62f2ad16998c9523a
abf9bf37c84a887572100cb6d2cc1a628574688b83d9ec375c00073da6382d25
ac65679285de2392fc8b76767e1db03387d7c5968544f70975f74eaecf1be10d
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ada11a51560cb25bd08d05a183e2ad443f58ff838a904ad93d438bb5c76f7cd6
addb97debb6f14f5bb8c9e63a3449e184d911fd50f2e9dbf73e64d5f62c55da2
af09e9d58676a69832a301f1b365e0edfbf5e67ec7ec1f83d76ca1673f5377ed
b026da50fc169ef54c2afc989bc6c38a513aefed22fa11d195b1bf5f1f0e0344
b11dff9282d54cc80505d328f3c2f5b0d4aa59f5079dc563ccce7d3719c24866
b163d7405b86fc249da09ecae8c8a5a834ae5f1eb05a3cf188a8e7ae47299e1c
b3be241d203ddc10730645993381cf8341eef547c398ee56c0eb4827436f916b
b3c7fc0cf7be713a4e97298f59db197355a9bdbd1d55944e6d8a4006f1a01cf6
b460287ef0b7723fa5ee67d7810c23fd3f727abaea97cde61a268b8346ef2deb
b4fe07cf9acd45fcb108002a389f098cd514117ccac6f92113d3896a441bf534
b6470bbd45ef9a9b33579972f46b056c3577c77cccf420961a1e5b617bc07ff1
b7aa714a4418a8e3d269a472e0ba2168cca963243ce2c94ad32315cd239fd245
b7db90d988f2d569ee665c1666e383f3ccb226e4532320946bb42d09702c6ed8
b91a5ef8243ee8c9064be9d39b5ce5007d1262a339633bc96972801df942b2f0
bc2055521461ac6a5b67246c8bd4458118883b4c33c1337ea2e59a2ae3061d52
bdb507e23aebde59d1885b28ddee501743e8ab8d57e4f92800064a6210adf43a
c1f92feb266044d4c46f3279c3ef0395942abc8d21f883173e5132397e2ea5a0
c30e1ee38b2a521c96f84a75cfb0683f7decdd597cd47c4b0ac5457c9aaad405
c3fc5a8420c5bd21d96f6099bd42cee5a288ee31ca725e4fdd4a97da0e8ffb41
c509777f5de0ccf4fef96cecfc51d8421b0960903ee1d09241db66853ceaa86e
c57368b866acfd060ad3c8b6d7f224e7bc8ab8d63b80ed864a979cf5df978e3e
c5c7b0b2f0c81bd3b33ba86389e9c749a124fc4b3110a246fa1811621f8aec1c
c716b836e06759c51d2b438d30d8c11ffb3fa2d3394bc9b5a76bd15ee3f32573
c768728f133b19853c539d97dbf9ae20430ee6d7b1e31051777808b7957d0441
c86fa16cb9f397dd76145683ce4e3e44aa5a9b0fee5fffbb95a2e3d0c3a31971
c91a940c0c38e37bae3da2a3e2be95386d8a14954efb37a14e83a2cfbec8bd03
cdf23271f898df40f402b0d86ec42f810966d5ee3caade5b0d87f311202da1ef
cf0d6d3cc5edf22f3166477574054657cec2f7f71c43fa399897587e59452d8f
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d02655b928b3bcc69b4fe931b5df031e29dc0899f3f0c652da890267f6b10355
d0697fda3606d362d1a524934a3ad611ab5c42c9d9a4e0dd794cf60761515664
d24b492cc15692d79a344d3cee1952e99baf5a35e727eee802014e43311af9dc
d24d95f31f8b8a92c4a107c83a5ef923d299e8b962f67c316bb7ed9504b3cd1b
d2e5ecf559c5617db1b1681ddf77fc9b3e8e37ea7dfa533aec62808bb88b830c
dc193f6020a37e29ed2f5f9e9f631c78e304595d0ac47e3b2f1cc1d980aa2662
dc932022746959d6f8979f0dcb53ad638c72b60c4c7d693441ca8780171c6f1d
ddba334df6c664a031ca10a932ea32be4a846953dcdf1cb93014f6b6bf42640f
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
dfb21156f65312e7baf370d35e66b73ffb7f4454a5b933ac626687920a168470
e09a8727a411877f96d02d31e0c0c11d89bee29e536525c9bd444a93efe01055
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e660ee07a821d40b584ecf18811feb7a5853fcaa037d07b2907f9c4a7cf3afc0
e92552bc193c8bae835c7b6db6eea8a39593fa14fb75a227f738c415330cc84e
ecb5c17ee12595c3d153d376ffa403471b00d1a7d9cf9924ad1df263c1991d15
edcf9e078dbd83bbc3736dc0d32da6733fb8c21b7137c59edbc9ef95ad60041c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f2c4c540c58fc5ff231605b7cc2a6951cd9de3bc77726a116923b91f99c6e3e3
f348c6403ccac26b10078dbbe9041f10285c49d4e42b240eea31fbdb0d66302a
f43c62200c7815091a6fe618461fbcb6ffd38e0f8ff7aaa9ee863ab0f5d47092
fa401cc2f2f4f5944180d38a30ac8eb6bb652ef8edf620f5edd9a490a6944caa
fc80a3e7d5aec8ab0cb9a9ce523d1472d918213789d65b84486f4ca7ed0e6f65
fe3b0bcd28be1cf04e1903eb9a448ec2ab0c04b3448ff7cd2f9eb7160cb81e02
fe8ce03cfbeed2d7ed7620f2b989ceba117c35a36093fd89f7de028a890945b6

www.bloomberg.com Open in urlscan Pro 104.108.39.139 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

217 Requests

99 %HTTPS

38 %IPv6

40 Domains

56 Subdomains

48 IPs

7 Countries

4008 kBTransfer

10760 kBSize

36 Cookies

47 Outgoing links

Page URL History

Redirected requests

217 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bloomberg.com Open in urlscan Pro
104.108.39.139 Public Scan

Screenshot
Live screenshot

Full Image

217
Requests

99 %
HTTPS

38 %
IPv6

40
Domains

56
Subdomains

48
IPs

7
Countries

4008 kB
Transfer

10760 kB
Size

36
Cookies

217 HTTP transactions
4 data transactions