urlscan.io logo urlscan.io
SecurityTrails logo

www.denverpost.com Open in urlscan Pro
192.0.66.2  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Submission: On June 29 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 138 IPs in 11 countries across 117 domains to perform 410 HTTP transactions. The main IP is 192.0.66.2, located in United States and belongs to AUTOMATTIC, US. The main domain is www.denverpost.com.
TLS certificate: Issued by R3 on June 2nd 2021. Valid for: 3 months.
This is the only time www.denverpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
22 192.0.66.2 2635 (AUTOMATTIC)
1 2a00:1450:400... 15169 (GOOGLE)
5 65.9.86.127 16509 (AMAZON-02)
2 65.9.77.20 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 65.9.77.17 16509 (AMAZON-02)
1 13.224.193.121 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
1 13.82.152.48 8075 (MICROSOFT...)
1 23.55.161.154 20940 (AKAMAI-ASN1)
2 2600:9000:20e... 16509 (AMAZON-02)
1 65.9.86.61 16509 (AMAZON-02)
2 192.0.76.3 2635 (AUTOMATTIC)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
14 2606:2800:233... 15133 (EDGECAST)
1 151.101.1.26 54113 (FASTLY)
14 35.175.85.111 14618 (AMAZON-AES)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 65.9.77.24 16509 (AMAZON-02)
5 2a02:2638:1::3 44788 (ASN-CRITE...)
2 4 2.18.234.21 16625 (AKAMAI-AS)
4 2.18.233.180 16625 (AKAMAI-AS)
1 65.9.77.91 16509 (AMAZON-02)
15 142.250.186.66 15169 (GOOGLE)
1 65.9.81.12 16509 (AMAZON-02)
1 52.205.167.202 14618 (AMAZON-AES)
14 2a00:1450:400... 15169 (GOOGLE)
1 65.9.77.3 16509 (AMAZON-02)
1 3 2620:116:800d... 16509 (AMAZON-02)
1 13.224.194.75 16509 (AMAZON-02)
1 2 107.178.250.234 15169 (GOOGLE)
4 18.195.42.228 16509 (AMAZON-02)
1 151.101.114.217 54113 (FASTLY)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 13.224.193.38 16509 (AMAZON-02)
2 5 65.9.77.48 16509 (AMAZON-02)
1 3 99.80.189.193 16509 (AMAZON-02)
1 35.174.31.79 14618 (AMAZON-AES)
1 75.101.131.192 14618 (AMAZON-AES)
2 185.64.189.115 62713 (AS-PUBMATIC)
1 2600:9000:210... 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 65.9.77.97 16509 (AMAZON-02)
1 52.15.171.234 16509 (AMAZON-02)
3 4 37.157.6.253 198622 (ADFORM)
2 2 213.155.156.182 1299 (TELIANET ...)
7 185.64.190.80 62713 (AS-PUBMATIC)
1 178.250.2.151 44788 (ASN-CRITE...)
11 16 142.250.184.194 15169 (GOOGLE)
3 3 185.29.135.233 30419 (MEDIAMATH...)
2 185.64.189.114 62713 (AS-PUBMATIC)
2 3 159.253.128.183 36351 (SOFTLAYER)
1 19 185.64.189.110 62713 (AS-PUBMATIC)
5 9 13.248.242.197 16509 (AMAZON-02)
6 12 185.33.221.11 29990 (ASN-APPNEX)
2 3 2a00:1288:110... 34010 (YAHOO-IRD)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 10 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 23.37.32.235 16625 (AKAMAI-AS)
1 142.250.185.198 15169 (GOOGLE)
4 178.250.0.165 44788 (ASN-CRITE...)
2 23.37.38.181 16625 (AKAMAI-AS)
1 185.64.189.112 62713 (AS-PUBMATIC)
2 69.173.144.140 26667 (RUBICONPR...)
1 3.120.90.149 16509 (AMAZON-02)
4 23.55.161.167 20940 (AKAMAI-ASN1)
1 18.215.138.99 14618 (AMAZON-AES)
3 23.55.161.133 20940 (AKAMAI-ASN1)
2 23.55.161.165 20940 (AKAMAI-ASN1)
4 13.85.16.224 8075 (MICROSOFT...)
2 65.9.84.32 16509 (AMAZON-02)
1 52.216.89.156 16509 (AMAZON-02)
5 5 107.22.208.198 14618 (AMAZON-AES)
1 1 23.37.43.59 16625 (AKAMAI-AS)
2 4 35.244.174.68 15169 (GOOGLE)
2 3 34.98.64.218 15169 (GOOGLE)
3 34.120.133.55 15169 (GOOGLE)
1 34.231.165.20 14618 (AMAZON-AES)
1 34.234.106.43 14618 (AMAZON-AES)
4 3.88.253.15 14618 (AMAZON-AES)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 34.120.253.250 15169 (GOOGLE)
1 65.9.86.150 16509 (AMAZON-02)
2 34.98.72.95 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 35.227.221.36 15169 (GOOGLE)
1 35.190.24.100 15169 (GOOGLE)
1 35.227.219.197 15169 (GOOGLE)
34 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
6 54.166.210.103 14618 (AMAZON-AES)
1 130.211.47.17 15169 (GOOGLE)
1 34.117.4.53 15169 (GOOGLE)
1 34.107.221.36 15169 (GOOGLE)
8 2a00:1450:400... 15169 (GOOGLE)
7 62.149.0.72 15497 (COLOCALL ...)
3 4 185.94.180.125 35220 (SPOTX-AMS)
2 2 52.59.102.119 16509 (AMAZON-02)
2 18.156.0.31 16509 (AMAZON-02)
4 2600:9000:210... 16509 (AMAZON-02)
6 213.174.135.1 39572 (ADVANCEDH...)
1 1 85.114.159.93 24961 (MYLOC-AS ...)
4 4 52.208.167.91 16509 (AMAZON-02)
1 185.86.137.133 201081 (SMARTADSE...)
1 1 162.55.6.210 24940 (HETZNER-AS)
3 3 213.19.147.45 26120 (RHYTHMONE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 94.23.171.206 16276 (OVH)
1 173.231.180.197 29791 (VOXEL-DOT...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 198.148.27.140 19189 (PULSEPOINT)
1 1 2a04:4e42:3::300 54113 (FASTLY)
1 151.101.13.44 54113 (FASTLY)
1 38.91.45.7 398989 (DEEPINTENT)
5 6 35.227.248.159 15169 (GOOGLE)
2 2 18.158.226.176 16509 (AMAZON-02)
1 1 18.210.5.212 14618 (AMAZON-AES)
2 2 38.27.122.126 174 (COGENT-174)
2 2 35.201.96.126 15169 (GOOGLE)
1 185.64.189.249 62713 (AS-PUBMATIC)
1 2 77.243.60.138 42697 (NETIC-AS)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
5 6 54.78.254.47 16509 (AMAZON-02)
2 2 151.101.114.49 54113 (FASTLY)
3 3 3.126.158.103 16509 (AMAZON-02)
2 2 54.194.211.3 16509 (AMAZON-02)
1 1 2001:678:cb4:... 56396 (TURN)
1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
1 1 178.62.202.251 14061 (DIGITALOC...)
6 6 66.155.71.149 13768 (COGECO-PEER1)
1 1 34.98.107.212 15169 (GOOGLE)
1 2 185.33.220.240 29990 (ASN-APPNEX)
1 1 52.212.126.234 16509 (AMAZON-02)
1 1 52.21.104.248 14618 (AMAZON-AES)
1 2a0c:5c81:513... 55081 (24SHELLS)
5 23.227.137.155 55081 (24SHELLS)
1 3 2a02:2638::1c 44788 (ASN-CRITE...)
1 52.16.154.221 16509 (AMAZON-02)
2 178.250.2.146 44788 (ASN-CRITE...)
1 216.52.2.19 29791 (VOXEL-DOT...)
3 52.28.203.152 16509 (AMAZON-02)
5 2a0c:5c81:514... 55081 (24SHELLS)
1 104.154.142.214 15169 (GOOGLE)
1 185.184.10.30 203690 (RTB-HOUSE...)
1 3 23.37.42.132 16625 (AKAMAI-AS)
1 52.58.57.174 16509 (AMAZON-02)
4 9 69.173.144.139 26667 (RUBICONPR...)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
1 2600:9000:210... 16509 (AMAZON-02)
1 2.18.232.130 16625 (AKAMAI-AS)
1 152.228.227.57 16276 (OVH)
2 7 18.196.169.15 16509 (AMAZON-02)
2 13.69.106.215 8075 (MICROSOFT...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2 52.94.232.32 16509 (AMAZON-02)
1 1 70.42.32.95 22075 (AS-OUTBRAIN)
1 104.26.5.15 13335 (CLOUDFLAR...)
1 63.147.65.174 209 (CENTURYLI...)
410 138
22    192.0.66.2 (United States)

ASN2635 (AUTOMATTIC, US)
www.denverpost.com
1    2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
5    65.9.86.127 (United States)

ASN16509 (AMAZON-02, US)
c.amazon-adsystem.com
2    65.9.77.20 (United States)

ASN16509 (AMAZON-02, US)
mng-denverpost.zeustechnology.com
1    2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    65.9.77.17 (United States)

ASN16509 (AMAZON-02, US)
cdn.p-n.io
1    13.224.193.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-121.fra2.r.cloudfront.net
cdn.blueconic.net
1    2600:9000:20eb:1200:3:b7e:8940:93a1 (United States)

ASN16509 (AMAZON-02, US)
cmp.osano.com
1    13.82.152.48 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prodmg2.blob.core.windows.net
1    23.55.161.154 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
launcher.spot.im
2    2600:9000:20eb:e000:c:2267:880:93a1 (United States)

ASN16509 (AMAZON-02, US)
c.go-fet.ch
1    65.9.86.61 (United States)

ASN16509 (AMAZON-02, US)
cdn.parsely.com
2    192.0.76.3 (United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
2    2a02:26f0:6c00:1b8::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
c.go-mpulse.net
14    2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)
az416426.vo.msecnd.net
loader-cdn.azureedge.net
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
cdn.ayc0zsm69431gfebd.xyz
1    151.101.1.26 (United States)

ASN54113 (FASTLY, US)
polyfill.io
14    35.175.85.111 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
medianewsgroup.blueconic.net
3    2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
4    2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    65.9.77.24 (United States)

ASN16509 (AMAZON-02, US)
check.analytics.rlcdn.com
5    2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
static.criteo.net
4    2.18.234.21 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com
js-sec.indexww.com
as-sec.casalemedia.com
ssum-sec.casalemedia.com
4    2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com
ads.pubmatic.com
1    65.9.77.91 (United States)

ASN16509 (AMAZON-02, US)
ib.3lift.com
15    142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net
securepubads.g.doubleclick.net
1    65.9.81.12 (United States)

ASN16509 (AMAZON-02, US)
cdn.listrakbi.com
1    52.205.167.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
p1.parsely.com
14    2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    65.9.77.3 (United States)

ASN16509 (AMAZON-02, US)
d31qbv1cthcecs.cloudfront.net
3    2620:116:800d:21:f916:5049:f87f:108e (United States)

ASN16509 (AMAZON-02, US)
secure.quantserve.com
pixel.quantserve.com
1    13.224.194.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-75.fra2.r.cloudfront.net
d2lv4zbk7v5f93.cloudfront.net
2    107.178.250.234 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 234.250.178.107.bc.googleusercontent.com
js.matheranalytics.com
4    18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
nexus.ensighten.com
1    151.101.114.217 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
scripts.webcontentassessor.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    13.224.193.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-38.fra2.r.cloudfront.net
ats.rlcdn.com
5    65.9.77.48 (United States)

ASN16509 (AMAZON-02, US)
sb.scorecardresearch.com
geo.privacymanager.io
3    99.80.189.193 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
insight.adsrvr.org
1    35.174.31.79 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
s1.listrakbi.com
1    75.101.131.192 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
onescript-recscont.listrakbi.com
2    185.64.189.115 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
1    2600:9000:2104:7000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
3    2a00:1450:400c:c0a::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    65.9.77.97 (United States)

ASN16509 (AMAZON-02, US)
certify.alexametrics.com
1    52.15.171.234 (Columbus, United States)

ASN16509 (AMAZON-02, US)
redirect.prod.experiment.routing.cloudfront.aws.a2z.com
4    37.157.6.253 (Denmark)

ASN198622 (ADFORM, DK)
PTR: s1.adform.net
c1.adform.net
2    213.155.156.182 (Sweden)

ASN1299 (TELIANET Telia Carrier, SE)
d5p.de17a.com
7    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
1    178.250.2.151 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
16    142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
3    185.29.135.233 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
2    185.64.189.114 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
simage4.pubmatic.com
3    159.253.128.183 (Amsterdam, Netherlands)

ASN36351 (SOFTLAYER, US)
PTR: b7.80.fd9f.ip4.static.sl-reverse.com
um.simpli.fi
19    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
9    13.248.242.197 (United States)

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com
match.adsrvr.org
12    185.33.221.11 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
3    2a00:1288:110:c305::8000 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
pr-bh.ybp.yahoo.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
10    2a00:1450:4001:811::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    23.37.32.235 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
cdn3.optimizely.com
1    142.250.185.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net
ad.doubleclick.net
4    178.250.0.165 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.par.vip.prod.criteo.com
bidder.criteo.com
2    23.37.38.181 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-38-181.deploy.static.akamaitechnologies.com
htlb.casalemedia.com
1    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
2    69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
1    3.120.90.149 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
tlx.3lift.com
4    23.55.161.167 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
api-2-0.spot.im
1    18.215.138.99 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
direct-events-collector.spot.im
3    23.55.161.133 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
publisher-assets.spot.im
2    23.55.161.165 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
events-collector.spot.im
pix.spot.im
4    13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prod-dfm-proxy-connext.azurewebsites.net
2    65.9.84.32 (United States)

ASN16509 (AMAZON-02, US)
d1wa9546y9kg0n.cloudfront.net
1    52.216.89.156 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
paywall-ad-bucket.s3.amazonaws.com
5    107.22.208.198 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-22-208-198.compute-1.amazonaws.com
cs.choozle.com
1    23.37.43.59 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-43-59.deploy.static.akamaitechnologies.com
tags.bluekai.com
4    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
idsync.rlcdn.com
di.rlcdn.com
3    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
us-u.openx.net
spot-im-d.openx.net
3    34.120.133.55 (Kansas City, United States)

ASN15169 (GOOGLE, US)
api.rlcdn.com
1    34.231.165.20 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
mid.rkdms.com
1    34.234.106.43 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
idx.liadm.com
4    3.88.253.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
at1.listrakbi.com
1    2a02:26f0:6c00::210:ba20 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
static-cdn.spot.im
1    34.120.253.250 (Kansas City, United States)

ASN15169 (GOOGLE, US)
tag.wknd.ai
1    65.9.86.150 (United States)

ASN16509 (AMAZON-02, US)
d1eoo1tco6rr5e.cloudfront.net
2    34.98.72.95 (Kansas City, United States)

ASN15169 (GOOGLE, US)
assets.bounceexchange.com
2    2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.nl
2    2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
3    2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com
de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com
1    35.227.221.36 (Kansas City, United States)

ASN15169 (GOOGLE, US)
data.cdnbasket.net
1    35.190.24.100 (Kansas City, United States)

ASN15169 (GOOGLE, US)
page.cdnbasket.net
1    35.227.219.197 (Kansas City, United States)

ASN15169 (GOOGLE, US)
view.cdnbasket.net
34    2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
7    2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
6    54.166.210.103 (United States)

ASN14618 (AMAZON-AES, US)
www.i.matheranalytics.com
1    130.211.47.17 (Kansas City, United States)

ASN15169 (GOOGLE, US)
ids.cdnwidget.com
1    34.117.4.53 (Kansas City, United States)

ASN15169 (GOOGLE, US)
api.bounceexchange.com
1    34.107.221.36 (Kansas City, United States)

ASN15169 (GOOGLE, US)
e.cdnwidget.com
8    2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
7    62.149.0.72 (Ukraine)

ASN15497 (COLOCALL Internet Data Center ColoCALL, UA)
sync.spotim.market
sync.adtelligent.com
4    185.94.180.125 (United States)

ASN35220 (SPOTX-AMS, US)
sync.search.spotxchange.com
2    52.59.102.119 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-102-119.eu-central-1.compute.amazonaws.com
pixel.advertising.com
2    18.156.0.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
4    2600:9000:2104:9400:4:b37b:9440:93a1 (United States)

ASN16509 (AMAZON-02, US)
rumcdn.geoedge.be
6    213.174.135.1 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
player.spotim.market
player.adtelligent.com
p.zetarail.com
1    85.114.159.93 (Schopfheim, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com
dsp.adfarm1.adition.com
4    52.208.167.91 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-167-91.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
1    185.86.137.133 (France)

ASN201081 (SMARTADSERVER, FR)
rtb-csync.smartadserver.com
1    162.55.6.210 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.210.6.55.162.clients.your-server.de
csync.loopme.me
3    213.19.147.45 (United Kingdom)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
1    2606:4700:3039::6815:c036 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
1    94.23.171.206 (France)

ASN16276 (OVH, FR)
green.erne.co
1    173.231.180.197 (United States)

ASN29791 (VOXEL-DOT-NET, US)
cm.adgrx.com
2    2606:4700::6812:c05 (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
1    2a04:4e42:3::300 (United States)

ASN54113 (FASTLY, US)
trc.taboola.com
1    151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
match.taboola.com
1    38.91.45.7 (United States)

ASN398989 (DEEPINTENT, US)
match.deepintent.com
6    35.227.248.159 (Kansas City, United States)

ASN15169 (GOOGLE, US)
pixel.tapad.com
2    18.158.226.176 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
pm.w55c.net
1    18.210.5.212 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
sync.srv.stackadapt.com
2    38.27.122.126 (United States)

ASN174 (COGENT-174, US)
match.bnmla.com
2    35.201.96.126 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 126.96.201.35.bc.googleusercontent.com
visitor.fiftyt.com
1    185.64.189.249 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
aud.pubmatic.com
2    77.243.60.138 (Aalborg, Denmark)

ASN42697 (NETIC-AS, DK)
uipglob.semasio.net
1    2606:4700:10::6816:1957 (United States)

ASN13335 (CLOUDFLARENET, US)
mwzeom.zeotap.com
6    54.78.254.47 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
loadm.exelator.com
2    151.101.114.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
3    3.126.158.103 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-158-103.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    54.194.211.3 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
ads.avct.cloud
1    2001:678:cb4:bbbb::11 (United Kingdom)

ASN56396 (TURN, GB)
ad.turn.com
1    2a02:fa8:8806:12::1400 (United States)

ASN41041 (VCLK-EU-SE, US)
pubmatic-match.dotomi.com
1    178.62.202.251 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
match.adsby.bidtheatre.com
6    66.155.71.149 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
1    34.98.107.212 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 212.107.98.34.bc.googleusercontent.com
ads.playground.xyz
2    185.33.220.240 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
1    52.212.126.234 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
rtb.gumgum.com
1    52.21.104.248 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
sync.ipredictive.com
1    2a0c:5c81:5139::2 (London, United Kingdom)

ASN55081 (24SHELLS, US)
s.adtelligent.com
5    23.227.137.155 (Piscataway, United States)

ASN55081 (24SHELLS, US)
hb.spotim.market
3    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
1    52.16.154.221 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-154-221.eu-west-1.compute.amazonaws.com
trends.revcontent.com
2    178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
1    216.52.2.19 (United States)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
3    52.28.203.152 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
c2shb.ssp.yahoo.com
5    2a0c:5c81:5142::2 (London, United Kingdom)

ASN55081 (24SHELLS, US)
ghb.adtelligent.com
ghb1.adtelligent.com
1    104.154.142.214 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 214.142.154.104.bc.googleusercontent.com
lockerdome.com
1    185.184.10.30 (Poland)

ASN203690 (RTB-HOUSE-ASH, PL)
prebid-us.creativecdn.com
3    23.37.42.132 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
eus.rubiconproject.com
1    52.58.57.174 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
ice.360yield.com
9    69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
token.rubiconproject.com
1    2a00:1288:80:800::7001 (Frankfurt am Main, Germany)

ASN203220 (YAHOO-DEB, GB)
ads.yahoo.com
1    2600:9000:2104:7600:10:43f:4340:93a1 (United States)

ASN16509 (AMAZON-02, US)
gw.geoedge.be
1    2.18.232.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-130.deploy.static.akamaitechnologies.com
acdn.adnxs.com
1    152.228.227.57 (France)

ASN16276 (OVH, FR)
id5-sync.com
7    18.196.169.15 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
eb2.3lift.com
2    13.69.106.215 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com
1    2a02:26f0:6c00:2b9::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
6852bd0b.akstat.io
1    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
2    52.94.232.32 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
1    70.42.32.95 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
1    104.26.5.15 (United States)

ASN13335 (CLOUDFLARENET, US)
api-mg2.db-ip.com
1    63.147.65.174 (Peoria, United States)

ASN209 (CENTURYLINK-US-LEGACY-QWEST, US)
uploads.denverpost.com
Apex Domain
Subdomains		 Transfer
45 googlesyndication.com
91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com
588 KB
36 pubmatic.com
ads.pubmatic.com
image6.pubmatic.com
image2.pubmatic.com
image4.pubmatic.com
simage2.pubmatic.com
hbopenbid.pubmatic.com
simage4.pubmatic.com
aud.pubmatic.com
44 KB
35 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
cm.g.doubleclick.net
ad.doubleclick.net
googleads.g.doubleclick.net
331 KB
23 denverpost.com
www.denverpost.com
uploads.denverpost.com
229 KB
15 adnxs.com
ib.adnxs.com
secure.adnxs.com
acdn.adnxs.com
12 KB
15 blueconic.net
cdn.blueconic.net
medianewsgroup.blueconic.net
442 KB
14 rubiconproject.com
fastlane.rubiconproject.com
secure-assets.rubiconproject.com
eus.rubiconproject.com
pixel.rubiconproject.com
token.rubiconproject.com
20 KB
14 google-analytics.com
www.google-analytics.com
40 KB
12 google.com
www.google.com
adservice.google.com
3 KB
12 adsrvr.org
insight.adsrvr.org
match.adsrvr.org
5 KB
12 spot.im
launcher.spot.im
api-2-0.spot.im
direct-events-collector.spot.im
publisher-assets.spot.im
events-collector.spot.im
static-cdn.spot.im
pix.spot.im
103 KB
11 adtelligent.com
player.adtelligent.com
s.adtelligent.com
sync.adtelligent.com
ghb.adtelligent.com
ghb1.adtelligent.com
6 KB
11 spotim.market
sync.spotim.market
player.spotim.market
hb.spotim.market
152 KB
10 criteo.com
dis.criteo.com
bidder.criteo.com
gum.criteo.com
mug.criteo.com
4 KB
10 ayc0zsm69431gfebd.xyz
cdn.ayc0zsm69431gfebd.xyz
205 KB
9 yahoo.com
pr-bh.ybp.yahoo.com
ups.analytics.yahoo.com
c2shb.ssp.yahoo.com
ads.yahoo.com
4 KB
9 3lift.com
ib.3lift.com
tlx.3lift.com
eb2.3lift.com
4 KB
9 rlcdn.com
check.analytics.rlcdn.com
ats.rlcdn.com
idsync.rlcdn.com
api.rlcdn.com
di.rlcdn.com
analytics.rlcdn.com Failed
62 KB
8 matheranalytics.com
js.matheranalytics.com
www.i.matheranalytics.com
43 KB
7 googletagservices.com
www.googletagservices.com
245 KB
7 listrakbi.com
cdn.listrakbi.com
s1.listrakbi.com
onescript-recscont.listrakbi.com
at1.listrakbi.com
27 KB
7 amazon-adsystem.com
c.amazon-adsystem.com
s.amazon-adsystem.com
69 KB
6 sitescout.com
pixel-sync.sitescout.com
3 KB
6 exelator.com
loadm.exelator.com
7 KB
6 tapad.com
pixel.tapad.com
2 KB
5 geoedge.be
rumcdn.geoedge.be
gw.geoedge.be
204 KB
5 choozle.com
cs.choozle.com
3 KB
5 casalemedia.com
htlb.casalemedia.com
as-sec.casalemedia.com
ssum-sec.casalemedia.com
3 KB
5 cloudfront.net
d31qbv1cthcecs.cloudfront.net
d2lv4zbk7v5f93.cloudfront.net
d1wa9546y9kg0n.cloudfront.net
d1eoo1tco6rr5e.cloudfront.net
59 KB
5 criteo.net
static.criteo.net
92 KB
4 bidr.io
match.prod.bidr.io
2 KB
4 spotxchange.com
sync.search.spotxchange.com
2 KB
4 azurewebsites.net
prod-dfm-proxy-connext.azurewebsites.net
250 KB
4 adform.net
c1.adform.net
2 KB
4 scorecardresearch.com
sb.scorecardresearch.com
1 KB
4 ensighten.com
nexus.ensighten.com
11 KB
4 gstatic.com
fonts.gstatic.com
90 KB
3 bidswitch.net
x.bidswitch.net
1 KB
3 cdnbasket.net
data.cdnbasket.net
page.cdnbasket.net
view.cdnbasket.net
1 KB
3 bounceexchange.com
assets.bounceexchange.com
api.bounceexchange.com
142 KB
3 openx.net
us-u.openx.net
spot-im-d.openx.net
1 KB
3 google.de
www.google.de
736 B
3 simpli.fi
um.simpli.fi
2 KB
3 mathtag.com
sync.mathtag.com
2 KB
3 quantserve.com
secure.quantserve.com
pixel.quantserve.com
10 KB
3 azureedge.net
loader-cdn.azureedge.net
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
238 KB
3 googletagmanager.com
www.googletagmanager.com
166 KB
2 visualstudio.com
dc.services.visualstudio.com
340 B
2 zetarail.com
p.zetarail.com
14 KB
2 avct.cloud
ads.avct.cloud
894 B
2 everesttech.net
sync-tm.everesttech.net
742 B
2 semasio.net
uipglob.semasio.net
1 KB
2 fiftyt.com
visitor.fiftyt.com
1 KB
2 bnmla.com
match.bnmla.com
1 KB
2 w55c.net
pm.w55c.net
2 KB
2 taboola.com
trc.taboola.com
match.taboola.com
652 B
2 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
1 KB
2 1rx.io
sync.1rx.io
1 KB
2 advertising.com
pixel.advertising.com
676 B
2 cdnwidget.com
ids.cdnwidget.com
e.cdnwidget.com
238 B
2 google.nl
adservice.google.nl
1018 B
2 facebook.com
www.facebook.com
312 B
2 de17a.com
d5p.de17a.com
637 B
2 facebook.net
connect.facebook.net
97 KB
2 go-mpulse.net
c.go-mpulse.net
51 KB
2 wp.com
stats.wp.com
pixel.wp.com
3 KB
2 parsely.com
cdn.parsely.com
p1.parsely.com
19 KB
2 go-fet.ch
c.go-fet.ch
39 KB
2 zeustechnology.com
mng-denverpost.zeustechnology.com
108 KB
2 googleapis.com
fonts.googleapis.com
ajax.googleapis.com
32 KB
1 db-ip.com
api-mg2.db-ip.com
887 B
1 zemanta.com
b1sync.zemanta.com
301 B
1 bing.com
c.bing.com
465 B
1 akstat.io
6852bd0b.akstat.io
359 B
1 id5-sync.com
id5-sync.com
9 KB
1 360yield.com
ice.360yield.com
515 B
1 creativecdn.com
prebid-us.creativecdn.com
prebid-eu.creativecdn.com Failed
180 B
1 lockerdome.com
lockerdome.com
834 B
1 lijit.com
ap.lijit.com
759 B
1 revcontent.com
trends.revcontent.com
1 ipredictive.com
sync.ipredictive.com
522 B
1 gumgum.com
rtb.gumgum.com
336 B
1 playground.xyz
ads.playground.xyz
486 B
1 bidtheatre.com
match.adsby.bidtheatre.com
550 B
1 dotomi.com
pubmatic-match.dotomi.com
104 B
1 turn.com
ad.turn.com
518 B
1 zeotap.com
mwzeom.zeotap.com
489 B
1 stackadapt.com
sync.srv.stackadapt.com
643 B
1 deepintent.com
match.deepintent.com
44 B
1 contextweb.com
bh.contextweb.com
462 B
1 adgrx.com
cm.adgrx.com
408 B
1 erne.co
green.erne.co
325 B
1 ad4m.at
ad4m.at
1009 B
1 unrulymedia.com
sync.targeting.unrulymedia.com
535 B
1 loopme.me
csync.loopme.me
212 B
1 smartadserver.com
rtb-csync.smartadserver.com
163 B
1 adition.com
dsp.adfarm1.adition.com
501 B
1 wknd.ai
tag.wknd.ai
27 KB
1 liadm.com
idx.liadm.com
690 B
1 rkdms.com
mid.rkdms.com
155 B
1 bluekai.com
tags.bluekai.com
899 B
1 amazonaws.com
paywall-ad-bucket.s3.amazonaws.com
1 KB
1 privacymanager.io
geo.privacymanager.io
592 B
1 optimizely.com
cdn3.optimizely.com
696 B
1 a2z.com
redirect.prod.experiment.routing.cloudfront.aws.a2z.com
48 B
1 alexametrics.com
certify.alexametrics.com
551 B
1 quantcount.com
rules.quantcount.com
427 B
1 webcontentassessor.com
scripts.webcontentassessor.com
20 KB
1 indexww.com
js-sec.indexww.com
14 KB
1 polyfill.io
polyfill.io
538 B
1 msecnd.net
az416426.vo.msecnd.net
22 KB
1 windows.net
prodmg2.blob.core.windows.net
143 KB
1 osano.com
cmp.osano.com
81 KB
1 p-n.io
cdn.p-n.io
70 KB
0 onetag-sys.com Failed
onetag-sys.com Failed
0 omnitagjs.com Failed
hb-api.omnitagjs.com Failed
0 onaudience.com Failed
pixel.onaudience.com Failed
410 117
Domain Requested by
34 tpc.googlesyndication.com scripts.webcontentassessor.com
rumcdn.geoedge.be
tpc.googlesyndication.com
securepubads.g.doubleclick.net
22 www.denverpost.com www.denverpost.com
19 simage2.pubmatic.com 1 redirects ads.pubmatic.com
15 securepubads.g.doubleclick.net mng-denverpost.zeustechnology.com
securepubads.g.doubleclick.net
az416426.vo.msecnd.net
www.denverpost.com
www.googletagservices.com
rumcdn.geoedge.be
14 cm.g.doubleclick.net 11 redirects eus.rubiconproject.com
eb2.3lift.com
14 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
az416426.vo.msecnd.net
14 medianewsgroup.blueconic.net cdn.blueconic.net
12 ib.adnxs.com 6 redirects mng-denverpost.zeustechnology.com
player.spotim.market
p.zetarail.com
eb2.3lift.com
10 www.google.com 1 redirects www.denverpost.com
scripts.webcontentassessor.com
rumcdn.geoedge.be
tpc.googlesyndication.com
10 cdn.ayc0zsm69431gfebd.xyz ajax.googleapis.com
cdn.ayc0zsm69431gfebd.xyz
9 match.adsrvr.org 5 redirects az416426.vo.msecnd.net
eus.rubiconproject.com
player.spotim.market
eb2.3lift.com
8 pagead2.googlesyndication.com www.googletagservices.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.denverpost.com
az416426.vo.msecnd.net
7 eb2.3lift.com 2 redirects ib.3lift.com
eb2.3lift.com
7 www.googletagservices.com scripts.webcontentassessor.com
securepubads.g.doubleclick.net
rumcdn.geoedge.be
7 image2.pubmatic.com ads.pubmatic.com
6 pixel-sync.sitescout.com 6 redirects
6 loadm.exelator.com 5 redirects ads.pubmatic.com
6 pixel.tapad.com 5 redirects ads.pubmatic.com
6 www.i.matheranalytics.com www.denverpost.com
5 pixel.rubiconproject.com eus.rubiconproject.com
5 hb.spotim.market player.spotim.market
5 cs.choozle.com 5 redirects
5 static.criteo.net mng-denverpost.zeustechnology.com
www.denverpost.com
player.spotim.market
static.criteo.net
5 c.amazon-adsystem.com www.denverpost.com
c.amazon-adsystem.com
4 token.rubiconproject.com 4 redirects
4 ghb.adtelligent.com player.spotim.market
p.zetarail.com
4 sync.adtelligent.com s.adtelligent.com
www.denverpost.com
rumcdn.geoedge.be
4 match.prod.bidr.io 4 redirects
4 rumcdn.geoedge.be launcher.spot.im
rumcdn.geoedge.be
player.spotim.market
www.denverpost.com
4 sync.search.spotxchange.com 3 redirects www.denverpost.com
4 at1.listrakbi.com cdn.listrakbi.com
4 prod-dfm-proxy-connext.azurewebsites.net cdn.ayc0zsm69431gfebd.xyz
4 api-2-0.spot.im launcher.spot.im
4 bidder.criteo.com static.criteo.net
player.spotim.market
p.zetarail.com
4 c1.adform.net 3 redirects ads.pubmatic.com
4 sb.scorecardresearch.com 2 redirects www.denverpost.com
4 nexus.ensighten.com www.googletagmanager.com
nexus.ensighten.com
4 ads.pubmatic.com mng-denverpost.zeustechnology.com
ads.pubmatic.com
launcher.spot.im
4 fonts.gstatic.com fonts.googleapis.com
3 c2shb.ssp.yahoo.com player.spotim.market
3 gum.criteo.com 1 redirects static.criteo.net
3 x.bidswitch.net 3 redirects
3 player.spotim.market www.denverpost.com
player.spotim.market
3 sync.spotim.market www.denverpost.com
ads.pubmatic.com
3 api.rlcdn.com az416426.vo.msecnd.net
player.spotim.market
3 idsync.rlcdn.com 2 redirects www.denverpost.com
3 publisher-assets.spot.im launcher.spot.im
www.denverpost.com
3 www.google.de www.denverpost.com
3 pr-bh.ybp.yahoo.com 2 redirects ads.pubmatic.com
3 um.simpli.fi 2 redirects ads.pubmatic.com
3 sync.mathtag.com 3 redirects
3 stats.g.doubleclick.net www.google-analytics.com
az416426.vo.msecnd.net
3 insight.adsrvr.org 1 redirects www.denverpost.com
d1eoo1tco6rr5e.cloudfront.net
3 www.googletagmanager.com www.denverpost.com
g2insights-cdn.azureedge.net
2 s.amazon-adsystem.com 1 redirects eb2.3lift.com
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 googleads.g.doubleclick.net de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com
2 de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com rumcdn.geoedge.be
2 eus.rubiconproject.com rumcdn.geoedge.be
eus.rubiconproject.com
2 ssum-sec.casalemedia.com 2 redirects
2 mug.criteo.com www.denverpost.com
2 p.zetarail.com rumcdn.geoedge.be
p.zetarail.com
2 secure.adnxs.com 1 redirects acdn.adnxs.com
2 ads.avct.cloud 2 redirects
2 sync-tm.everesttech.net 2 redirects
2 uipglob.semasio.net 1 redirects ads.pubmatic.com
2 visitor.fiftyt.com 2 redirects
2 match.bnmla.com 2 redirects
2 pm.w55c.net 2 redirects
2 sync.1rx.io 2 redirects
2 ups.analytics.yahoo.com www.denverpost.com
ads.pubmatic.com
2 pixel.advertising.com 2 redirects
2 adservice.google.com securepubads.g.doubleclick.net
rumcdn.geoedge.be
2 adservice.google.nl securepubads.g.doubleclick.net
rumcdn.geoedge.be
2 assets.bounceexchange.com tag.wknd.ai
assets.bounceexchange.com
2 us-u.openx.net 2 redirects
2 d1wa9546y9kg0n.cloudfront.net cdn.ayc0zsm69431gfebd.xyz
2 pixel.quantserve.com 1 redirects www.denverpost.com
2 fastlane.rubiconproject.com mng-denverpost.zeustechnology.com
player.spotim.market
2 htlb.casalemedia.com mng-denverpost.zeustechnology.com
player.spotim.market
2 www.facebook.com www.denverpost.com
connect.facebook.net
2 d5p.de17a.com 2 redirects
2 image6.pubmatic.com ads.pubmatic.com
2 connect.facebook.net www.denverpost.com
connect.facebook.net
2 js.matheranalytics.com 1 redirects www.denverpost.com
2 c.go-mpulse.net www.denverpost.com
c.go-mpulse.net
2 c.go-fet.ch www.denverpost.com
c.go-fet.ch
2 mng-denverpost.zeustechnology.com www.denverpost.com
1 uploads.denverpost.com az416426.vo.msecnd.net
1 api-mg2.db-ip.com cdn.ayc0zsm69431gfebd.xyz
1 b1sync.zemanta.com 1 redirects
1 c.bing.com eb2.3lift.com
1 6852bd0b.akstat.io c.go-mpulse.net
1 pix.spot.im launcher.spot.im
1 id5-sync.com player.spotim.market
1 acdn.adnxs.com p.zetarail.com
1 gw.geoedge.be rumcdn.geoedge.be
1 ads.yahoo.com eus.rubiconproject.com
1 ice.360yield.com p.zetarail.com
1 secure-assets.rubiconproject.com 1 redirects
1 spot-im-d.openx.net player.spotim.market
1 prebid-us.creativecdn.com player.spotim.market
1 lockerdome.com player.spotim.market
1 ghb1.adtelligent.com player.spotim.market
1 ap.lijit.com player.spotim.market
1 trends.revcontent.com player.spotim.market
1 s.adtelligent.com rumcdn.geoedge.be
1 player.adtelligent.com player.spotim.market
1 sync.ipredictive.com 1 redirects
1 rtb.gumgum.com 1 redirects
1 ads.playground.xyz 1 redirects
1 match.adsby.bidtheatre.com 1 redirects
1 pubmatic-match.dotomi.com ads.pubmatic.com
1 ad.turn.com 1 redirects
1 mwzeom.zeotap.com ads.pubmatic.com
1 aud.pubmatic.com ads.pubmatic.com
1 sync.srv.stackadapt.com 1 redirects
1 match.deepintent.com ads.pubmatic.com
1 match.taboola.com ads.pubmatic.com
1 trc.taboola.com 1 redirects
1 bh.contextweb.com 1 redirects
1 s.tribalfusion.com ads.pubmatic.com
1 a.tribalfusion.com 1 redirects
1 cm.adgrx.com ads.pubmatic.com
1 green.erne.co 1 redirects
1 ad4m.at ads.pubmatic.com
1 sync.targeting.unrulymedia.com 1 redirects
1 csync.loopme.me 1 redirects
1 rtb-csync.smartadserver.com ads.pubmatic.com
1 dsp.adfarm1.adition.com 1 redirects
1 di.rlcdn.com www.denverpost.com
1 e.cdnwidget.com www.denverpost.com
1 api.bounceexchange.com assets.bounceexchange.com
1 ids.cdnwidget.com az416426.vo.msecnd.net
1 simage4.pubmatic.com ads.pubmatic.com
1 as-sec.casalemedia.com az416426.vo.msecnd.net
1 view.cdnbasket.net az416426.vo.msecnd.net
1 page.cdnbasket.net az416426.vo.msecnd.net
1 data.cdnbasket.net az416426.vo.msecnd.net
1 91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 d1eoo1tco6rr5e.cloudfront.net nexus.ensighten.com
1 tag.wknd.ai www.denverpost.com
1 static-cdn.spot.im launcher.spot.im
1 idx.liadm.com az416426.vo.msecnd.net
1 mid.rkdms.com az416426.vo.msecnd.net
1 tags.bluekai.com 1 redirects
1 paywall-ad-bucket.s3.amazonaws.com www.denverpost.com
1 geo.privacymanager.io ats.rlcdn.com
1 events-collector.spot.im launcher.spot.im
1 direct-events-collector.spot.im launcher.spot.im
1 tlx.3lift.com mng-denverpost.zeustechnology.com
1 hbopenbid.pubmatic.com mng-denverpost.zeustechnology.com
1 ad.doubleclick.net www.denverpost.com
1 cdn3.optimizely.com d2lv4zbk7v5f93.cloudfront.net
1 image4.pubmatic.com ads.pubmatic.com
1 dis.criteo.com ads.pubmatic.com
1 redirect.prod.experiment.routing.cloudfront.aws.a2z.com www.denverpost.com
1 certify.alexametrics.com www.denverpost.com
1 rules.quantcount.com secure.quantserve.com
1 g2insights-cdn.azureedge.net ajax.googleapis.com
1 fp-cdn.azureedge.net ajax.googleapis.com
1 onescript-recscont.listrakbi.com cdn.listrakbi.com
1 s1.listrakbi.com cdn.listrakbi.com
1 ats.rlcdn.com www.denverpost.com
1 scripts.webcontentassessor.com www.googletagmanager.com
1 d2lv4zbk7v5f93.cloudfront.net www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 d31qbv1cthcecs.cloudfront.net www.denverpost.com
1 loader-cdn.azureedge.net ajax.googleapis.com
1 pixel.wp.com www.denverpost.com
1 p1.parsely.com www.denverpost.com
1 cdn.listrakbi.com www.denverpost.com
1 ib.3lift.com mng-denverpost.zeustechnology.com
1 js-sec.indexww.com mng-denverpost.zeustechnology.com
1 check.analytics.rlcdn.com mng-denverpost.zeustechnology.com
1 polyfill.io ajax.googleapis.com
1 az416426.vo.msecnd.net www.denverpost.com
1 stats.wp.com www.denverpost.com
1 cdn.parsely.com www.denverpost.com
1 launcher.spot.im www.denverpost.com
1 prodmg2.blob.core.windows.net www.denverpost.com
1 cmp.osano.com www.denverpost.com
1 cdn.blueconic.net www.denverpost.com
1 cdn.p-n.io www.denverpost.com
1 ajax.googleapis.com www.denverpost.com
1 fonts.googleapis.com www.denverpost.com
0 analytics.rlcdn.com Failed
0 prebid-eu.creativecdn.com Failed p.zetarail.com
0 onetag-sys.com Failed p.zetarail.com
0 hb-api.omnitagjs.com Failed player.spotim.market
0 pixel.onaudience.com Failed ads.pubmatic.com
410 191
Subject Issuer Validity Valid
denverpost.com
R3		 2021-06-02 -
2021-08-31		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2021-05-31 -
2021-08-23		 3 months crt.sh
c.amazon-adsystem.com
Amazon		 2020-08-04 -
2021-08-02		 a year crt.sh
*.zeustechnology.com
Amazon		 2021-05-15 -
2022-06-13		 a year crt.sh
pushlycdn.com
Amazon		 2021-03-16 -
2022-04-14		 a year crt.sh
*.blueconic.net
Thawte TLS RSA CA G1		 2019-12-04 -
2022-02-01		 2 years crt.sh
cmp.osano.com
Amazon		 2020-08-26 -
2021-09-25		 a year crt.sh
*.blob.core.windows.net
Microsoft RSA TLS CA 01		 2021-05-17 -
2022-05-17		 a year crt.sh
*.spot.im
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2020-11-26 -
2021-11-30		 a year crt.sh
*.go-fet.ch
Amazon		 2020-12-08 -
2022-01-06		 a year crt.sh
*.parsely.com
Amazon		 2020-08-02 -
2021-09-02		 a year crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA		 2020-04-02 -
2022-07-05		 2 years crt.sh
akstat.io
DigiCert SHA2 Secure Server CA		 2021-06-08 -
2022-06-13		 a year crt.sh
sni1e6ffgl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2020-04-16 -
2022-04-21		 2 years crt.sh
polyfill.io
GlobalSign Atlas R3 DV TLS CA 2020		 2021-06-04 -
2022-07-06		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-05-31 -
2021-08-23		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-05-31 -
2021-08-23		 3 months crt.sh
analytics.rlcdn.com
Amazon		 2020-12-09 -
2022-01-07		 a year crt.sh
*.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-06-27 -
2021-09-24		 3 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
*.pubmatic.com
DigiCert SHA2 Secure Server CA		 2021-03-30 -
2022-04-04		 a year crt.sh
*.3lift.com
Amazon		 2020-06-26 -
2021-07-26		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-05-31 -
2021-08-23		 3 months crt.sh
*.listrakbi.com
Amazon		 2021-01-25 -
2022-02-22		 a year crt.sh
sni22a5dgl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-03 -
2021-11-07		 a year crt.sh
*.cloudfront.net
Amazon		 2021-03-19 -
2022-03-17		 a year crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA		 2020-10-02 -
2021-10-07		 a year crt.sh
js.matheranalytics.com
Sectigo RSA Domain Validation Secure Server CA		 2021-03-19 -
2022-04-19		 a year crt.sh
nexus.ensighten.com
DigiCert SHA2 Secure Server CA		 2020-09-09 -
2021-10-11		 a year crt.sh
scripts.webcontentassessor.com
GlobalSign Atlas R3 DV TLS CA 2020		 2021-01-27 -
2022-02-28		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-05-26 -
2021-08-24		 3 months crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
*.scorecardresearch.com
Amazon		 2021-02-28 -
2022-03-29		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
sni1ad09gl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2019-11-22 -
2021-12-01		 2 years crt.sh
sni1ad03gl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2019-11-22 -
2021-12-01		 2 years crt.sh
sni9642gl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-20 -
2022-03-22		 a year crt.sh
certify.alexametrics.com
Amazon		 2021-06-14 -
2022-07-13		 a year crt.sh
*.prod.experiment.routing.cloudfront.aws.a2z.com
Amazon		 2020-09-10 -
2021-10-10		 a year crt.sh
track.adform.net
DigiCert SHA2 Secure Server CA		 2019-09-16 -
2021-09-20		 2 years crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-06-27 -
2021-09-24		 3 months crt.sh
*.simpli.fi
DigiCert SHA2 Secure Server CA		 2019-09-18 -
2021-12-12		 2 years crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-03-29 -
2021-09-22		 6 months crt.sh
www.google.com
GTS CA 1C3		 2021-05-31 -
2021-08-23		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-06-07 -
2021-08-30		 3 months crt.sh
*.optimizely.com
DigiCert SHA2 Secure Server CA		 2021-02-17 -
2022-02-21		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-05-31 -
2021-08-23		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2021-03-05 -
2022-02-19		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-12-18 -
2022-01-18		 a year crt.sh
*.privacymanager.io
Amazon		 2020-10-24 -
2021-11-23		 a year crt.sh
*.azurewebsites.net
Microsoft RSA TLS CA 01		 2020-09-28 -
2021-09-28		 a year crt.sh
*.s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2021-01-11 -
2022-02-11		 a year crt.sh
*.rkdms.com
Entrust Certification Authority - L1K		 2020-10-08 -
2021-10-30		 a year crt.sh
*.liadm.com
Amazon		 2020-11-30 -
2021-12-29		 a year crt.sh
tag.wknd.ai
R3		 2021-05-27 -
2021-08-25		 3 months crt.sh
assets.bounceexchange.com
GTS CA 1D4		 2021-05-01 -
2021-07-30		 3 months crt.sh
*.google.nl
GTS CA 1C3		 2021-05-31 -
2021-08-23		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-05-31 -
2021-08-23		 3 months crt.sh
*.cdnbasket.net
Go Daddy Secure Certificate Authority - G2		 2020-07-29 -
2021-09-27		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-06-07 -
2021-08-30		 3 months crt.sh
www.i.matheranalytics.com
Sectigo RSA Domain Validation Secure Server CA		 2020-01-28 -
2022-01-27		 2 years crt.sh
ids.cdnwidget.com
GTS CA 1D4		 2021-05-01 -
2021-07-30		 3 months crt.sh
*.wunderkind.co
R3		 2021-06-01 -
2021-08-30		 3 months crt.sh
e.cdnwidget.com
GTS CA 1D4		 2021-06-28 -
2021-09-26		 3 months crt.sh
sync.spotim.market
R3		 2021-06-05 -
2021-09-03		 3 months crt.sh
*.search.spotxchange.com
GeoTrust RSA CA 2018		 2021-04-08 -
2022-05-09		 a year crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-03-22 -
2021-09-15		 6 months crt.sh
rumcdn.geoedge.be
Amazon		 2020-10-02 -
2021-11-03		 a year crt.sh
player.spotim.market
R3		 2021-06-28 -
2021-09-26		 3 months crt.sh
*.smartadserver.com
DigiCert ECC Secure Server CA		 2020-01-30 -
2022-02-03		 2 years crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-08 -
2021-08-08		 a year crt.sh
public1.adgear.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-24 -
2022-03-26		 a year crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-25 -
2021-12-26		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.tapad.com
DigiCert SHA2 Secure Server CA		 2020-10-05 -
2021-11-06		 a year crt.sh
*.semasio.net
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-09 -
2022-04-10		 a year crt.sh
*.exelator.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-06-07		 a year crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018		 2019-06-19 -
2021-08-31		 2 years crt.sh
*.adtelligent.com
Sectigo RSA Domain Validation Secure Server CA		 2020-10-28 -
2021-11-27		 a year crt.sh
s.adtelligent.com
ZeroSSL ECC Domain Secure Site CA		 2021-06-06 -
2021-09-04		 3 months crt.sh
hb.spotim.market
ZeroSSL ECC Domain Secure Site CA		 2021-06-10 -
2021-09-08		 3 months crt.sh
p.zetarail.com
R3		 2021-06-06 -
2021-09-04		 3 months crt.sh
sync.adtelligent.com
R3		 2021-06-05 -
2021-09-03		 3 months crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-03-18 -
2021-09-08		 6 months crt.sh
ghb.adtelligent.com
ZeroSSL ECC Domain Secure Site CA		 2021-06-11 -
2021-09-09		 3 months crt.sh
ghb1.adtelligent.com
ZeroSSL ECC Domain Secure Site CA		 2021-06-14 -
2021-09-12		 3 months crt.sh
*.lockerdome.com
Go Daddy Secure Certificate Authority - G2		 2020-09-27 -
2021-10-29		 a year crt.sh
*.creativecdn.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2021-03-30 -
2022-04-12		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2020-06-18 -
2021-08-17		 a year crt.sh
*.360yield.com
Amazon		 2020-08-26 -
2021-09-26		 a year crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-06-16 -
2021-07-28		 a month crt.sh
*.geoedge.be
Amazon		 2021-01-18 -
2022-02-16		 a year crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018		 2021-03-11 -
2022-02-07		 a year crt.sh
*.id5-sync.com
R3		 2021-06-01 -
2021-08-30		 3 months crt.sh
in.applicationinsights.azure.com
Microsoft RSA TLS CA 02		 2021-04-21 -
2022-04-21		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2021-04-12 -
2021-10-12		 6 months crt.sh
s.amazon-adsystem.com
Amazon		 2020-08-28 -
2021-08-20		 a year crt.sh
uploads.denverpost.com
R3		 2021-05-12 -
2021-08-10		 3 months crt.sh

This page contains 46 frames:

Primary Page: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Frame ID: 960CC68D09EE6EF9232C7AD05C755F86
Requests: 207 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Frame ID: A27DD7837E605130FA98E78EA2A8119D
Requests: 14 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
Frame ID: 6495DE362AE40A4F93E3F274279C9401
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3292070678450782984
Frame ID: 051D9F1DA8F617AC6735F2B17F9E2D4B
Requests: 1 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 5001FC58E95DDBDCE9AF2E758A94436B
Requests: 1 HTTP requests in this frame

Frame: https://cdn3.optimizely.com/js/geo2.js?cb=1624981502735
Frame ID: 0B85CF6367FB6F655B8BF0386B459DE6
Requests: 1 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/ighse75/rz1s9i5/iframe
Frame ID: 4A7B2E3E7E1F93B4C89E5A3DD4453A01
Requests: 2 HTTP requests in this frame

Frame: https://91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 7234E3138E9F5B288FFDE8ABB1DFBA85
Requests: 1 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Frame ID: 7471CC9643222B277C2F3DFE2A3C2549
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6ux1TvTLRne9l9Db3AUo7PH9y2SujHUFTY2Ye5qkQcpFzli-M_nFibC_8yLxWI7gUj5iaSx4Czlo17Jl7MaAd68kNGZJSL7xY_SwOnSeOPb_aIUSnkXFXYhKhmKiMXWcGr6qARDZKG2xOXdMJcYSrnJ1dCKltlI-IyCKxWI5ouerXcSLoBhiSxMSLWKdnXOlWJQ37FV4S77fdFA2uU8kUvxNly0_TVndCDjBKPgFktY61Hh6AjfWDH4nGTLKjlUeEaZEkjUcZZP-rRuWX1dpTDoZMngl0s3OzMDCsq0UHqdpXJroLlnBm6anVYBqfV6pr-2956wSfJt94tOsgnqGO&sig=Cg0ArKJSzMk8Cjfx6t2AEAE&adurl=
Frame ID: 5EC4EB3659FDDCEEF062B0C89ADE7B6F
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvUbIU9gebk_pR4LN8eZWRUn97mx3Pu24Ne7swMtqntMlRqSBk0PNu9zJknxrA3bpZw_OnWD_hvDTyyDH9QZQHG_-_Q-cTiz3rPQMKH3D1jJUTQtbBZApuN9vLCNFaB58S1Oy1yiHIVkl-SLxvQf1MF27ZyRn7iDIS93dmle9OWc3-lJJW0-S6-ElloNjz02O3vGaqqLd0IE559ClrI3LFwpSa0UU2Q_fJis8iHnCQuQ8VXDOH6UKnZV8CaHKSaR-3pF8AHdoyaVES8sfjaT7lC2jvUbJlYYWSA1gzc_Qb5DKGYaCWcWfHZzVrC44gJFsfommO6JOXrn9WNyLZMuHhY&sig=Cg0ArKJSzFm5b8vWtlt6EAE&adurl=
Frame ID: 2A43F83CBE563343FE74B1BF6E2FDCDB
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssuODjt6pSEFktLVi1VIYFexcoXQofEqdT2nVNp-D5GLpe6UmALEq4nlitc-pjKLI68ZPhmyHjmYbsBrCEuZDCGTOCikvdKjyj1IFfN-2xUs3_WbOVuq32zb0wtzz_hCb-Sn_GuOUwTnwuk5GJJc-0ZskM1Id_lL2652yth9js_Pf2UOGYuYIyQZYoSjcfFFqsQlmLv15_vZWz_5-HZfGFyRzqnL-p9AYmdvh-uFGlZ_tJ89ObhmeFUZ_pqUljeL38xOye-i7Lq9n_CVduwVwV2bkrgTCwCzx3ip6GJ25JU1uxp0Z95NBQXIer45VAHotCwhC7arbC0fz0LRUwDHAQo&sig=Cg0ArKJSzEXAIwl4o8WpEAE&adurl=
Frame ID: 3728526BFFB8D2F6C5DFC348A883C385
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuz6GFeP_LTspD_JYBEG_DKC13JxWw4W_s_d0fo-YEgG5lkjD0TOo4zSYuNdHYg0rqyLsU-5Zi6Sq-MVRLwnpDXMzmzraktKFqf91U_mIRZL9GjWqWud_dITaFhLIYL_OrLp5bLVfRYQwB5GZSVTcBZ8zg20XFtVpGMpq2CFTFKn-1voXCIkwNnBqa0Na1YeBHcDHw1R4MMBm7rD3Z9eeWtB7qC28tog7r8UQGGq6pP_8rF1B7XrgOwrb2TwulIMExH3_N2U5jgF8HWHnULDsmaCyTC5rbNZIrYO-Mk4pe49_OHiT5KPnHKURPXsQM_R3GBIEXAnJLHs5gVczrUtgs5aWU&sig=Cg0ArKJSzKsXmMFCJJ_CEAE&adurl=
Frame ID: 8A5B91C96102A796611D6979300E441A
Requests: 8 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Frame ID: E328B94A80C7170A91D5BFF83275E53F
Requests: 17 HTTP requests in this frame

Frame: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Frame ID: 61FCAE34A84E8A2E198C0F14ACAF24C8
Requests: 46 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6979242424886753422
Frame ID: C589D7127ACA433EF9601124F7DD30E4
Requests: 1 HTTP requests in this frame

Frame: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAAFHU7BtoAAADW_brKRIQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Frame ID: 0A23DF9E1454B2A26D122969B74BC275
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie=$UID&gdpr=0
Frame ID: 9A354DADADA53565F7C9BC4FB16546AB
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003
Frame ID: 1FD3D9715932CA88D83F1C2EB4A36477
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
Frame ID: EAAF0495C3D4F7E77893F250B57A6C04
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ahic9WSEj0wRc1Rt9yieXDvR
Frame ID: 8257C0FBC77355891AA324418DB912DC
Requests: 1 HTTP requests in this frame

Frame: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Frame ID: 40B7607C5BFCC5B76395B0CDB7B792C7
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: A39D5524874457C803DB4591AA6F7AE1
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=BkLbbTw2bU5h&pid=557219
Frame ID: F85D2B23709329BA1E2F5C7E5DBC5F73
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: 735D56E211E50D3B1F949D24B22911BC
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
Frame ID: 32E099D397040B800A43955C0C2B6C3F
Requests: 1 HTTP requests in this frame

Frame: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
Frame ID: C2B182509084159049CBCD7F0FB10F12
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rg573CxS1LYfVf5&gdpr=0&gdpr_consent=
Frame ID: 693313FF712C1DFE5A3D876C97999809
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=pHXeeUKXSTZwn-YYCcnNhJ8wNwc
Frame ID: 007DA0AA8B2C2E5B17EB7B8BFB5ADD56
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:61E2B7E0D53D483795802CF503F8FBDF
Frame ID: EC1074B2A71A529FACEC5E4FF7939458
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=42042ed4-289b-4cbf-a99d-f7a9cb117001
Frame ID: 08F0CA97A4BD38BD9BD5E77A58820EAC
Requests: 1 HTTP requests in this frame

Frame: https://sync.spotim.market/csync?t=a&ep=281178&extuid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
Frame ID: 290A00AA0BD613D282B60D92106E65FC
Requests: 1 HTTP requests in this frame

Frame: https://s.adtelligent.com/sync.html?aid=572165
Frame ID: C765FDE7468551CA49A928CD3750D9AA
Requests: 2 HTTP requests in this frame

Frame: https://p.zetarail.com/prebidlink/18807/j.html?i=8200
Frame ID: FDC0E91E6D7DFD6B5BBBF2DA7B7957FD
Requests: 10 HTTP requests in this frame

Frame: https://sync.adtelligent.com/csync?t=a&ep=323546&extuid=YNtABxyDNkYfEfFd2h9O.QAA%261131
Frame ID: 77CCA03418E9C0EB14B62D89A88A5AA6
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=17184-d
Frame ID: E8AA7A0CE8A21E70840E09AA2BB0E179
Requests: 11 HTTP requests in this frame

Frame: https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: 0A9867EB6329F4F6EDA3C7073EA28A38
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: F56E31AD47A816E521E6628993E82B06
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 9CA2A9DC45FFF06BD6A2EC7E1147F2CF
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Frame ID: 6F931884DF86163650BA7613DE7584BE
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 846236F53E57A0B69D916B70F2C68197
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 0004C470A8F2ECBB5E08D488BA74BAB8
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.denverpost.com
Frame ID: 6B52ACB9CB5A1701C60092990B0246FB
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 093B23CE516F6104BD43B1CBC64182F9
Requests: 11 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: F2F84B449640D7F36FBDB68A20C3011C
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 56DEF0F7F1AEC7877726316539D39C31
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /\/\/nexus\.ensighten\.com\//i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /\.quantserve\.com\/quant\.js/i

Page Statistics

410
Requests

99 %
HTTPS

24 %
IPv6

117
Domains

191
Subdomains

138
IPs

11
Countries

4671 kB
Transfer

15490 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71
  • https://js.matheranalytics.com/s/ma23578/239876503/wp/ml.js?cb=1567 HTTP 301
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/14/ml.br.js
Request Chain 76
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1624981502530&ns_c=UTF-8&c8=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&c7=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1624981502530&ns_c=UTF-8&c8=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&c7=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&c9=
Request Chain 95
  • https://c1.adform.net/serving/cookie/match?party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
Request Chain 96
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3292070678450782984
Request Chain 98
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WhcrCkXdTRGoa_MvgiLVsg%3D%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WhcrCkXdTRGoa_MvgiLVsg%3D%3D&google_tc= HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 99
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=228860db-3ffe-4900-a0ba-d45a0dff6643
Request Chain 101
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NUExNzJCMEEtNDVERC00RDExLUE4NkItRjMyRjgyMjJENUIy&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NUExNzJCMEEtNDVERC00RDExLUE4NkItRjMyRjgyMjJENUIy&gdpr=0&gdpr_consent=&google_tc= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 102
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESENhx_sKBpcJ6EwJPAIgJWtQ&google_cver=1
Request Chain 104
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2222419212698096373
Request Chain 105
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&gdpr=0&gdpr_consent=
Request Chain 106
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2
Request Chain 107
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3021078908452899730&gdpr=0&gdpr_consent=
Request Chain 155
  • https://cs.choozle.com/dp/chz/5450?d=www.denverpost.com&cb=6089030354 HTTP 302
  • https://cs.choozle.com/sync HTTP 302
  • https://cs.choozle.com/sync?v=true&cid=92b2f857-55d8-48e1-b031-a98d88a39154 HTTP 302
  • https://tags.bluekai.com/site/48443?id=92b2f857-55d8-48e1-b031-a98d88a39154&limit=1&redir=https%3A%2F%2Fcs.choozle.com%2Fsync%3Fpid%3D%24_BK_UUID%26dpsync%3Dbk%26cid%3D92b2f857-55d8-48e1-b031-a98d88a39154 HTTP 302
  • https://cs.choozle.com/sync?pid=TK%2F0my99999bd5%2BQ&dpsync=bk&cid=92b2f857-55d8-48e1-b031-a98d88a39154 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_puid=92b2f857-55d8-48e1-b031-a98d88a39154&ttd_pid=gdmv7qs&ttd_tpi=1 HTTP 302
  • https://cs.choozle.com/sync?pid=e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&dpsync=ttd&cid=92b2f857-55d8-48e1-b031-a98d88a39154 HTTP 302
  • https://idsync.rlcdn.com/459489.gif?partner_uid=92b2f857-55d8-48e1-b031-a98d88a39154 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=COGFHBIwCiwIARCp7AEaJDkyYjJmODU3LTU1ZDgtNDhlMS1iMDMxLWE5OGQ4OGEzOTE1NBAAGg0IgYDthgYSBQjoBxAAQgBKAA HTTP 307
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=0b3f1485-c2e3-4bf1-977e-97235c2bb5c5
Request Chain 167
  • https://insight.adsrvr.org/tags/ighse75/rz1s9i5/iframe HTTP 303
  • https://d1eoo1tco6rr5e.cloudfront.net/ighse75/rz1s9i5/iframe
Request Chain 227
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D271858%26extuid%3D%24UID HTTP 302
  • https://sync.spotim.market/csync?t=a&ep=271858&extuid=3021078908452899730
Request Chain 228
  • https://sync.search.spotxchange.com/partner?source=211945 HTTP 302
  • https://sync.search.spotxchange.com/partner?source=211945&__user_check__=1&sync_id=fa891760-d8f0-11eb-a599-1afcdea00206
Request Chain 229
  • https://pixel.advertising.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://pixel.advertising.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPfa8913b3-d8f0-11eb-93b1-02c8291bccce
Request Chain 230
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20&__user_check__=1&sync_id=fa893e00-d8f0-11eb-981b-1131174c0506 HTTP 302
  • https://sync.spotim.market/csync/?t=a&ep=301276&extuid=fa893dc4-d8f0-11eb-981b-1131174c0506
Request Chain 238
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6979242424886753422
Request Chain 239
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBRkhFN0J0b0FBQURXX2JyS1JJUQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBRkhFN0J0b0FBQURXX2JyS1JJUQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1&google_tc= HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1&_bee_ppp=1 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAAFHU7BtoAAADW_brKRIQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Request Chain 240
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 307
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie=$UID&gdpr=0
Request Chain 241
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3553511853 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3553511853 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/90d2043b-69e9-4cba-b47a-40bbd01c2c60 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003
Request Chain 243
  • https://green.erne.co/pubmatic/cm HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ahic9WSEj0wRc1Rt9yieXDvR
Request Chain 245
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 246
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%% HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=BkLbbTw2bU5h&pid=557219
Request Chain 247
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Request Chain 249
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxODQmdGw9MTU3NjgwMA==&r=https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB&partner_device_id=${PUBMATIC_UID} HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
Request Chain 250
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rg573CxS1LYfVf5&gdpr=0&gdpr_consent=
Request Chain 251
  • https://sync.srv.stackadapt.com/sync?nid=11 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=pHXeeUKXSTZwn-YYCcnNhJ8wNwc
Request Chain 252
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:61E2B7E0D53D483795802CF503F8FBDF
Request Chain 253
  • https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D HTTP 302
  • https://um.simpli.fi/match_redirect?sifi_redir=https%3A%2F%2Fmatch.bnmla.com%2Fusersync%3Fdspid%3D6%26uuid%3D%24UID HTTP 302
  • https://match.bnmla.com/usersync?dspid=6&uuid=D263009B61A24C448B8638E42A7882FA HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=42042ed4-289b-4cbf-a99d-f7a9cb117001
Request Chain 255
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr= HTTP 302
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=&fbounce=1 HTTP 302
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&addseg=17
Request Chain 256
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&sInitiator=external&gdpr=0&gdpr_consent= HTTP 302
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&sInitiator=external&gdpr=0&gdpr_consent=
Request Chain 258
  • https://loadm.exelator.com/load/?p=204&g=71&buid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=0&gdpr_consent=&j=0 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=71&buid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=0&gdpr_consent=&j=0&xl8blockcheck=1
Request Chain 260
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YNtAAwACN0IesgAC HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YNtAAwACN0IesgAC&gdpr=0&gdpr_consent=&_test=YNtAAwACN0IesgAC
Request Chain 261
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=FFTsTxEC7kgPAbAaEAWlHxVTvk8PBrwYRgdY9rHS
Request Chain 262
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic HTTP 302
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=e70277b2-7d2f-4030-a0fe-2f9c7a8d6236&ssp=pubmatic HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c3a61afa-33d3-45de-9e64-769eb1518c8c&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 263
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3249595990992905771&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 265
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:965fa246-2b6e-417d-afb5-74bb5c3e0805&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 266
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&gdpr=0&gdpr_consent=
Request Chain 267
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3021078908452899730
Request Chain 268
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4e4ae2d8-3977-45d2-bc80-301eeb069184
Request Chain 269
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=fa790e2a-d8f0-11eb-8bd0-e91864723560&gdpr=0&gdpr_consent=
Request Chain 278
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553%26partner_url%3Dhttps%253A%252F%252Fsync.adtelligent.com%252Fcsync%253Ft%253Da%2526ep%253D309017%2526extuid%253D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553%26partner_url%3Dhttps%253A%252F%252Fsync.adtelligent.com%252Fcsync%253Ft%253Da%2526ep%253D309017%2526extuid%253D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&xl8blockcheck=1 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553 HTTP 302
  • https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
Request Chain 281
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.denverpost.com%2F&domain=www.denverpost.com&cw=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=qv_W3nxxU3AySjdQVk85V2s3eGN0NmlYeldYME56dlJlNER1ZDBaem5Dam5NNXM1bUFFVkwraUtnbDVOa0s2YkpJckgrR0lQZGZCRmErMkI5emh4WUZaaGl1MllMTmdTaEg5cU1zWlhCOFdoVWdRK3JXUjdBQTFpTXAvRDFOeTVTVVM3VE1NNmpQQ1c4am9EeTNjckxPeDNtQTNjYnJDWjFMeDNYQkU0d0k4WFIvT0E0SEN1YlNjckNHYjNGNmRBajFWTnJMclVCeFphSUdtOFROTzNaWVFrN0d6NW9yVG1tMDQ3WGU3UW83cExFVTJObGNXbnU1YzJjRU01N3hYT2NRUm9vfA&cppv=2
Request Chain 300
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553%26partner_url%3Dhttps%253A%252F%252Fsync.adtelligent.com%252Fcsync%253Ft%253Da%2526ep%253D309017%2526extuid%253D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553%26partner_url%3Dhttps%253A%252F%252Fsync.adtelligent.com%252Fcsync%253Ft%253Da%2526ep%253D309017%2526extuid%253D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&xl8blockcheck=1 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553 HTTP 302
  • https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
Request Chain 301
  • https://ssum-sec.casalemedia.com/usermatchredir?s=189529&cb=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D323546%26extuid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D323546%26extuid%3D&s=189529&C=1 HTTP 302
  • https://sync.adtelligent.com/csync?t=a&ep=323546&extuid=YNtABxyDNkYfEfFd2h9O.QAA%261131
Request Chain 302
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17184-d HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=17184-d
Request Chain 303
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D323548%26extuid%3D%24UID HTTP 302
  • https://sync.adtelligent.com/csync?t=a&ep=323548&extuid=3021078908452899730
Request Chain 316
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FJODE3WjEtNC1KSFJI
Request Chain 317
  • https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjRiMTAxOTI1Zjg0MDdlYzc4MzkyMzgxZjI2NTk5ZDY4MTAyNGZhMA
Request Chain 318
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/8IYibNKj75tb1Gg1vr2uVg?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2512432862959234791
Request Chain 319
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=16f260db-4005-4f00-afe6-d20f581f7d3a
Request Chain 320
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KQI817Z1-4-JHRH&sigv=1&esig=2~ba879af882017bb2b8e029455ac61d3aa09f4a0e
Request Chain 322
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELNUZ1YyiYa0fDmdEBJzTFg&google_cver=1
Request Chain 362
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 375
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 379
  • https://sb.scorecardresearch.com/c2/6035443/cs.js HTTP 302
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
Request Chain 391
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm=&google_sc=&gdpr=1&gdpr_consent=&google_tc= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELRFDC1-OWTsK_eYVEfvP6w&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Request Chain 392
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODI0NTA5NTMwMDU1Mjg0MDM3
Request Chain 394
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/824509530055284037?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-gZIeu8FE2oQ.tttiNCnL17Ngozj_DfEAvONUsxc_EA--~A&dongle=0883
Request Chain 395
  • https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=1%26gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Feb2.3lift.com%252Fxuid%253Fmid%253D3335%2526xuid%253D%2524UID%2526dongle%253D4d58%2526gdpr%3D1%2526gdpr_consent%3D HTTP 302
  • https://eb2.3lift.com/xuid?mid=3335&xuid=5501602819095909930&dongle=4d58&gdpr=1&gdpr_consent=
Request Chain 396
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=824509530055284037 HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=824509530055284037&dcc=t
Request Chain 397
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

410 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/ 		204 KB
45 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx / WordPress VIP <https://wpvip.com>
Resource Hash
df88bec424942a5245856059224aa3e2043561588d0343acf441302d3184e3fc
Security Headers
Name Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob:; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:method
GET
:authority
www.denverpost.com
:scheme
https
:path
/2021/06/22/colorado-unemployment-fraud-phishing/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:01 GMT
content-type
text/html; charset=UTF-8
content-security-policy
default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob:; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
x-hacker
If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by
WordPress VIP <https://wpvip.com>
host-header
a9130478a60e5f9135f765b23f26593b
link
<https://www.denverpost.com/wp-json/>; rel="https://api.w.org/" <https://www.denverpost.com/wp-json/wp/v2/posts/4614849>; rel="alternate"; type="application/json" <https://dpo.st/3cUaopj>; rel=shortlink
content-encoding
gzip
x-rq
ams6 87 130 3156
cache-control
max-age=300, must-revalidate
age
0
x-cache
miss
vary
Accept-Encoding
accept-ranges
bytes
strict-transport-security
max-age=31536000;includeSubdomains
/
www.denverpost.com/_static/ 		60 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/_static/??-eJx9j90KwjAMhV/ILmyCPxciPkqXVhds2tFkyN7ezMEuRLxKOCfn4wReo6OMaQpRAEUgkCj0qeDTJeqrrzOIzik2TLmxgx1YAkvWmBXGND0oW+jOTuskaqxA6LVUsZhXwg/02/sLk7EoscnMJgt4kaiytpAhLjv7H3lMZMPx5DZSRbiFjbA04dJTis6HIQqV7NbfzLnypT103f58PLXtG+gDaHM=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e6e71f05d9bdd38041bcb651a99bc15ea64027dc04191c9c7c142f7282c62436
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/_static/??-eJx9j90KwjAMhV/ILmyCPxciPkqXVhds2tFkyN7ezMEuRLxKOCfn4wReo6OMaQpRAEUgkCj0qeDTJeqrrzOIzik2TLmxgx1YAkvWmBXGND0oW+jOTuskaqxA6LVUsZhXwg/02/sLk7EoscnMJgt4kaiytpAhLjv7H3lMZMPx5DZSRbiFjbA04dJTis6HIQqV7NbfzLnypT103f58PLXtG+gDaHM=
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 91 222 3120
last-modified
Thu, 13 May 2021 00:01:08 GMT
server
nginx
age
66123
vary
Accept-Encoding
x-cache
hit
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
9653
css
fonts.googleapis.com/ 		4 KB
1011 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=5.7.2
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3aa29d6340c1d354b2594b02413c66ec2775832ca183a3787514b03215069157
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.denverpost.com
Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 29 Jun 2021 15:44:18 GMT
server
ESF
date
Tue, 29 Jun 2021 15:45:01 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 29 Jun 2021 15:45:01 GMT
/
www.denverpost.com/_static/ 		90 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/_static/??-eJyVj90KwjAMRl/ILOwH0QvxUaS0cUTbpiyZw7d3BREGXuhdzsV3OMGlgJdslA1LnEfOiuGawAVIEhTVnLFHr+vpJ6LcJM7Nijv8slQ2gg0Eyg+aiqj9qErzR3AjK87f4dgccI2ZIykuHEYyRZMC1VoLn5F+1Vw4e1Tx7CJEGUU38E9QfePNdXJOp3bf9d3Q9kP3ApxIfW0=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cd19e78169e09d87c19d1360446509f97ef2a22f50c6900875455ad6632a8652
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/_static/??-eJyVj90KwjAMRl/ILOwH0QvxUaS0cUTbpiyZw7d3BREGXuhdzsV3OMGlgJdslA1LnEfOiuGawAVIEhTVnLFHr+vpJ6LcJM7Nijv8slQ2gg0Eyg+aiqj9qErzR3AjK87f4dgccI2ZIykuHEYyRZMC1VoLn5F+1Vw4e1Tx7CJEGUU38E9QfePNdXJOp3bf9d3Q9kP3ApxIfW0=
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 91 185 3143
last-modified
Wed, 09 Jun 2021 12:22:26 GMT
server
nginx
age
66322
vary
Accept-Encoding
x-cache
hit
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
23563
/
www.denverpost.com/_static/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/_static/??-eJytzEEOgyAQQNELiRM0qe3C9CwEBoKZAcMM7fVrE72Bq7f5+fDdja9FsSh4ygeGu9mpp1wELkPkfyWV0MTa2KliAyeCKiDNA9VE+EEaOZdxkwHu3QaMrpOe9zev9jFN82t5Wrv9AE8PSK8=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
6436303b662b2886d7757c3e092e03ab1da4e4176fc66c2c561373a10985c49a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/_static/??-eJytzEEOgyAQQNELiRM0qe3C9CwEBoKZAcMM7fVrE72Bq7f5+fDdja9FsSh4ygeGu9mpp1wELkPkfyWV0MTa2KliAyeCKiDNA9VE+EEaOZdxkwHu3QaMrpOe9zev9jFN82t5Wrv9AE8PSK8=
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 87 205 3162
last-modified
Tue, 18 May 2021 16:12:19 GMT
server
nginx
age
66123
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
1315
apstag.js
c.amazon-adsystem.com/aax2/ 		123 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
0f4b08d07ecca9f8fcaf108ea78bb163fc98cfc19a844bd0f87412ab34a41873

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 10:14:08 GMT
content-encoding
gzip
server
Server
age
19851
etag
c457e964d47ff007ca9e04843536c474
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-version-id
SOzAdyP7.FQsxAjkeGom0RVGr_hQgEwt
x-amz-cf-id
XTeRxYB7nNcIZQyKXpn7vJB7DSh3BY6lfpRCuSe-_aF9PNcCluYhbA==
zeus-adapter.js
www.denverpost.com/wp-content/plugins/dfm_zeus/assets/dist/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/plugins/dfm_zeus/assets/dist/zeus-adapter.js?m=1622397811g
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
84c9c9d4de88f5cf5e9ed1803bc3dc4a3a60be607d5b1d1c690151144e6a8a5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/plugins/dfm_zeus/assets/dist/zeus-adapter.js?m=1622397811g
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 87 194 3119
last-modified
Thu, 29 Apr 2021 10:33:35 GMT
server
nginx
age
758547
etag
W/"608a8b7f-43df"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
5681
expires
Wed, 29 Jun 2022 15:45:01 GMT
main.js
mng-denverpost.zeustechnology.com/ 		202 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mng-denverpost.zeustechnology.com/main.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c0d0348c2cf2b5675820d596a0b9325f5c2c962f46785973441d9425e41681b6

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
Dozpvy9P9oakxK91xtzPHmWPAw8MBtBT
content-encoding
gzip
last-modified
Thu, 27 May 2021 15:59:05 GMT
server
AmazonS3
age
3432
etag
W/"45b0138a2d190d11e03208f6cd116458"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 0f65f9aac16e53eeb77d85b7c23a21c2.cloudfront.net (CloudFront)
cache-control
max-age=600,s-maxage=3600
date
Tue, 29 Jun 2021 14:51:24 GMT
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
C9_21c9qjuXGzfYmHwBG2mK6Wfl-Pa3lsFIL2K5wHwJeiJW9RHC10A==
/
www.denverpost.com/_static/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/_static/??-eJyNjFsKwjAQRTfkdHxUoR/iEix0AVLTqaRkkpCbILh6W7DQT78u98A5/I5kgs/iM0dXXtaDh1EfHyngHpA8f4u8QFogPYsfnFQTdrxxjbPzkBZaK0iGW0ljSNp7I2tsAmssDlKp9f9Vuu6+sYFAOQSHX+Cm18PlWDf7U3Oupy8s6kyn
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
56ce57f0210be734225d723221ec671fd92f96421f8df1707d34e293284d50b4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/_static/??-eJyNjFsKwjAQRTfkdHxUoR/iEix0AVLTqaRkkpCbILh6W7DQT78u98A5/I5kgs/iM0dXXtaDh1EfHyngHpA8f4u8QFogPYsfnFQTdrxxjbPzkBZaK0iGW0ljSNp7I2tsAmssDlKp9f9Vuu6+sYFAOQSHX+Cm18PlWDf7U3Oupy8s6kyn
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 89 106 3194
last-modified
Mon, 28 Jun 2021 18:12:37 GMT
server
nginx
age
66123
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
3160
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 22 Jun 2021 16:31:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
602016
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Jun 2022 16:31:25 GMT
loader.min.js
www.denverpost.com/wp-content/plugins/loader-wp/static/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 89 106 3194
last-modified
Wed, 14 Apr 2021 23:40:28 GMT
server
nginx
age
758619
etag
W/"60777d6c-3e4a"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
5483
expires
Wed, 29 Jun 2022 15:45:01 GMT
pushly-sdk.min.js
cdn.p-n.io/ 		352 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.p-n.io/pushly-sdk.min.js?domain_key=WZUt8dwXwUZotnPfklpQcv7B2rwEoNFUnwAN&ver=5.7.2
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2ef693f04a86bd6c802b168f1f35ef62f65a024148c53f734821393986cdb094

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
last-modified
Wed, 23 Jun 2021 23:56:20 GMT
server
AmazonS3
x-amz-cf-pop
AMS1-C1
etag
W/"f0369ce9999763c567fac285d521fb2f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
2592000
cache-control
max-age=900
x-cache
Hit from cloudfront
x-amz-cf-id
IXmqRa2FWLXvSwgRzBs9JwOTlTdFBMeqg5j4ZRqx80qM-CR_vYaztA==
via
1.1 f32f19f2f9b3c0c60a4ff31c809ed008.cloudfront.net (CloudFront)
dfm-pushly.min.js
www.denverpost.com/wp-content/plugins/dfm-pushly/static/js/ 		160 B
239 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/plugins/dfm-pushly/static/js/dfm-pushly.min.js?m=1622397811g
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/plugins/dfm-pushly/static/js/dfm-pushly.min.js?m=1622397811g
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
x-rq
ams6 87 205 3162
last-modified
Thu, 06 May 2021 21:08:39 GMT
server
nginx
age
758547
etag
"60945ad7-a0"
strict-transport-security
max-age=31536000;includeSubdomains
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
160
expires
Wed, 29 Jun 2022 15:45:01 GMT
medianewsgroup.js
cdn.blueconic.net/ 		136 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.blueconic.net/medianewsgroup.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-121.fra2.r.cloudfront.net
Software
- /
Resource Hash
4a167d4099e1480af5dc1dd04cd1fbd600fcdd2d93ade21244537f28adb1fda5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:41:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
age
209
x-cache
Hit from cloudfront
content-length
41268
x-xss-protection
1; mode=block
last-modified
Tue, 22 Jun 2021 15:35:03 GMT
server
-
etag
"21e89-5c55c889ab668-gzip"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
via
1.1 f7bf326347bdd7f275a38a22b5b83724.cloudfront.net (CloudFront)
cache-control
public, max-age=600, s-maxage=500
x-amz-cf-pop
FRA2-C1
accept-ranges
none
x-robots-tag
noindex, nofollow
x-amz-cf-id
AQmyeFNqgVDlUEDtC1xJkcKFjPFMJlUw3LmLznQ54GeucTrj3DyDkQ==
osano.js
cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/ 		380 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:1200:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
c66dbf6b5716d3f7c8ece663d59bd0a576cc6bcc799e05c342255bcdce5338bf
Security Headers
Name Value
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=2592000
content-encoding
br
x-content-type-options
nosniff
age
34837
x-cache
Hit from cloudfront
date
Tue, 29 Jun 2021 06:04:28 GMT
content-length
82748
x-xss-protection
mode=block
last-modified
Tue, 27 Apr 2021 03:34:03 GMT
server
CloudFront
etag
"520ce580452205946fe2409cb804c2d0"
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
via
1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
cache-control
public, max-age=86400, s-maxage=86400, must-revalidate, proxy-revalidate, no-transform
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
A8NgocHjVWHMNz4KVJ8kgAn3VjiB4LLNkWewQdJzAtpEJSYnB4qF8w==
mg2nw.min.js
prodmg2.blob.core.windows.net/newsletterwidget/mngcep/ 		142 KB
143 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prodmg2.blob.core.windows.net/newsletterwidget/mngcep/mg2nw.min.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.82.152.48 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
1994c60967493250d994f00dac0d8fa3b6ac442a090bc147691e0ce948f5b26c

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Tue, 29 Jun 2021 15:45:01 GMT
Last-Modified
Wed, 26 May 2021 12:25:15 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
UAPhrGrDHF720fH0zq0Q6Q==
ETag
0x8D9204150CC0C86
Content-Type
application/javascript
Access-Control-Allow-Origin
*
x-ms-request-id
d655608b-d01e-0046-70fd-6cf8e9000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
145533
hhsl-check.min.js
www.denverpost.com/wp-content/plugins/dfm-ad-mods/static/js/ 		2 KB
884 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js?m=1622397811g
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
bcc12496cca31bf3ce07009f2b035c7405081719cc9bcc534e1272649c6afd9f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js?m=1622397811g
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 87 130 3156
last-modified
Sun, 30 May 2021 18:03:31 GMT
server
nginx
age
758547
etag
W/"60b3d373-882"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
801
expires
Wed, 29 Jun 2022 15:45:01 GMT
dp-logo-1.svg
www.denverpost.com/wp-content/uploads/2020/11/ 		10 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.denverpost.com/wp-content/uploads/2020/11/dp-logo-1.svg
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2590d66919bcebebcab8820a8e98a672c795c718f39f53d1c62cdd26ced8660b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/uploads/2020/11/dp-logo-1.svg
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-rq
ams6 109 142 443
last-modified
Tue, 10 Nov 2020 18:50:29 GMT
server
nginx
etag
W/"9a1141ac603be4a8"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=2592000
strict-transport-security
max-age=31536000;includeSubdomains
expires
Wed, 06 Apr 2022 13:52:25 GMT
boldcoastal.css
www.denverpost.com/wp-content/themes/assets/static/css/ 		382 KB
59 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/themes/assets/static/css/boldcoastal.css?ver=1622397811
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cab9075ee8befa04884e463d30c2d393f3cfa8e80851ccc8a5e27973e450b2b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/themes/assets/static/css/boldcoastal.css?ver=1622397811
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-rq
ams6 87 194 3119
last-modified
Tue, 08 Jun 2021 20:22:48 GMT
server
nginx
age
758548
etag
W/"60bfd198-5f8fb"
vary
Accept-Encoding
x-cache
hit
content-type
text/css
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
60028
expires
Wed, 29 Jun 2022 15:45:02 GMT
main.js
mng-denverpost.zeustechnology.com/ 		0
54 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://mng-denverpost.zeustechnology.com/main.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
Dozpvy9P9oakxK91xtzPHmWPAw8MBtBT
content-encoding
gzip
last-modified
Thu, 27 May 2021 15:59:05 GMT
server
AmazonS3
age
3432
etag
W/"45b0138a2d190d11e03208f6cd116458"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 0f65f9aac16e53eeb77d85b7c23a21c2.cloudfront.net (CloudFront)
cache-control
max-age=600,s-maxage=3600
date
Tue, 29 Jun 2021 14:51:24 GMT
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
AwEUZAd8z9BnsTYv-S60yXtHHUe5dB65xBeHcctuJN5-4u5tV9R4fw==
apstag.js
c.amazon-adsystem.com/aax2/ 		0
33 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 10:14:08 GMT
content-encoding
gzip
server
Server
age
19852
etag
c457e964d47ff007ca9e04843536c474
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-version-id
SOzAdyP7.FQsxAjkeGom0RVGr_hQgEwt
x-amz-cf-id
VWILtZ4Y_RsnBgwQmyzFNjm0qUfPLeOtaAxuVt7NQsrGCakor9IXNg==
wp-emoji-release.min.js
www.denverpost.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-rq
ams6 87 130 3156
last-modified
Thu, 13 May 2021 00:01:17 GMT
server
nginx
age
758619
etag
W/"609c6c4d-3795"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
4712
expires
Wed, 29 Jun 2022 15:45:02 GMT
Trust-Logo-Horizontal.svg
www.denverpost.com/wp-content/plugins/dfm-trust-indicators/static/images/ 		7 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.denverpost.com/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-rq
ams6 87 194 3119
last-modified
Thu, 29 Apr 2021 10:33:35 GMT
server
nginx
age
263
etag
W/"608a8b7f-1ab8"
vary
Accept-Encoding
x-cache
hit
content-type
image/svg+xml
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
2485
expires
Wed, 29 Jun 2022 15:45:02 GMT
sp_sXPv48AD
launcher.spot.im/spot/ 		418 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://launcher.spot.im/spot/sp_sXPv48AD
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.154 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
fasthttp /
Resource Hash
2660f2b99e85e68fa8824e34184467a69e55c4023287042919cd3623db8ac01c

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
br
server
fasthttp
cache-control
max-age=600
content-type
application/javascript; charset=UTF-8
content-length
94672
expires
Tue, 29 Jun 2021 15:55:02 GMT
loading.gif
www.denverpost.com/wp-content/mu-plugins/jetpack-9.8/modules/sharedaddy/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.denverpost.com/wp-content/mu-plugins/jetpack-9.8/modules/sharedaddy/images/loading.gif
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/mu-plugins/jetpack-9.8/modules/sharedaddy/images/loading.gif
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
x-rq
ams6 89 54 3226
last-modified
Thu, 27 May 2021 18:19:25 GMT
server
nginx
age
758558
etag
"60afe2ad-9e2"
strict-transport-security
max-age=31536000;includeSubdomains
x-cache
hit
content-type
image/gif
cache-control
max-age=31536000
accept-ranges
bytes
content-length
2530
expires
Wed, 29 Jun 2022 15:45:02 GMT
comments-number.css
www.denverpost.com/wp-content/plugins/spotim-comments/assets/stylesheets/ 		1 KB
736 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/plugins/spotim-comments/assets/stylesheets/comments-number.css?m=1622397811g
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
60ae6a4bb71a75329fc3c3e5616989c9f855c27dbbc9c5c2f1e05523f3fdd579
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/plugins/spotim-comments/assets/stylesheets/comments-number.css?m=1622397811g
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 87 194 3119
last-modified
Thu, 29 Apr 2021 10:33:35 GMT
server
nginx
age
758547
etag
W/"608a8b7f-4fa"
vary
Accept-Encoding
x-cache
hit
content-type
text/css
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
668
expires
Wed, 29 Jun 2022 15:45:01 GMT
/
www.denverpost.com/_static/ 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/_static/??-eJyVzUEKwjAQQNELmQ6pYHUhHkVKMtUJySRkJhVzemnBnRu3Dz4fXsW4zIqsUGJ7EAv4Jd07NoFZBFVAqoOws9nYpOxlSMRDkAP86Msza+aFYoQV2ecKhZy2ihv9F8a5v4U6fn+3dLWncTxeprO14QPPX0bI
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b6314c8400868242589514cba66862e787c8ec59275942e0417a65f821a0a976
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/_static/??-eJyVzUEKwjAQQNELmQ6pYHUhHkVKMtUJySRkJhVzemnBnRu3Dz4fXsW4zIqsUGJ7EAv4Jd07NoFZBFVAqoOws9nYpOxlSMRDkAP86Msza+aFYoQV2ecKhZy2ihv9F8a5v4U6fn+3dLWncTxeprO14QPPX0bI
pragma
no-cache
cookie
bc_tstgrp=4; BCRevision_1624981501675=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22entrypage%22%3A%5B%22https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F%22%5D%2C%22testgroup%22%3A%5B4%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22currentresolution%22%2C%22entrypage%22%5D%2C%22testgroup_prelistener%22%3A%5B%22testgroup%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501675%22%7D; BCRevision_1624981501676=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501676%22%7D
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 89 106 3194
last-modified
Wed, 12 May 2021 18:16:56 GMT
server
nginx
age
66123
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
8024
ads.js
www.denverpost.com/wp-content/themes/wp-mason/static/js/ 		87 B
186 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
pragma
no-cache
cookie
bc_tstgrp=4; BCRevision_1624981501675=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22entrypage%22%3A%5B%22https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F%22%5D%2C%22testgroup%22%3A%5B4%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22currentresolution%22%2C%22entrypage%22%5D%2C%22testgroup_prelistener%22%3A%5B%22testgroup%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501675%22%7D; BCRevision_1624981501676=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501676%22%7D
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
x-rq
ams6 86 177 3241
last-modified
Thu, 29 Apr 2021 19:40:27 GMT
server
nginx
age
758618
etag
"608b0bab-57"
strict-transport-security
max-age=31536000;includeSubdomains
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
87
expires
Wed, 29 Jun 2022 15:45:01 GMT
/
www.denverpost.com/_static/ 		102 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/_static/??-eJydz8sKwjAQheEXMh1awctCfJY0SdvUzExwJopvb0AXCiLW7Q8fnAPXbByTBlLQKWAQsCJBBUStRgezgGNEpsZNhU4NRmpmWcEPLnO6DTElWYJ6Tt6xrSF9YbWgFaYXmHg0kUxfVOvYpZRNxNFY1fMnmlMZIwn4AY31BtnLG6/tcWQ5lo4u0Qf+Q2bWuvoJj3hoN1233m93bTvfAVvurl8=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a993d84168913a07e214ea72d07fafee0f9716680910bf1202ea9f2fc603e29a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/_static/??-eJydz8sKwjAQheEXMh1awctCfJY0SdvUzExwJopvb0AXCiLW7Q8fnAPXbByTBlLQKWAQsCJBBUStRgezgGNEpsZNhU4NRmpmWcEPLnO6DTElWYJ6Tt6xrSF9YbWgFaYXmHg0kUxfVOvYpZRNxNFY1fMnmlMZIwn4AY31BtnLG6/tcWQ5lo4u0Qf+Q2bWuvoJj3hoN1233m93bTvfAVvurl8=
pragma
no-cache
cookie
bc_tstgrp=4; BCRevision_1624981501675=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22entrypage%22%3A%5B%22https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F%22%5D%2C%22testgroup%22%3A%5B4%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22currentresolution%22%2C%22entrypage%22%5D%2C%22testgroup_prelistener%22%3A%5B%22testgroup%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501675%22%7D; BCRevision_1624981501676=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501676%22%7D
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 87 130 3156
last-modified
Sun, 30 May 2021 18:03:31 GMT
server
nginx
age
66123
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
29412
embed.js
c.go-fet.ch/a/ 		177 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.go-fet.ch/a/embed.js?ver=1.0.0
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:e000:c:2267:880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e5b116fcb9ac4bb4acdb2eec031b39eed112fd86b3938c87caac511db03a33e1

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:37:15 GMT
content-encoding
gzip
last-modified
Mon, 28 Jun 2021 22:35:30 GMT
server
AmazonS3
age
471
etag
W/"e37d96bfaabda9d16c5cf6168a56fe3f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
cache-control
public,max-age=900
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
fXo_LjEwwj-xNigN48DmwhoNillPXMDiE512GYCq5Y-fjXypIW73iw==
/
www.denverpost.com/_static/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/_static/??/wp-includes/js/wp-embed.min.js,/wp-content/mu-plugins/jetpack-9.8/_inc/build/sharedaddy/sharing.min.js?m=1622139566j
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5ec473c7cce7c6753ceb7037a43c201b36aae6409d646f4e303f1045694d4da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/_static/??/wp-includes/js/wp-embed.min.js,/wp-content/mu-plugins/jetpack-9.8/_inc/build/sharedaddy/sharing.min.js?m=1622139566j
pragma
no-cache
cookie
bc_tstgrp=4; BCRevision_1624981501675=%7B%22method%22%3A%22setProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22language%22%3A%5B%22en%22%5D%2C%22currentscreenwidth%22%3A%5B1600%5D%2C%22currentscreenheight%22%3A%5B1200%5D%2C%22currentresolution%22%3A%5B%221600x1200%22%5D%2C%22entrypage%22%3A%5B%22https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F%22%5D%2C%22testgroup%22%3A%5B4%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22language%22%2C%22currentscreenwidth%22%2C%22currentscreenheight%22%2C%22currentresolution%22%2C%22entrypage%22%5D%2C%22testgroup_prelistener%22%3A%5B%22testgroup%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501675%22%7D; BCRevision_1624981501676=%7B%22method%22%3A%22addProperties%22%2C%22param%22%3A%7B%22properties%22%3A%7B%22resolution%22%3A%5B%221600x1200%22%5D%7D%2C%22sources%22%3A%7B%22listenerinteractiontype%22%3A%5B%22resolution%22%5D%7D%7D%2C%22requestId%22%3A%22rev_1624981501676%22%7D
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-rq
ams6 87 194 3119
last-modified
Thu, 27 May 2021 18:19:25 GMT
server
nginx
age
66123
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
4401
p.js
cdn.parsely.com/keys/denverpost.com/ 		50 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.parsely.com/keys/denverpost.com/p.js?ver=2.5.0
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2eab49f65f53d3e7bdd7afbe21369f1aa082075f913e05fc104253ac0f2b74e7

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
public
date
Tue, 29 Jun 2021 12:25:22 GMT
content-encoding
gzip
last-modified
Mon, 08 Mar 2021 19:07:47 GMT
server
nginx
age
12201
etag
W/"60467603-c8b8"
x-cache
Hit from cloudfront
content-type
application/x-javascript
via
1.1 8da78542dac6b4328eb443200c30bbff.cloudfront.net (CloudFront)
cache-control
max-age=86400, public
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
2bx4dii0EjeibozHottwTuiCJsTtWPAyGOf0m-RaqCNaQjF7I4Xaug==
expires
Wed, 30 Jun 2021 12:21:39 GMT
e-202126.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202126.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT ams
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Sun, 19 Jun 2022 22:35:29 GMT
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
eEYYOb32LZFr6yGAi8hXG4401uAIPew2
content-encoding
gzip
etag
W/"a4d296427fc806b21335359e398c025c"
age
5096
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Wed, 07 Apr 2021 05:49:36 GMT
server
AmazonS3
date
Tue, 29 Jun 2021 14:21:57 GMT
vary
Origin
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 e79fcd7f3f0a842841acfca75e35ea79.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
AMS1-C1
x-amz-cf-id
BLi-LU_c8Yzgmq2FbMa1f1wYg0vQP5ThODqko607M64-Fo_l_FF7Ug==
TWTC4-NWJAU-FVVAU-VQNPU-LATGK
c.go-mpulse.net/boomerang/ 		205 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/boomerang/TWTC4-NWJAU-FVVAU-VQNPU-LATGK
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/_static/??-eJyNjFsKwjAQRTfkdHxUoR/iEix0AVLTqaRkkpCbILh6W7DQT78u98A5/I5kgs/iM0dXXtaDh1EfHyngHpA8f4u8QFogPYsfnFQTdrxxjbPzkBZaK0iGW0ljSNp7I2tsAmssDlKp9f9Vuu6+sYFAOQSHX+Cm18PlWDf7U3Oupy8s6kyn
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:1b8::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Akamai Resource Optimizer /
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:01 GMT
Content-Encoding
br
Last-Modified
Sun, 13 Jun 2021 07:37:57 GMT
Server
Akamai Resource Optimizer
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800, s-maxage=604800
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
50393
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FA5) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
1404
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (frc/8FA5)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
6a5a1659-601e-007c-45fa-6cc68a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 29 Jun 2021 16:15:02 GMT
polyfill.min.js
polyfill.io/v3/ 		72 B
538 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.26 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
age
1495735
detected-user-agent
HeadlessChrome/89.0.4389
server-timing
HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length
74
referrer-policy
origin-when-cross-origin
last-modified
Fri, 11 Jun 2021 23:24:49 GMT
date
Tue, 29 Jun 2021 15:45:02 GMT
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
normalized-user-agent
chrome/89.0.0
access-control-allow-origin
*
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
325
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/ 		105 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2021-06-29T17%3A45%3A01%2B02%3A00&ts=1624981501676
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
2282ced248e7dfa95a0db3f829d2797b09a17eae029a540441586bfea5c1affa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
15155
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
bd0d384fa562a28bf0983ee79e18bb3b
medianewsgroup.blueconic.net/plugin/plugin/ 		301 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/plugin/plugin/bd0d384fa562a28bf0983ee79e18bb3b
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
092de8574d38ed761b0630d125bc529387eed04dd9d8d5ace8bc681eced9f3dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Jun 2021 15:45:02 GMT
server
-
etag
bd0d384fa562a28bf0983ee79e18bb3b
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
x-permitted-cross-domain-policies
master-only
cache-control
public, no-cache="Set-Cookie", max-age=31536000
content-type
text/javascript; charset=utf-8
content-length
71610
x-xss-protection
1; mode=block
expires
Wed, 29 Jun 2022 15:45:02 GMT
LB-Zone-2
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325/ 		266 B
789 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325/LB-Zone-2?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=&bctempid=8b00c746-e983-4052-a01c-366c4ab7697f&overruleReferrer=&time=2021-06-29T17%3A45%3A02%2B02%3A00&ts=1624981502175
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
d048cd3c852f67da3ffb5ae455897b5e9ab33521454fcd3fbdbe7cbe34e9d8f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
186
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
gtm.js
www.googletagmanager.com/ 		425 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
28582e6a99ab6b2a37befb7303b16c1de90f8dba9bfaa2c12420de9213d2e68c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
81147
x-xss-protection
0
last-modified
Tue, 29 Jun 2021 15:20:46 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 29 Jun 2021 15:45:02 GMT
SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v12/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=5.7.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a615849237c0ce94e73fc69d86e5f9c58bdaca8d9756a5ff4c88fa86b14e6177
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.denverpost.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 23 Jun 2021 23:58:58 GMT
x-content-type-options
nosniff
age
488764
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21232
x-xss-protection
0
last-modified
Thu, 20 Feb 2020 01:56:42 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 23 Jun 2022 23:58:58 GMT
SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v12/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v12/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=5.7.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
06c572e99c878362d40d1f358efdfe400ae1310f35cf22174dcdd5db022dd810
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.denverpost.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 22 Jun 2021 21:41:38 GMT
x-content-type-options
nosniff
age
583404
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22340
x-xss-protection
0
last-modified
Thu, 20 Feb 2020 02:52:18 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Jun 2022 21:41:38 GMT
truncated
/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141

Request headers

Origin
https://www.denverpost.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
font/truetype
13257
check.analytics.rlcdn.com/check/ 		25 B
388 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://check.analytics.rlcdn.com/check/13257
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8a9ba7bbc88ec23d81a2d63845638a3b6603de473261872f301803cef84ef335

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
via
1.1 a06d82f018833bef3e7f2e9fd230e5ee.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-C1
x-amzn-requestid
ea191ddc-c68c-425a-ad5d-2c5e58db0008
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amzn-trace-id
Root=1-60db3ffe-3a2aa0504143a8e21babebe3;Sampled=0
x-amz-apigw-id
BsbvxHeIoAMFgcg=
content-length
25
x-amz-cf-id
ThqRE2gcXmARMi02d06g-J21ePQzbOJwJshbwszz_es-TvtgMjkQ6A==
publishertag.js
static.criteo.net/js/ld/ 		117 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.js
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
758135feb6954c2501153f4a7846378a69e4189243d09272685850b10632358f

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
last-modified
Wed, 02 Jun 2021 14:10:01 GMT
server
nginx
etag
W/"60b79139-1d469"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 30 Jun 2021 15:45:02 GMT
185707-19209563922117.js
js-sec.indexww.com/ht/p/ 		40 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/ht/p/185707-19209563922117.js
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5f73db920d574a8ba16efc308a57e03f838227d4935e9892ec4d7403cf663517

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:03 GMT
Content-Encoding
gzip
Last-Modified
Tue, 29 Jun 2021 15:41:11 GMT
Server
Apache
ETag
"760de0-9fd7-5c5e96f6d4deb"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=3599
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
13656
Expires
Tue, 29 Jun 2021 16:45:02 GMT
userSync.js
ads.pubmatic.com/AdServer/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/userSync.js
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:14 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300709-1af3-5c4c7cca9e573"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
public, max-age=72327
accept-ranges
bytes
content-type
text/javascript
content-length
2267
expires
Wed, 30 Jun 2021 11:50:29 GMT
sync.js
ib.3lift.com/ 		275 B
618 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.3lift.com/sync.js
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
c815be0139a92202ff8f262cc335f6ae103594bb1d92c1c479ed604adf384a16

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:35:27 GMT
via
1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
last-modified
Tue, 29 Jun 2021 15:35:27 GMT
age
575
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=900
x-rev
fbdf79a
x-amz-cf-pop
AMS1-C1
content-length
275
x-amz-cf-id
hqpfpgXU-53gdX0hP4GQZTsvSnBQKIBXLOw4bxEUy-nbaLFTs-mu6w==
x-served-by
impression-bus5.us_east.prod
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
sffe /
Resource Hash
de3e98641c1d746e61b91de6394c62c30825073d247814fde10c2ec7dc49bda6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"915 / 60 of 1000 / last-modified: 1624965047"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24254
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:02 GMT
tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
fonts.gstatic.com/s/droidserif/v13/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v13/tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=5.7.2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ad15918ec10a62580864ae3198a9d9545f260fe70e6cb9aa65901a5b02584fec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.denverpost.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 24 Jun 2021 05:39:00 GMT
x-content-type-options
nosniff
age
468362
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25984
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:28 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 24 Jun 2022 05:39:00 GMT
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Origin
https://www.denverpost.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/font-woff;charset=utf-8
script.js
cdn.listrakbi.com/scripts/ 		64 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.81.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
864171daa3d07a43d8a53f27975fe588295bd4931fe4411a26c2bea75326c204

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:02 GMT
Content-Encoding
gzip
X-AspNet-Version
4.0.30319
X-ltk
6/29/2021 7:05:24 AM
X-Powered-By
ASP.NET
X-Cache
RefreshHit from cloudfront
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI COM NAV INT DEM CNT PRE LOC"
Connection
keep-alive
Content-Length
20328
Last-Modified
Wed, 23 Jun 2021 17:46:33 GMT
Server
Microsoft-IIS/8.5
ETag
"eSkx8WzKhqQaJzJX4xUC8Q=="
Vary
Accept-encoding
Content-Type
text/javascript; charset=utf-8
Via
1.1 0186e9c41d0aebb13c1398b95b7f4757.cloudfront.net (CloudFront)
Cache-Control
public, no-transform, max-age=3600, s-maxage=600
X-Amz-Cf-Pop
AMS1-C1
Accept-Ranges
bytes
X-Amz-Cf-Id
CplKoGXN9OEHU2hEa9aO0hZ0dZ4t-eSHAcFOEv0w6RipKqSz_6BsQw==
Expires
Tue, 29 Jun 2021 16:45:02 GMT
common.chunk.min.js
www.denverpost.com/wp-content/themes/assets/static/js/ 		42 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/themes/assets/static/js/common.chunk.min.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/_static/??-eJydz8sKwjAQheEXMh1awctCfJY0SdvUzExwJopvb0AXCiLW7Q8fnAPXbByTBlLQKWAQsCJBBUStRgezgGNEpsZNhU4NRmpmWcEPLnO6DTElWYJ6Tt6xrSF9YbWgFaYXmHg0kUxfVOvYpZRNxNFY1fMnmlMZIwn4AY31BtnLG6/tcWQ5lo4u0Qf+Q2bWuvoJj3hoN1233m93bTvfAVvurl8=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
dbae94cba2ba3d07d6ae6e79a7c60c4efc36deb442e193ab18e0fd0cd4d97eef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/themes/assets/static/js/common.chunk.min.js
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-rq
ams6 91 185 3143
last-modified
Wed, 14 Apr 2021 23:18:35 GMT
server
nginx
age
758618
etag
W/"6077784b-a62f"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
10587
expires
Wed, 29 Jun 2022 15:45:02 GMT
common-async.chunk.min.js
www.denverpost.com/wp-content/themes/assets/static/js/ 		56 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/themes/assets/static/js/common-async.chunk.min.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/_static/??-eJydz8sKwjAQheEXMh1awctCfJY0SdvUzExwJopvb0AXCiLW7Q8fnAPXbByTBlLQKWAQsCJBBUStRgezgGNEpsZNhU4NRmpmWcEPLnO6DTElWYJ6Tt6xrSF9YbWgFaYXmHg0kUxfVOvYpZRNxNFY1fMnmlMZIwn4AY31BtnLG6/tcWQ5lo4u0Qf+Q2bWuvoJj3hoN1233m93bTvfAVvurl8=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1ea03e7bb14df931f8a649756cffe9465c815aa0efc23acce14b50e21c3d20ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/themes/assets/static/js/common-async.chunk.min.js
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-rq
ams6 87 194 3119
last-modified
Thu, 29 Apr 2021 10:33:35 GMT
server
nginx
age
758618
etag
W/"608a8b7f-e145"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
8564
expires
Wed, 29 Jun 2022 15:45:02 GMT
boldcoastal-async.chunk.min.js
www.denverpost.com/wp-content/themes/assets/static/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.denverpost.com/wp-content/themes/assets/static/js/boldcoastal-async.chunk.min.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/_static/??-eJydz8sKwjAQheEXMh1awctCfJY0SdvUzExwJopvb0AXCiLW7Q8fnAPXbByTBlLQKWAQsCJBBUStRgezgGNEpsZNhU4NRmpmWcEPLnO6DTElWYJ6Tt6xrSF9YbWgFaYXmHg0kUxfVOvYpZRNxNFY1fMnmlMZIwn4AY31BtnLG6/tcWQ5lo4u0Qf+Q2bWuvoJj3hoN1233m93bTvfAVvurl8=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ab5186d21dd8de73feda81815eb24a9906b827a0ff943d5a8d59a22e30245952
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

:path
/wp-content/themes/assets/static/js/boldcoastal-async.chunk.min.js
pragma
no-cache
cookie
bc_tstgrp=4; BCTempID=8b00c746-e983-4052-a01c-366c4ab7697f; BCZoneID=LB-Zone-2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.denverpost.com
referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-rq
ams6 87 205 3162
last-modified
Thu, 06 May 2021 21:08:40 GMT
server
nginx
age
758618
etag
W/"60945ad8-abe"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000;includeSubdomains
accept-ranges
bytes
content-length
1217
expires
Wed, 29 Jun 2022 15:45:02 GMT
truncated
/ 		772 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
884c4cba946fc8a2c5479e4abb423711013a05af259ac7a7a31cafdb9d0e7dd1

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
gtm.js
www.googletagmanager.com/ 		107 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KM8CCP2
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9eca93bb4e6c04a645696299609a03d3949ee8b75838e868dabd2d3182ece65e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36336
x-xss-protection
0
last-modified
Tue, 29 Jun 2021 15:20:46 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 29 Jun 2021 15:45:02 GMT
denverpost.com.json
c.go-fet.ch/hosts/ 		52 B
557 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://c.go-fet.ch/hosts/denverpost.com.json
Requested by
Host: c.go-fet.ch
URL: https://c.go-fet.ch/a/embed.js?ver=1.0.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:e000:c:2267:880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d1fc811cb918e99c124039ed41021b91ce278410d6c4476fe101be24188a0cd2

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
content-length
70
access-control-allow-origin
*
last-modified
Tue, 23 Mar 2021 18:37:24 GMT
server
AmazonS3
etag
"e4104856216064dceafecfc265701507"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/json; charset=utf-8
via
1.1 9e62923882d737ac8cd27f0d1b1c24cf.cloudfront.net (CloudFront)
cache-control
public, max-age=300
x-amz-cf-id
P2oZdvKvrkkC0Bzpu7TEj5mm0O1P-Hit7O5y-wUubZvLIXKaVqOfwg==
/
p1.parsely.com/plogger/ 		43 B
258 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p1.parsely.com/plogger/?rand=1624981502359&plid=26184145&idsite=denverpost.com&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&sref=&sts=1624981502357&slts=0&title=Fraudsters+sneaking+into+Colorado+unemployment+accounts+via+a+backdoor&date=Tue+Jun+29+2021+17%3A45%3A02+GMT%2B0200+(Central+European+Summer+Time)&action=pageview&pvid=20348789&u=pid%3D32789ff00343518076f5f234ae623570
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.167.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:02 GMT
Cache-Control
no-cache
Last-Modified
Tuesday, 29-Jun-2021 15:45:02 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
config
c.amazon-adsystem.com/cdn/prod/ 		0
304 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=3391&u=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
via
1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
AMS1-C1
x-cache
Miss from cloudfront
access-control-allow-origin
https://www.denverpost.com
cache-control
max-age=86087, s-maxage=86400
access-control-allow-credentials
true
x-amz-cf-id
vO-vHx2anLDDqOvQTqYMHoji9nJdPU9hObyyHK_5AI0_cRI5NYsrgA==
g.gif
pixel.wp.com/ 		50 B
92 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A9.8.1&blog=111738712&post=4614849&tz=-6&srv=www.denverpost.com&host=www.denverpost.com&ref=&fcp=1462&rand=0.11077897602825826
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
fonts.gstatic.com/s/droidserif/v13/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v13/tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=5.7.2
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9f0624a5f72fa4c0942c21c83960fd1f80b6a49391d27a616a758b098672a00a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.denverpost.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 24 Jun 2021 03:26:10 GMT
x-content-type-options
nosniff
age
476332
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22492
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:03:23 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 24 Jun 2022 03:26:10 GMT
cdddbd3f7ba12d52e8f289352ad95f36
medianewsgroup.blueconic.net/plugin/library/ 		832 KB
245 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/plugin/library/cdddbd3f7ba12d52e8f289352ad95f36
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
340a7ed7157d63efd4118785f6951b83bd1b84fc0c615955fe65c592dc047334
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Jun 2021 15:45:02 GMT
server
-
etag
cdddbd3f7ba12d52e8f289352ad95f36
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
x-permitted-cross-domain-policies
master-only
cache-control
public, no-cache="Set-Cookie", max-age=31536000
content-type
text/javascript; charset=utf-8
content-length
249563
x-xss-protection
1; mode=block
expires
Wed, 29 Jun 2022 15:45:02 GMT
325
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=8b00c746-e983-4052-a01c-366c4ab7697f&bctempid=&overruleReferrer=&time=2021-06-29T17%3A45%3A02%2B02%3A00&ts=1624981502482
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
8a6a6febfbf44efb2f7814a5e1179bc7ec1774cade721250270a2bdc7e8bab93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
1024
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
cs
medianewsgroup.blueconic.net/DG/DEFAULT/ 		66 B
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/cs?bcsessionid=8b00c746-e983-4052-a01c-366c4ab7697f&&callback=bc_json326
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
ff00148160575c60967bc550a95ecb8b90b05a0149d9b05d7614245acf383767
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
content-type
text/javascript; charset=utf-8
content-length
86
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
loader-config.json
loader-cdn.azureedge.net/prod/dfm/ 		1011 B
841 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://loader-cdn.azureedge.net/prod/dfm/loader-config.json?_=1624981501547
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F1B) /
Resource Hash
96b34914f736b96f184920bea4cf3b30a7b76583c51bf1e9caf2add39705bffd

Request headers

Accept
*/*
Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
content-md5
i1fC4Ue5p2n4u48t1IbEIQ==
age
1643
x-cache
HIT
content-length
465
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 10:13:01 GMT
server
ECAcc (frc/8F1B)
etag
0x8D905773626BB80
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
f971fd80-601e-00dc-63f9-6c742c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A27D 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/userSync.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method
GET
:authority
ads.pubmatic.com
:scheme
https
:path
/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=18120
expires
Tue, 29 Jun 2021 20:47:02 GMT
date
Tue, 29 Jun 2021 15:45:02 GMT
vary
Accept-Encoding
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Jun 2021 17:36:57 GMT
server
Golfe2
age
294
date
Tue, 29 Jun 2021 15:40:08 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19661
expires
Tue, 29 Jun 2021 17:40:08 GMT
atrk.js
d31qbv1cthcecs.cloudfront.net/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d31qbv1cthcecs.cloudfront.net/atrk.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 24 May 2021 06:38:31 GMT
Content-Encoding
gzip
Connection
keep-alive
Last-Modified
Tue, 27 Apr 2021 18:03:54 GMT
Server
AmazonS3
Age
3143192
ETag
W/"d89453438fbf10dcf4c13265c40d5160"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 bf5caee39117de5337c47c748b716e80.cloudfront.net (CloudFront)
Cache-Control
max-age=26920000
Transfer-Encoding
chunked
X-Amz-Cf-Pop
AMS1-C1
X-Amz-Cf-Id
Tmcr9OLXv3G3ewCa0avGEreCD24cXc8N_dapoUMkUeyQ4j8s-GoWCw==
quant.js
secure.quantserve.com/ 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
etag
"WhyxmPkT7L77qVDcrjxwGw=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Tue, 06 Jul 2021 15:45:02 GMT
esf.js
d2lv4zbk7v5f93.cloudfront.net/ 		223 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d2lv4zbk7v5f93.cloudfront.net/esf.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.224.194.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-194-75.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
323075a1922843a6c7f5371bc7fa55500b77944f1268d83461964e3906942141

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 28 Jun 2021 19:56:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 06 Feb 2018 14:39:56 GMT
Server
AmazonS3
Age
71313
ETag
"e817b0f323fb2559fcb2e5701865527a"
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront)
Connection
keep-alive
X-Amz-Cf-Pop
FRA2-C1
Accept-Ranges
bytes
Content-Length
42771
X-Amz-Cf-Id
ykbBNSMV3A2oB3ZTFJHYOGaArFUYA6U1vvKSevC8Is3tPywUTfgEfg==
ml.br.js
js.matheranalytics.com/static/ltm/ma23578/wp/14/
Redirect Chain
  • https://js.matheranalytics.com/s/ma23578/239876503/wp/ml.js?cb=1567
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/14/ml.br.js
141 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.matheranalytics.com/static/ltm/ma23578/wp/14/ml.br.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash
79297cf1e36e4e293f4c1d0d7a2761cef47e79c6696c56449ea6e6461f0059ab

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 04:01:24 GMT
content-encoding
br
last-modified
Thu, 27 Aug 2020 21:04:38 GMT
server
nginx
age
42218
etag
"3a6e372f19bd4bc068c12731274dfe48"
vary
Accept-Encoding
x-cache
HIT Thu, 27 Aug 2020 21:19:10 GMT
content-type
application/x-javascript
via
1.1 google
cache-control
public,max-age=3600
alt-svc
clear
content-length
41998

Redirect headers

date
Tue, 29 Jun 2021 15:45:02 GMT
via
1.1 google
server
nginx
vary
Accept-Encoding
location
https://js.matheranalytics.com/static/ltm/ma23578/wp/14/ml.br.js
cache-control
public, max-age=269200
alt-svc
clear
x-served-by
1-gc-euw1-10927
Bootstrap.js
nexus.ensighten.com/choozle/2867/ 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/2867/Bootstrap.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
85eb44416cc1c0c3312fc9bf0e6bb210a105a9dab0534cc376529084bebdafdf

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
last-modified
Sat, 09 Jun 2018 23:37:40 GMT
server
nginx
etag
W/"5b1c64c4-87c6"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
scripts.webcontentassessor.com/scripts/ 		77 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c1282ebb5e04d4df8b4a32d9cdee9f617b59fbabf3f32d2259f2d49a1a4d6a30

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
age
3
x-cache
HIT
content-length
20503
x-amz-id-2
PyInqxYSd+uC09ZbPMv3uOoOO0+PSInTc1CcEGtYj58Jq3w6ofOtvxmXNP5Gf7KcJNbx1TmObPQ=
x-served-by
cache-hhn4030-HHN
last-modified
Tue, 29 Jun 2021 15:34:16 GMT
server
AmazonS3
x-timer
S1624981503.637268,VS0,VE1
etag
"a2a9ac53bbb015d390196433c9035d53"
vary
Accept-Encoding
x-amz-request-id
H0D64E6AQ655T2HN
via
1.1 varnish
cache-control
max-age=3600,stale-if-error=86400,stale-while-revalidate=3600
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1
fbevents.js
connect.facebook.net/en_US/ 		95 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
31a54a93488f9711927aeb875ff1dd63a8c41359847f10f9cea7488dc65179b7
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
24675
x-xss-protection
0
pragma
public
x-fb-debug
reRn528lhkSWn1Sj/FCrmMEJmp2GTh/JBA+WejVWITYKYEsgDtYNQLRGvYRglA8GHMarj6LLYgS2tJBieiYKKA==
x-fb-trip-id
2050670934
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 29 Jun 2021 15:45:02 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
ats.js
ats.rlcdn.com/ 		184 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ats.rlcdn.com/ats.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-38.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
cffabe0948ab31d5e6574c15c4e0d494ecc146d91cd0434d684c9ace31f9c068

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Tue, 29 Jun 2021 08:32:12 GMT
content-encoding
gzip
last-modified
Fri, 11 Jun 2021 10:13:39 GMT
server
AmazonS3
age
25971
etag
W/"535a44cb49d4769cf9ec82fbcba860c8"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
KFvtQEF49ZQSVuqNgx9QL0DaILhmyKFe
via
1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
content-type
application/x-javascript
x-amz-cf-id
jW_gIwui34jnqlkp4NwKbFBc0aHYDTcsptLSfQkmJKYz1qi9mVbtlg==
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1624981502530&ns_c=UTF-8&c8=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&c7=https%3A%2F%2Fwww.denv...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1624981502530&ns_c=UTF-8&c8=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&c7=https%3A%2F%2Fwww.den...
64 B
331 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1624981502530&ns_c=UTF-8&c8=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&c7=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&c9=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
via
1.1 8e4700eb43d0f5579f360cfc02e71fad.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-C1
etag
W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache
Miss from cloudfront
content-type
image/gif; charset=utf-8
content-length
64
x-amz-cf-id
0SLHlqpL-ODPxqyHTMRYHMMIOrv_AIUQE55KjJk6xNS93NGRFsgsAQ==

Redirect headers

date
Tue, 29 Jun 2021 15:45:02 GMT
via
1.1 8e4700eb43d0f5579f360cfc02e71fad.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-C1
vary
Accept
x-cache
Miss from cloudfront
content-type
text/plain; charset=utf-8
location
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1624981502530&ns_c=UTF-8&c8=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&c7=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&c9=
content-length
293
x-amz-cf-id
t2eb0SPOtwvbwKAMluGUACxrLnVkmxW7gBTx3JE-T26oYn2odHhSVg==
/
insight.adsrvr.org/track/evnt/ 		70 B
261 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/track/evnt/?adv=wvvvz6x&ct=0:75j4cjk&fmt=3
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pubads_impl_2021062408.js
securepubads.g.doubleclick.net/gpt/ 		332 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
sffe /
Resource Hash
f852dfebba4af97add777a1d789b4739164d6cc93aa34db2c463141a5c3f4d09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Jun 2021 17:13:33 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
118414
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:02 GMT
getIds
s1.listrakbi.com/tUxHTINGb1zW/session/ 		175 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.listrakbi.com/tUxHTINGb1zW/session/getIds?callback=ltkCallback5315&gsid=&_sid=&_tid=&ps=null&dps=true
Requested by
Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.174.31.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
9513b644b93838ff1052fb79cf519259a12ad5562c91a7e544441a8d356a7c85

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
server
Microsoft-IIS/8.5
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI COM NAV INT DEM CNT PRE LOC"
cache-control
no-cache
content-type
application/x-javascript; charset=utf-8
content-length
175
expires
-1
tUxHTINGb1zW.js
onescript-recscont.listrakbi.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onescript-recscont.listrakbi.com/tUxHTINGb1zW.js
Requested by
Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.101.131.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.19.10 / ASP.NET
Resource Hash
6a52dd58d7afae1b6bb657cbe920e39e8bad4b789b9f7a726bb499ffa34c966b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
cache-control
max-age=300
server
nginx/1.19.10
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
2040
content-type
text/javascript; charset=utf-8
PugMaster
image6.pubmatic.com/AdServer/ Frame A27D 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=97657638&p=160200&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e5cca754d6c8f3de3634cf3458ecf82acd9e8c4ebe7671b017ed7446a9850f8e

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
content-type
text/html; charset=UTF-8
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
fp.min.js
fp-cdn.azureedge.net/prod/dfm/ 		59 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F4C) /
Resource Hash
9d7ae5b7196c72a8c09f3a766e06e61b2ef1d6192076016838b479136435b678

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
content-md5
I+TRQO5bVyRNfhz04pv14Q==
age
22536
x-cache
HIT
content-length
19745
x-ms-lease-status
unlocked
last-modified
Thu, 24 Dec 2020 08:54:59 GMT
server
ECAcc (frc/8F4C)
etag
0x8D8A7E997F32F60
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
6adb9c76-b01e-0056-0bc9-6cce0f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
g2i.min.js
g2insights-cdn.azureedge.net/prod/dfm/ 		1 MB
217 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g2insights-cdn.azureedge.net/prod/dfm/g2i.min.js?
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F49) /
Resource Hash
a7193b4a580e14658a91dd634cc0ef32ebccae115e311886a993b5e07ca5102d

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
content-md5
MEV0XK+iSrlNTVyliS0EpQ==
age
7977
x-cache
HIT
content-length
221901
x-ms-lease-status
unlocked
last-modified
Tue, 29 Dec 2020 13:55:30 GMT
server
ECAcc (frc/8F49)
etag
0x8D8AC0167971F78
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
b0cecac4-d01e-0009-25eb-6c3cf1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
t8y9347t.min.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		559 KB
118 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FC9) /
Resource Hash
e4cb92545debc096ddbad5c1b5aabc2d81619b50a13ae3e4553c7856bf48533b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
content-md5
YCP0LFp1TeQG+VR1A6wQBQ==
age
11330
x-cache
HIT
content-length
119954
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:48 GMT
server
ECAcc (frc/8FC9)
etag
0x8D9056E3D3EEAAD
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
0c987640-b01e-0116-32e3-6ca1b4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
rules-p-4ctCQwtnNBNs2.js
rules.quantcount.com/ 		3 B
427 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-4ctCQwtnNBNs2.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:7000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 14:57:46 GMT
via
1.1 b9394c80294503e08bddf2381e55e810.cloudfront.net (CloudFront)
age
2845
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
3
last-modified
Sat, 04 Mar 2017 19:57:14 GMT
server
AmazonS3
etag
"8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
x-amz-cf-id
EkC7GnpQRJJDbAkI_Jt000peVJ7XZl3OA38Uddn0sZmQ8GRFEga4Lw==
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
882 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 14:51:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
3219
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:51:23 GMT
331892897543876
connect.facebook.net/signals/config/ 		252 KB
72 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/331892897543876?v=2.9.42&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
03b8ba92e44af300657ebe52034fba14fd6f1398df9f1f4b9f9e47bad7e85109
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
pTGMfc6NW6zq5hnyYTvgrUPYB88NHAdIM9EQYvGe3WGKan6ViHZEMjpvw+oOiK7v0GOrv3QpFFozYWTZfa0W9A==
cross-origin-embedder-policy-report-only
require-corp;report-to="coop_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 29 Jun 2021 15:45:02 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
config.json
c.go-mpulse.net/api/ 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/config.json?key=TWTC4-NWJAU-FVVAU-VQNPU-LATGK&d=www.denverpost.com&t=5416605&v=1.720.0&sl=0&si=123ab32b-9bd8-412f-868c-7e0ff0e93176-qvgzr1&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/TWTC4-NWJAU-FVVAU-VQNPU-LATGK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:1b8::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6991413d71917c9f3f4d1fb2537c011236bdd7f73049a13bcf264524e2066f01

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:02 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
1048
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j91&a=450566955&t=pageview&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&dr=&dp=%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ul=en-us&de=UTF-8&dt=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAAEAjAAAAAC~&jid=528853037&gjid=1619554265&cid=1143692882.1624981503&tid=UA-61435456-7&_gid=1205821580.1624981503&_r=1&gtm=2wg6n0TLFP4R&cd2=denverpost.com&cd3=denverpost.com&cd4=&cd5=2021-06-22T06%3A00%3A24-06%3A00&cd6=2021-06-22T06%3A00%3A24-06%3A00&cd7=2021-06-21T18%3A25%3A28-06%3A00&cd9=no&cd10=Business&cd11=5.7.2&cd12=&cd13=WP&cd14=Business&cd15=Business&cd16=&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd22=colorado-unemployment-fraud-phishing&cd23=4614849&cd24=article&cd25=DENVER&cd26=Aldo%20Svaldi&cd27=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&cd28=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd29=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=Denver&cd34=true&cd35=&cd36=2542&cd37=420&cd38=Aldo%20Svaldi&cd49=true&cd50=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&cd51=&cd54=asvaldi%40denverpost.com&cd55=The%20Denver%20Post&cd53=1143692882.1624981503&z=1854534534
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j91&a=450566955&t=pageview&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ul=en-us&de=UTF-8&dt=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDACEAjBAAAAC~&jid=1416320280&gjid=405481095&cid=1143692882.1624981503&tid=UA-111452396-3&_gid=1205821580.1624981503&_r=1&gtm=2wg6n0KM8CCP2&z=1910704127
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j91&a=450566955&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ul=en-us&de=UTF-8&dt=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=DML&ea=Version&el=20210623-header-height-fix-1-gd06ef36_prod_master&_u=aGDACEAjBAAAAC~&jid=573454613&gjid=1856460368&cid=1143692882.1624981503&tid=UA-111452396-5&_gid=1205821580.1624981503&_r=1&gtm=2wg6n0KM8CCP2&z=203926048
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
465 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=528853037&gjid=1619554265&_gid=1205821580.1624981503&_u=aGBAAEAiAAAAAC~&z=1474025809
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 29 Jun 2021 15:45:02 GMT
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
atrk.gif
certify.alexametrics.com/ 		43 B
551 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&time=1624981502624&time_zone_offset=-120&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=&host_url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&random_number=11910399719&sess_cookie=766ba42117a5871faa066f93e1a&sess_cookie_flag=1&user_cookie=766ba42117a5871faa066f93e1a&user_cookie_flag=1&dynamic=true&domain=denverpost.com&account=NJsqn1QolK10uW&jsv=20130128&user_lang=en-US
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 28 Jun 2021 20:41:09 GMT
Via
1.1 a06d82f018833bef3e7f2e9fd230e5ee.cloudfront.net (CloudFront)
Last-Modified
Mon, 17 Jan 2011 20:41:40 GMT
Server
AmazonS3
Age
68634
ETag
"221d8352905f2c38b3cb2bd191d630b0"
X-Cache
Hit from cloudfront
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
X-Amz-Cf-Pop
AMS1-C1
x-amz-meta-alexa-last-modified
20110117123941
Content-Length
43
X-Amz-Cf-Id
L0pvPLc5gMv7XRI_OPzqF1JIPabrpOqg7tdoqLHNYEKKhWzmIVjTng==
x.png
redirect.prod.experiment.routing.cloudfront.aws.a2z.com/ 		0
48 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redirect.prod.experiment.routing.cloudfront.aws.a2z.com/x.png
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.15.171.234 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
server
Server
match
c1.adform.net/serving/cookie/ Frame 6495
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
35 B
467 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.253 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
c1.adform.net
:scheme
https
:path
/serving/cookie/match?CC=1&party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
C=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:02 GMT
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
set-cookie
uid=2222419212698096373; expires=Sat, 28 Aug 2021 15:45:02 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains

Redirect headers

server
nginx
date
Tue, 29 Jun 2021 15:45:02 GMT
content-length
0
location
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
set-cookie
C=1; expires=Thu, 29 Jul 2021 15:45:02 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains
Pug
image2.pubmatic.com/AdServer/ Frame 051D
Redirect Chain
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3292070678450782984
42 B
210 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3292070678450782984
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method
GET
:authority
image2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3292070678450782984
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KADUSERCOOKIE=5A172B0A-45DD-4D11-A86B-F32F8222D5B2; chkChromeAb67Sec=1; DPSync3=1626134400%3A219_201_197%7C1625011200%3A174; SyncRTB3=1626220800%3A35%7C1626134400%3A71_220_21_13_161_56_7_54_3
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:03 GMT
content-type
image/gif; charset=utf-8
content-length
42
set-cookie
KRTBCOOKIE_336=5844-3292070678450782984; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:03 GMT; path=/ PugT=1624981503; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:03 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:03 GMT; path=/
x-lat
lhrpug005:0:482
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3292070678450782984
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
usersync.aspx
dis.criteo.com/dis/ Frame 5001 		43 B
360 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:method
GET
:authority
dis.criteo.com
:scheme
https
:path
/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

cache-control
no-cache
pragma
no-cache
content-type
image/gif
expires
Tue, 29 Jun 2021 00:00:00 GMT
server
Microsoft-IIS/10.0
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1209
x-powered-by
ASP.NET
date
Tue, 29 Jun 2021 15:45:02 GMT
content-length
43
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A27D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WhcrCkXdTRGoa_MvgiLVsg%3D%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WhcrCkXdTRGoa_MvgiLVsg%3D%3D&google_tc=
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:03 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3945-5c4c7cc02bd56"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=18120
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5054
expires
Tue, 29 Jun 2021 20:47:02 GMT

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame A27D
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=228860db-3ffe-4900-a0ba-d45a0dff6643
0
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=228860db-3ffe-4900-a0ba-d45a0dff6643
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 29 Jun 2021 15:47:34 GMT
Server
MT3 3799 851f7e8 master cdg-pixel-x5
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=228860db-3ffe-4900-a0ba-d45a0dff6643
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 29 Jun 2021 15:47:33 GMT
/
pixel.onaudience.com/ Frame A27D 		0
0
Pug
image2.pubmatic.com/AdServer/ Frame A27D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NUExNzJCMEEtNDVERC00RDExLUE4NkItRjMyRjgyMjJENUIy&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NUExNzJCMEEtNDVERC00RDExLUE4NkItRjMyRjgyMjJENUIy&gdpr=0&gdpr_consent=&google_tc=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug004:0:397
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame A27D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESENhx_sKBpcJ6EwJPAIgJWtQ&google_cver=1
42 B
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESENhx_sKBpcJ6EwJPAIgJWtQ&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug011:0:409
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESENhx_sKBpcJ6EwJPAIgJWtQ&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame A27D 		43 B
611 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.253.128.183 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),
Reverse DNS
b7.80.fd9f.ip4.static.sl-reverse.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Mon, 28 Jun 2021 15:45:02 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame A27D
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2222419212698096373
42 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2222419212698096373
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
cache-control
no-store, no-cache, private
x-lat
amspug020:0:1148
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2222419212698096373
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame A27D
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&gdpr=0&gdpr_consent=
42 B
650 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:01 GMT
cache-control
no-store, no-cache, private
x-lat
amspug012:0:357
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 29 Jun 2021 15:47:34 GMT
Server
MT3 3799 851f7e8 master cdg-pixel-x11
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 29 Jun 2021 15:47:33 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame A27D
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2
42 B
447 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
cache-control
no-store, no-cache, private
x-lat
amspug015:0:414
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
Pug
image2.pubmatic.com/AdServer/ Frame A27D
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3021078908452899730&gdpr=0&gdpr_consent=
42 B
520 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3021078908452899730&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug012:0:348
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:02 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
67cfd6a8-648d-4284-b98a-ea57443ab2a6
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3021078908452899730&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
5A172B0A-45DD-4D11-A86B-F32F8222D5B2
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame A27D 		43 B
839 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/5A172B0A-45DD-4D11-A86B-F32F8222D5B2?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
serverComponent.php
nexus.ensighten.com/choozle/2867/ 		500 B
642 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/2867/serverComponent.php?r=735.4028578716587&ClientID=923&PageID=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/2867/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b77291dddf887f1184f2cc2e7364b71d4f72d364f2374fb4c707757988b3688d

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
cache-control
no-cache, no-store
server
nginx
content-type
text/javascript
content-length
500
expires
Tue, 29 Jun 2021 15:45:01 GMT
/
www.facebook.com/tr/ 		44 B
297 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=331892897543876&ev=PageView&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&rl=&if=false&ts=1624981502681&sw=1600&sh=1200&v=2.9.42&r=stable&ec=0&o=30&it=1624981502602&coo=false&rqm=GET
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Tue, 29 Jun 2021 15:45:02 GMT
ga-audiences
www.google.com/ads/ 		42 B
254 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=528853037&_u=aGBAAEAiAAAAAC~&z=265106033
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=528853037&_u=aGBAAEAiAAAAAC~&z=265106033
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
geo2.js
cdn3.optimizely.com/js/ Frame 0B85 		289 B
696 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn3.optimizely.com/js/geo2.js?cb=1624981502735
Requested by
Host: d2lv4zbk7v5f93.cloudfront.net
URL: https://d2lv4zbk7v5f93.cloudfront.net/esf.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.37.32.235 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
788823f9d4b7e823e4c22dbd1e55634f4748204804893fdcd27a9d4953c0b642

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
Y1BKPK.c9lIaZx2uYj8JMWZye_vJfrh9
Server
AmazonS3
x-amz-request-id
6A1AA1F810754193
ETag
"adadfc5d7afd13e353d9d52cec1c7827"
Content-Type
application/javascript
Cache-Control
max-age=52865
Date
Tue, 29 Jun 2021 15:45:05 GMT
Connection
keep-alive
Content-Length
289
x-amz-id-2
ZXi0usPohSuAesZIiMOoUe7rm5pVbZJKk5/swzraA3dBkb05ZJ80j/UhN0E+j1RwRsydsZwrM/Y=
;ord=1624981502736
ad.doubleclick.net/ddm/ad/gbwkknn/ 		43 B
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/ddm/ad/gbwkknn/;ord=1624981502736?
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ 		688 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
dd18ab6d18362066cbd1783ac281accdd1e301360335466e27de80bdc0816de0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type
text/plain;charset=UTF-8

Response headers

Date
Tue, 29 Jun 2021 15:45:02 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
ad056180-8e02-45b6-92c8-034c349cc32b
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.denverpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ 		0
191 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?ptv=109&profileId=184&cb=75329944707
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
bidder.par.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:02 GMT
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Finatra
timing-allow-origin
*
vary
Origin
cygnus
htlb.casalemedia.com/ 		46 B
391 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?ac=j&s=212590&v=7.2&sd=1&r=%7B%22id%22%3A%221e0039ef-b4cd-4b64-9efd-f23a12123d68%22%2C%22imp%22%3A%5B%7B%22id%22%3A%220ae11d83-a868-423a-b685-519ecf81c098%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652874%22%7D%7D%2C%7B%22id%22%3A%22688ac09b-0e54-42d1-81c2-395e0221aa1d%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652876%22%7D%7D%2C%7B%22id%22%3A%2210b0d9d5-070a-45d9-b2dd-ff77fc5941e2%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652876%22%7D%7D%2C%7B%22id%22%3A%22c0aba795-a204-4d77-a8ee-2bc5f62022b7%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652876%22%7D%7D%2C%7B%22id%22%3A%220c6334ea-c5d9-4728-8266-b26d870e46fd%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652877%22%7D%7D%2C%7B%22id%22%3A%2268b5362f-8cf2-48ff-940c-fbc06ffbb7f5%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652877%22%7D%7D%2C%7B%22id%22%3A%2203ceed8b-34f9-4ae0-a9d3-7b1f221c3952%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652877%22%7D%7D%2C%7B%22id%22%3A%22647b671d-2fc0-40f0-9b93-188b88ad677a%22%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652877%22%7D%7D%2C%7B%22id%22%3A%2228bb82a1-51c4-4b30-b3f4-00db8d4b06a1%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652879%22%7D%7D%2C%7B%22id%22%3A%2290d46e3c-1338-4a9e-af46-48f63aee1b15%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652879%22%7D%7D%2C%7B%22id%22%3A%2207a5aba0-c680-4b2f-a022-af2c6ba88f7c%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652883%22%7D%7D%2C%7B%22id%22%3A%22a23bcded-1db0-4a82-949b-35727d209fe8%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22652883%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F%22%2C%22ref%22%3A%22%22%7D%7D
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-181.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ded1eaea7a81c448692b51438a3d7eb0753ce304aba0e4a8d73fb8ca439ccfb6

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:05 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[NL], RC:[], CN:[EU], CIP:[159.48.55.7], XFF:[]
server
Apache
vary
Is-Traffic-Invalid,Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.denverpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
64
x-ak-client-geo
12
expires
Tue, 29 Jun 2021 15:45:05 GMT
translator
hbopenbid.pubmatic.com/ 		0
118 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=zeus_client
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:05 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ 		716 B
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=368294&tk_flint=custom&slots=5&size_id=44%3B2%3B15%3B15%3B15&alt_size_ids=%3B55%2C57%3B9%2C10%2C54%3B10%3B10&zone_id=2004928%3B2004936%3B2004912%3B2004914%3B2004916&rp_floor=0.01
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
2dddf985c75bb11fff47619a780ef9528f01961ec11d6c7d0acc38349fdb9e93

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:03 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.denverpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
716
Expires
Wed, 17 Sep 1975 21:32:10 GMT
auction
tlx.3lift.com/header/ 		19 B
559 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=zeus&v=1&referrer=www.denverpost.com&debug=false
Requested by
Host: mng-denverpost.zeustechnology.com
URL: https://mng-denverpost.zeustechnology.com/main.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.90.149 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-auction-status
12, 12, 12, 12, 12
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
372 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&pid=UurVM2mQJAffl&cb=0&ws=1600x1200&v=7.66.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fdenverpost.com%2Fbusiness%2FSponsorship_1%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%221x1%22%5D%2C%22sn%22%3A%22%2F8013%2Fdenverpost.com%2Fbusiness%2Finterstitial%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fdenverpost.com%2Fbusiness%2Ftop_leaderboard%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22300x1050%22%2C%22160x600%22%5D%2C%22sn%22%3A%22%2F8013%2Fdenverpost.com%2Fbusiness%2FCube1_RRail_ATF%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fdenverpost.com%2Fbusiness%2FCube2_RRail_mid%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fdenverpost.com%2Fbusiness%2FCube3_RRail_lower%22%7D%5D&cfgv=0&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
via
1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
AMS1-C1
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
lWlYhFSpPXAHqPcUnam5LZlNQ1d2tqP_Ska20t9xInYD50OqAaGDiw==
592d223f3627bd6dcf4303ad950ef4a7
medianewsgroup.blueconic.net/templates/ 		383 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/templates/592d223f3627bd6dcf4303ad950ef4a7
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
60d6fc1981f48c234863305f39049a93b9014860159d63dcd97e7e2072041554
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Jun 2021 15:45:02 GMT
server
-
etag
592d223f3627bd6dcf4303ad950ef4a7
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
x-permitted-cross-domain-policies
master-only
cache-control
public, no-cache="Set-Cookie", max-age=31536000
content-type
text/javascript; charset=utf-8
content-length
54163
x-xss-protection
1; mode=block
expires
Wed, 29 Jun 2022 15:45:02 GMT
325
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/ 		381 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=8b00c746-e983-4052-a01c-366c4ab7697f&bctempid=&overruleReferrer=&time=2021-06-29T17%3A45%3A02%2B02%3A00&ts=1624981502853
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
7458fe0eaee3baef97e59b37758968138b1c6b54e7afec32ea300800e2e6d59b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
161
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
stats
medianewsgroup.blueconic.net/rest/recommendations/ 		14 B
698 B 		Script
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/rest/recommendations/stats?storeId=eb3cd944-53e0-47a9-a944-d4cdf9677a5e&action=view&itemId=4614849&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&profileId=8b00c746-e983-4052-a01c-366c4ab7697f&isEntrypage=true&hash=d7368edb9195f6e72a64dee183a4fbde&lastmodified=1624321528000&&callback=bc_json327
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
45cf251fc08e9fc86ab96c7a43b0d90040f353ca4942ead5e3cdfdd6876a1108
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
content-type
text/javascript;charset=utf-8
content-length
34
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
325
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/ 		281 B
888 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=8b00c746-e983-4052-a01c-366c4ab7697f&bctempid=&overruleReferrer=&time=2021-06-29T17%3A45%3A02%2B02%3A00&ts=1624981502887
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
9fc85bf1a68db7ec6b485d5eb16da8931df59308f4abce149bdc4b45fd774e49
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
155
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
325
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/ 		141 B
877 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=8b00c746-e983-4052-a01c-366c4ab7697f&bctempid=&overruleReferrer=&time=2021-06-29T17%3A45%3A02%2B02%3A00&ts=1624981502888
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
5babb783c5a65a749bdd1e4beb448b779bfe845b05fe6be6d341eba3ef8d7860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
146
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
22ffdee66bcd4231ec3f4f8f22b7647a.js
nexus.ensighten.com/choozle/2867/code/ 		1 KB
866 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/2867/code/22ffdee66bcd4231ec3f4f8f22b7647a.js?conditionId0=2887325&conditionId1=469797
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/2867/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5c764ba1ccecd6b069fa3af48c26616aa22fd6076413d7d3585172ca50df6af4

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:02 GMT
content-encoding
gzip
last-modified
Sat, 09 Jun 2018 23:37:40 GMT
server
nginx
etag
W/"5b1c64c4-5c4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
v2
api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_sXPv48AD/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_sXPv48AD/v2?platform=Desktop
Protocol
H2
Server
23.55.161.167 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
fasthttp /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
x-access-token,x-guid,x-post-id,x-spot-id,x-spotim-page-view-id
Origin
https://www.denverpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-length
0
server
fasthttp
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers
x-spot-id,x-post-id,x-guid,x-spotim-page-view-id,x-access-token
access-control-expose-headers
access-control-max-age
86400
date
Tue, 29 Jun 2021 15:45:04 GMT
events
direct-events-collector.spot.im/api/v2/ 		0
265 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://direct-events-collector.spot.im/api/v2/events?stream_name=init
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.215.138.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
fasthttp /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:03 GMT
access-control-allow-credentials
true
server
fasthttp
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
pixel-ads-google-adsense.html
publisher-assets.spot.im/ad/event-tracking/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://publisher-assets.spot.im/ad/event-tracking/pixel-ads-google-adsense.html
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.133 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-cf-pop
FRA2-C1
content-length
20
last-modified
Wed, 12 Aug 2020 13:25:53 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/html
access-control-allow-origin
*
cache-control
max-age=31622400
accept-ranges
bytes
x-amz-cf-id
HBfW3ZIL0B-vg-CcjBItftk4ISvudvIX_5NCtq5VTSoiuVj3Guoqnw==
expires
Thu, 30 Jun 2022 15:45:06 GMT
v2
api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_sXPv48AD/ 		36 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_sXPv48AD/v2?platform=Desktop
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.167 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
fasthttp /
Resource Hash
66d17cbd715a1c9ccc09e9eb0c81a322469362e0f2279fa13f2d2a8495c42946

Request headers

x-guid
null
x-post-id
4614849
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8
x-spot-id
sp_sXPv48AD
x-spotim-page-view-id
5ca5cd9a-2978-4df7-9f9c-9477f64943bf
Referer
https://www.denverpost.com/
x-access-token
undefined

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
content-encoding
gzip
server
fasthttp
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.denverpost.com
access-control-max-age
86400
access-control-allow-credentials
true
access-control-allow-headers
x-spot-id,x-post-id,x-guid,x-spotim-page-view-id,x-access-token
content-length
3083
x-request-id
f8f1e705-d8f0-11eb-b070-2a18b842f708
access-control-expose-headers
pixel-ads-google-adsense.html
publisher-assets.spot.im/ad/event-tracking/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://publisher-assets.spot.im/ad/event-tracking/pixel-ads-google-adsense.html
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.133 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-cf-pop
FRA2-C1
content-length
20
last-modified
Wed, 12 Aug 2020 13:25:53 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/html
access-control-allow-origin
*
cache-control
max-age=31622400
accept-ranges
bytes
x-amz-cf-id
HBfW3ZIL0B-vg-CcjBItftk4ISvudvIX_5NCtq5VTSoiuVj3Guoqnw==
expires
Thu, 30 Jun 2022 15:45:06 GMT
truncated
/ 		44 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/webp
device_load
events-collector.spot.im/api/v1/ 		36 B
478 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://events-collector.spot.im/api/v1/device_load
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.165 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
fasthttp /
Resource Hash
1387a68ba4dfad608ce6fc1a8de4fa1193cda7cf876aa9d6628ed9cd038b2a12

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:03 GMT
server
fasthttp
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.denverpost.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
access-control-allow-headers
content-type, x-spotim-device-uuid, x-spotim-page-view-id, x-spotim-source, x-xsrf-token
content-length
36
expires
Tue, 29 Jun 2021 15:45:03 GMT
pixel;r=238109456;labels=Denver;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F;uh=65ce955d6ae6;uht=2;fpan=1;fpa=P0...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=238109456;labels=Denver;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F;uh=65ce955d6ae6;uht=2;fpan=1;fpa=P0-2122476344-1624981502942;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=denverpost.com;je=0;sr=1600x1200x24;dst=1;et=1624981502942;tzo=-120;ogl=type.article%2Ctitle.Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor%2Curl.https%3A%2F%2Fwww%252Edenverpost%252Ecom%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F%2Cdescription.The%20Colorado%20Department%20of%20Labor%20and%20Employment%20has%20made%20big%20strides%20in%20reducing%2Csite_name.The%20Denver%20Post%2Cimage.https%3A%2F%2Fwww%252Edenverpost%252Ecom%2Fwp-content%2Fuploads%2F2021%2F01%2FScreen-Shot-2021-01-08-at-%2Cimage%3Awidth.1024%2Cimage%3Aheight.640%2Cimage%3Aalt.A%20screen%20grab%20of%20the%20Colorado%20%252E%252E%252E%2Clocale.en_US
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:02 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
/
geo.privacymanager.io/ 		30 B
592 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Requested by
Host: ats.rlcdn.com
URL: https://ats.rlcdn.com/ats.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
3656ad0b9309abc5993e3cd41a5b83b18ae7e261fd007d16cb44d5e102520632

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 03:08:30 GMT
via
1.1 c4084ad1fdf68c421001efad60b9b357.cloudfront.net (CloudFront), 1.1 bdbb0d922c29917c00cfed799f55e7c2.cloudfront.net (CloudFront)
age
45394
x-amzn-requestid
1e065f8f-6a2a-4c1e-8740-9840d2d8d144
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type
application/json
access-control-allow-origin
*
x-amzn-trace-id
Root=1-60da8eae-44391fea327e1606702cf592;Sampled=0
x-cache
Hit from cloudfront
x-amz-cf-pop
DUB2-C1, AMS1-C1
x-amz-apigw-id
Bqs7OGQPDoEFipw=
content-length
30
x-amz-cf-id
jeF5EK2GmstAcfVu0PxyKF9wJ3a1BcdXJEGz8FDQSE_f2QpX4t8FXw==
access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
t8y9347t.min.css
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		295 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.css?
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F69) /
Resource Hash
70c4634f438568a86bb98789e25bd251a5b979f0e1f68c57956f5c038f53a914

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:03 GMT
content-encoding
gzip
content-md5
qePO0yKWifmYWvQdlK/DtQ==
age
21254
x-cache
HIT
content-length
28321
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:48 GMT
server
ECAcc (frc/8F69)
etag
0x8D9056E3D33EB71
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
1a57fb8b-801e-00f4-4acc-6c0393000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
203812f962cdac28cda2020bc8088b55.js
nexus.ensighten.com/choozle/2867/code/ 		261 B
443 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/2867/code/203812f962cdac28cda2020bc8088b55.js?conditionId0=421905
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/2867/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b003b4bb9f910d93e4f42f609cc96dff2fe12888d3caaf9dea8b17c6b0901c9a

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
last-modified
Sat, 09 Jun 2018 23:37:40 GMT
server
nginx
etag
"5b1c64c4-105"
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
accept-ranges
bytes
content-length
261
325
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/ 		4 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=8b00c746-e983-4052-a01c-366c4ab7697f&bctempid=&overruleReferrer=&time=2021-06-29T17%3A45%3A03%2B02%3A00&ts=1624981503040
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
d423dc7be0bfe97679cc9e916cab7c7de756d65055359b560d6a2fc8db6228df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
2020
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
truncated
/ 		82 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/ 		90 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/ 		38 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/webp
325
medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/ 		4 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/DG/DEFAULT/rest/rpc/325?referer=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&bcsessionid=8b00c746-e983-4052-a01c-366c4ab7697f&bctempid=&overruleReferrer=&time=2021-06-29T17%3A45%3A03%2B02%3A00&ts=1624981503049
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
2b143984860cdbf2a0db9f2372ecbb1c9d601f424b4776e12d82d9664cfbade1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
access-control-allow-origin
https://www.denverpost.com
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
2020
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
DENVERPRODWP
prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/DENVERPRODWP
Protocol
HTTP/1.1
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Origin
https://www.denverpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
X-Powered-By
ASP.NET
Date
Tue, 29 Jun 2021 15:45:18 GMT
Content-Length
0
gtm.js
www.googletagmanager.com/ 		174 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL
Requested by
Host: g2insights-cdn.azureedge.net
URL: https://g2insights-cdn.azureedge.net/prod/dfm/g2i.min.js?
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a7a48125b1cb0c7d692ab45894b86aba4d9566ab5d2b380d5630926522c2526d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52345
x-xss-protection
0
last-modified
Tue, 29 Jun 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 29 Jun 2021 15:45:03 GMT
index.js
d1wa9546y9kg0n.cloudfront.net/ 		6 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d1wa9546y9kg0n.cloudfront.net/index.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.84.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8431f4973d02bcceeadba217953b9a058dad0b1d958f9ba25f9fccfe95d7ae42

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 00:55:16 GMT
Via
1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
Last-Modified
Tue, 23 Feb 2016 09:35:10 GMT
Server
AmazonS3
Age
53689
ETag
"cf67eb51479caf3b57c3577a08b6a038"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Connection
keep-alive
X-Amz-Cf-Pop
AMS1-C1
Accept-Ranges
bytes
Content-Length
6494
X-Amz-Cf-Id
Zyo-tL67XubUkFuXu6SVnvWtLSy-FDijx1Jd3yPPPweDx4J8jkRTnA==
DENVERPRODWP
prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/ 		975 KB
249 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/configuration/mapped/siteCode/DFM/configCode/DENVERPRODWP
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
4c6628a9ef3638f4dd7b264171f54937c2c28a00cb4047a09ce88fef14619061

Request headers

authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE2MjQ5OTU5MDN9.g6v_IpSF0RDGh_RThRHFYvyVoi_jKebCwoF0VYQaCxo
source-system
Plugin
site-code
DFM
autoqa
false
access-control-allow-origin
*
settingskey
PMP,DP
ssid
c66d71608de292b7317e7d81ea23d940
environment
prod
attr
DP
config-code
DENVERPRODWP
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type
application/json
location
undefined
accept
application/json
Referer
https://www.denverpost.com/
version
Version: 2.5.4.3_swg

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:18 GMT
Content-Encoding
gzip
Expires
-1
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
254050
X-Server-Time
6/29/2021 3:45:19 PM
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 		631 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.89.156 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:04 GMT
Last-Modified
Tue, 15 Oct 2019 13:44:16 GMT
Server
AmazonS3
x-amz-request-id
S9TZ0MQCWB6CGB6V
ETag
"ef2cc7f55b7ab677b023e36033e26471"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
631
x-amz-id-2
iT23+UpzEc6rEiJ1k3V3VZEXrXhlewIbKSN/YvWyOxLkmc3aKebKvdvCy/hTaPhSoMeZIaJU47c=
x-amz-meta-s3b-last-modified
20191015T134358Z
events
bidder.criteo.com/csm/ 		0
191 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/csm/events
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
bidder.par.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:02 GMT
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Finatra
timing-allow-origin
*
vary
Origin
pixel.gif
static.criteo.net/images/ 		43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/images/pixel.gif?ch=1
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
last-modified
Tue, 09 Dec 2008 16:52:36 GMT
server
nginx
etag
"493ea254-2b"
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
43
expires
Fri, 24 Jun 2022 15:45:03 GMT
pixel.gif
static.criteo.net/images/ 		43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.criteo.net/images/pixel.gif?ch=2
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
last-modified
Tue, 09 Dec 2008 16:52:36 GMT
server
nginx
etag
"493ea254-2b"
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
43
expires
Fri, 24 Jun 2022 15:45:03 GMT
396846.gif
idsync.rlcdn.com/
Redirect Chain
  • https://cs.choozle.com/dp/chz/5450?d=www.denverpost.com&cb=6089030354
  • https://cs.choozle.com/sync
  • https://cs.choozle.com/sync?v=true&cid=92b2f857-55d8-48e1-b031-a98d88a39154
  • https://tags.bluekai.com/site/48443?id=92b2f857-55d8-48e1-b031-a98d88a39154&limit=1&redir=https%3A%2F%2Fcs.choozle.com%2Fsync%3Fpid%3D%24_BK_UUID%26dpsync%3Dbk%26cid%3D92b2f857-55d8-48e1-b031-a98d8...
  • https://cs.choozle.com/sync?pid=TK%2F0my99999bd5%2BQ&dpsync=bk&cid=92b2f857-55d8-48e1-b031-a98d88a39154
  • https://match.adsrvr.org/track/cmf/generic?ttd_puid=92b2f857-55d8-48e1-b031-a98d88a39154&ttd_pid=gdmv7qs&ttd_tpi=1
  • https://cs.choozle.com/sync?pid=e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&dpsync=ttd&cid=92b2f857-55d8-48e1-b031-a98d88a39154
  • https://idsync.rlcdn.com/459489.gif?partner_uid=92b2f857-55d8-48e1-b031-a98d88a39154
  • https://idsync.rlcdn.com/1000.gif?memo=COGFHBIwCiwIARCp7AEaJDkyYjJmODU3LTU1ZDgtNDhlMS1iMDMxLWE5OGQ4OGEzOTE1NBAAGg0IgYDthgYSBQjoBxAAQgBKAA
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=0b3f1485-c2e3-4bf1-977e-97235c2bb5c5
0
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=0b3f1485-c2e3-4bf1-977e-97235c2bb5c5
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
via
1.1 google
alt-svc
clear
content-length
0

Redirect headers

date
Tue, 29 Jun 2021 15:45:05 GMT
content-encoding
gzip
server
OXGW/16.209.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=0b3f1485-c2e3-4bf1-977e-97235c2bb5c5
content-type
image/gif
alt-svc
clear
content-length
0
via
1.1 google
recommendations
medianewsgroup.blueconic.net/rest/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://medianewsgroup.blueconic.net/rest/recommendations?storeId=eb3cd944-53e0-47a9-a944-d4cdf9677a5e&profileId=8b00c746-e983-4052-a01c-366c4ab7697f&frequencyCap=8&itemId=4614849&request=%5B%7B%22id%22%3A1569367102587%2C%22filters%22%3A%5B%22!section%3A%5C%22Horoscopes%5C%22%22%2C%22!section%3A%5C%22Comics%5C%22%22%2C%22!section%3A%5C%22TV%20Listings%5C%22%22%2C%22!section%3A%5C%22Why%20Subscribe%20to%20The%20Denver%20Post%5C%22%22%2C%22publicationDate%3E%3D2021-06-27T15%3A45%3A03.316Z%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3A10%7D%2C%7B%22id%22%3A%22default%22%2C%22filters%22%3A%5B%22VIEWED%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3Anull%7D%5D&&callback=bc_json328
Requested by
Host: cdn.blueconic.net
URL: https://cdn.blueconic.net/medianewsgroup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.175.85.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
- /
Resource Hash
f4fc1abb3cbd3768658934960ff9fc3cac7a0388ae9dadbf9db21bbe5ce737ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-robots-tag
noindex, nofollow
p3p
policyref="", CP="DSP"
x-permitted-cross-domain-policies
master-only
cache-control
no-cache, no-store, no-transform, must-revalidate, private
content-type
text/javascript;charset=utf-8
content-length
3412
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
identity
api.rlcdn.com/api/ 		44 B
330 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.rlcdn.com/api/identity?pid=2&rt=envelope
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.133.55 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
via
1.1 google
x-content-type-options
nosniff
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods
GET, OPTIONS
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
alt-svc
clear
content-length
44
idsv2
mid.rkdms.com/ 		0
155 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=MEDIANEWSGROUP
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.165.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:03 GMT
access-control-allow-credentials
true
server
nginx
access-control-allow-methods
GET, HEAD, OPTIONS
any
idx.liadm.com/idex/ie/ 		206 B
690 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://idx.liadm.com/idex/ie/any
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.234.106.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
34c0228d1b17ca63361b7a098fe7060c38349770cadd4011178fce664a34e8bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Tue, 29 Jun 2021 15:45:03 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/json
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
trace-id
0ccdd8968b1676ae
Content-Length
206
rid
match.adsrvr.org/track/ 		108 B
677 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=185707
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.242.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
52aa0ad5355a91a61bec3dd4e95e468162168a19d35644fa0937554b97244fa4

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.denverpost.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
108
expires
Thu, 29 Jul 2021 15:45:03 GMT
/
www.facebook.com/tr/ 		0
15 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryqSsSPsuG96ix8yNU

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Tue, 29 Jun 2021 15:45:03 GMT
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
content-length
0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
tUxHTINGb1zW
at1.listrakbi.com/activity/ 		111 B
708 B 		Script
General
Check archive.org
Download Go to
Full URL
https://at1.listrakbi.com/activity/tUxHTINGb1zW
Requested by
Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.88.253.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
2075a71af3c720d0e39567930c41634a5d4d1ef7f26e2f01bd1bfa9b0fcee3b6

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
private
server
Microsoft-IIS/8.5
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
111
content-type
text/javascript; charset=utf-8
conversation.svg
static-cdn.spot.im/production/launcher/tags/v2.56.3/launcher/ 		3 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://static-cdn.spot.im/production/launcher/tags/v2.56.3/launcher/conversation.svg
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00::210:ba20 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
da47d25bde260aaac30fba5ce9ff1ccd5b62b15e3884f1fc40d4d5c5222b8740

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
JqiCpxHbZ.6eQ5BU8NvPezQs57FjRD_9
content-encoding
gzip
last-modified
Sun, 27 Jun 2021 12:14:23 GMT
server
AmazonS3
x-amz-cf-pop
JFK51-C1
etag
W/"6426c2417d4edd062cad1e3e46e94b29"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31622400
date
Tue, 29 Jun 2021 15:45:03 GMT
content-length
704
x-amz-cf-id
yu93xrOD10K9-JGQAAgJWp56IN3VmHi5cgP-tNOWLhirxy-t7Ws1CA==
expires
Thu, 30 Jun 2022 15:45:03 GMT
4614849
api-2-0.spot.im/v1.0.0/config/ab_test/sp_sXPv48AD/ 		99 B
818 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api-2-0.spot.im/v1.0.0/config/ab_test/sp_sXPv48AD/4614849
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.167 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
fasthttp /
Resource Hash
ebb5eadcd1f3fe9b71b13e5175e5f1ddaf9eca9583c055b4c276e02abcf16471

Request headers

Accept
application/json
Referer
https://www.denverpost.com/
x-spotim-page-view-id
5ca5cd9a-2978-4df7-9f9c-9477f64943bf
Content-Type
application/json
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
x-spotim-device-uuid
de7b660e-dcf1-409e-99ee-89fc25d12d67

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
server
fasthttp
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.denverpost.com
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-allow-credentials
true
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
content-length
99
x-request-id
f8f0edb4-d8f0-11eb-84bf-fa65c5de0753
4614849
api-2-0.spot.im/v1.0.0/config/ab_test/sp_sXPv48AD/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api-2-0.spot.im/v1.0.0/config/ab_test/sp_sXPv48AD/4614849
Protocol
H2
Server
23.55.161.167 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
fasthttp /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type,x-spotim-device-uuid,x-spotim-page-view-id
Origin
https://www.denverpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-length
0
server
fasthttp
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers
content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-expose-headers
x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age
86400
date
Tue, 29 Jun 2021 15:45:04 GMT
i.js
tag.wknd.ai/3994/ 		63 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.wknd.ai/3994/i.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.253.250 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fasthttp /
Resource Hash
85088ebb23822ac7b631bad39b8e0f46a86659afb0df488846e4c9b3769f61fe

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:43:07 GMT
content-encoding
gzip
server
fasthttp
age
116
etag
ed53f6471252d9
content-type
text/plain; charset=utf-8
via
1.1 google
cache-control
public,max-age=60
x-region
us-central1
timing-allow-origin
*
alt-svc
clear
content-length
27798
iframe
d1eoo1tco6rr5e.cloudfront.net/ighse75/rz1s9i5/ Frame 4A7B
Redirect Chain
  • https://insight.adsrvr.org/tags/ighse75/rz1s9i5/iframe
  • https://d1eoo1tco6rr5e.cloudfront.net/ighse75/rz1s9i5/iframe
133 B
623 B 		Document
General
Check archive.org
Download Go to
Full URL
https://d1eoo1tco6rr5e.cloudfront.net/ighse75/rz1s9i5/iframe
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/2867/code/22ffdee66bcd4231ec3f4f8f22b7647a.js?conditionId0=2887325&conditionId1=469797
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.86.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
af7208e97c75d11c6cf82e711567ecd8bd26fb08d71fe878dea38a1ce5bbd738

Request headers

Host
d1eoo1tco6rr5e.cloudfront.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.denverpost.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

Content-Type
text/html
Content-Length
133
Connection
keep-alive
Last-Modified
Thu, 27 Oct 2016 21:55:01 GMT
Accept-Ranges
bytes
Server
AmazonS3
Date
Tue, 29 Jun 2021 15:01:21 GMT
Cache-Control
max-age=86400
ETag
"d51601446745c7954e13cffdaadeac4d"
X-Cache
Hit from cloudfront
Via
1.1 043fc2faaa02eeb59193e3fa300adb6b.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
AMS1-C1
X-Amz-Cf-Id
IU5WVm6y1HuUDj-scNOu_E_bemC5gQ4QGOoQeOciHEZG-Oc160wrsQ==
Age
2952

Redirect headers

date
Tue, 29 Jun 2021 15:45:03 GMT
content-type
text/html; charset=UTF-8
content-length
183
location
https://d1eoo1tco6rr5e.cloudfront.net/ighse75/rz1s9i5/iframe
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
/
insight.adsrvr.org/track/evnt/ Frame 4A7B 		70 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/track/evnt/?adv=ighse75&ct=0:rz1s9i5&fmt=3
Requested by
Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/ighse75/rz1s9i5/iframe
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://d1eoo1tco6rr5e.cloudfront.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
tUxHTINGb1zW
at1.listrakbi.com/activity/ 		111 B
706 B 		Script
General
Check archive.org
Download Go to
Full URL
https://at1.listrakbi.com/activity/tUxHTINGb1zW?vuid=c4f2b5d7-9fb7-4512-a4fd-d78797aa7df6&uid=7A74C45D-1365-4F85-A009-FFEC66FAFF2D&gsid=272e18d0-db39-48e7-8cc8-c08cbbc04a7e&_t_0=at&t_0=PageBrowse&k_0=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F
Requested by
Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.88.253.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
2075a71af3c720d0e39567930c41634a5d4d1ef7f26e2f01bd1bfa9b0fcee3b6

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
private
server
Microsoft-IIS/8.5
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
111
content-type
text/javascript; charset=utf-8
tUxHTINGb1zW
at1.listrakbi.com/activity/ 		111 B
705 B 		Script
General
Check archive.org
Download Go to
Full URL
https://at1.listrakbi.com/activity/tUxHTINGb1zW?vuid=c4f2b5d7-9fb7-4512-a4fd-d78797aa7df6&uid=68E24535-D551-46D3-AFEF-B857508089B5&gsid=272e18d0-db39-48e7-8cc8-c08cbbc04a7e&_t_0=at&t_0=ContentBrowse&k_0=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F
Requested by
Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.88.253.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
2075a71af3c720d0e39567930c41634a5d4d1ef7f26e2f01bd1bfa9b0fcee3b6

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
private
server
Microsoft-IIS/8.5
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
111
content-type
text/javascript; charset=utf-8
tUxHTINGb1zW
at1.listrakbi.com/activity/ 		111 B
707 B 		Script
General
Check archive.org
Download Go to
Full URL
https://at1.listrakbi.com/activity/tUxHTINGb1zW?vuid=c4f2b5d7-9fb7-4512-a4fd-d78797aa7df6&uid=50A91FA5-CED9-42E1-BE9B-1D73E78421BB&gsid=272e18d0-db39-48e7-8cc8-c08cbbc04a7e&_t_0=at&t_0=Identification&k_0=3&_t_1=at&t_1=Identification&k_1=4&_t_2=at&t_2=Identification&k_2=5
Requested by
Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.88.253.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
2075a71af3c720d0e39567930c41634a5d4d1ef7f26e2f01bd1bfa9b0fcee3b6

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:03 GMT
cache-control
private
server
Microsoft-IIS/8.5
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
111
content-type
text/javascript; charset=utf-8
ijs_all_modules_cjs_min_36b64f6e4069a3dac8004dac95ac43d4.js
assets.bounceexchange.com/assets/smart-tag/versioned/ 		565 KB
140 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_36b64f6e4069a3dac8004dac95ac43d4.js
Requested by
Host: tag.wknd.ai
URL: https://tag.wknd.ai/3994/i.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
2dbb376f558046efd43a3d612350058d711f34ccd55f9b9fb985851ab0356fba

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 23 Jun 2021 06:51:08 GMT
content-encoding
gzip
age
550435
x-guploader-uploadid
ABg5-UyTEh_cRvXCT56PnbCca5hlsxVC1xrDxS1k3QFKFIXxeOx1AI3W7NhX9Vg3XrILlAKiWRRbXIwOjs7_HTc8Dys
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
143185
last-modified
Mon, 21 Jun 2021 19:40:13 GMT
server
UploadServer
etag
"0fb13d68e9eac356d5476d211c2d441d"
vary
Accept-Encoding
x-goog-hash
crc32c=W7GeQQ==, md5=D7E9aOnqw1bVR20hHC1EHQ==
x-goog-generation
1624304412992529
access-control-allow-origin
*
access-control-expose-headers
etag, Content-Type
cache-control
public,max-age=31536000
x-goog-stored-content-length
143185
accept-ranges
bytes
content-type
text/javascript
expires
Thu, 23 Jun 2022 06:51:08 GMT
integrator.js
adservice.google.nl/adsid/ 		107 B
853 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.nl/adsid/integrator.js?domain=www.denverpost.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
570 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		142 KB
19 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=566418539731751&correlator=2743647028077934&output=ldjh&impl=fifs&eid=31061649%2C31061415%2C21065724&vrg=2021062408&ptt=17&sc=1&sfv=1-0-38&ecs=20210629&iu_parts=8013%2Cdenverpost.com%2Cbusiness%2CSponsorship_1%2Cinterstitial%2Ctop_leaderboard%2COutstream_Video%2CCube1_RRail_ATF%2CCube2_RRail_mid%2CCube3_RRail_lower&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F4%2C%2F0%2F1%2F2%2F5%2C%2F0%2F1%2F2%2F6%2C%2F0%2F1%2F2%2F7%2C%2F0%2F1%2F2%2F8%2C%2F0%2F1%2F2%2F9&prev_iu_szs=300x50%2C1x1%2C728x90%7C970x90%7C970x250%2C480x360%2C300x250%7C300x600%7C300x1050%7C160x600%2C300x600%7C300x250%2C300x600%7C300x250&prev_scp=POS%3DSponsorship_1%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Sponsorship_1.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3Dinterstitial%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_interstitial.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3Dtop_leaderboard%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_top_leaderboard.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3DOutstream_Video%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Outstream_Video.init.dsk%7CPOS%3DCube1_RRail_ATF%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Cube1_RRail_ATF.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3DCube2_RRail_mid%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Cube2_RRail_mid.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3DCube3_RRail_lower%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Cube3_RRail_lower.init.dsk%26amznbid%3D2%26amznp%3D2&eri=1&cust_params=zeus%3Dapplied%26kv%3Dbusiness%252Ccolorado-department-of-labor%252Cfraud%252Cjobs%252Cmore-business-news%252Cunemployment%252Caldo-svaldi%26page%3Darticle%26RPN%3D392372150881%26rurl%3D%26articleid%3D4614849&cookie_enabled=1&bc=31&abxe=1&lmt=1624981503&dt=1624981503801&dlt=1624981501203&idt=1545&frm=20&biw=1600&bih=1200&oid=3&adxs=1439%2C800%2C800%2C637%2C1287%2C1287%2C1287&adys=17%2C177%2C182%2C1019%2C487%2C790%2C1671&adks=422864591%2C883939939%2C536565947%2C2201960385%2C2781879128%2C3203588830%2C4273369955&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1x0%7C1280x0%7C1600x6%7C711x0%7C304x0%7C304x0%7C304x0&msz=1x0%7C1x0%7C1x0%7C1x0%7C1x0%7C1x0%7C1x0&ga_vid=1143692882.1624981503&ga_sid=1624981504&ga_hid=450566955&ga_fc=false&fws=4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1%2C1280%2C1600%2C711%2C304%2C304%2C304&btvi=0%7C0%7C0%7C0%7C0%7C0%7C1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
8c02d2c7bda764aa1e9d14a92c5d096e91114382dccbbb32f7fd080d2e6bb7bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19647
x-xss-protection
0
google-lineitem-id
-2,-2,5727885340,-2,5727885340,5727885340,5577690685
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,-2,138354018764,-2,138354398473,138354018770,138336096163
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7234 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Tue, 29 Jun 2021 15:45:03 GMT
expires
Wed, 29 Jun 2022 15:45:03 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
data.cdnbasket.net/ 		100 B
449 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://data.cdnbasket.net/
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.221.36 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
c95951dc2494343aee7a9757b0c2d5af315b98fca45d5475504d9f7d58e3263c

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:04 GMT
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Headers
Origin, Content-Type, Accept
Expires
0
/
page.cdnbasket.net/ 		57 B
406 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://page.cdnbasket.net/
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.190.24.100 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
33147c2ad24d8acefca49e60ee628fe122273e18546a576b56c4847c889d909b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:04 GMT
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Headers
Origin, Content-Type, Accept
Expires
0
/
view.cdnbasket.net/ 		57 B
406 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://view.cdnbasket.net/
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.227.219.197 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
bc23b2b97a417647628b766fa16c0df3c5bd3ae8ad469a88ffca3dba2dd3751c

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:05 GMT
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Headers
Origin, Content-Type, Accept
Expires
0
local_storage_frame16.min.html
assets.bounceexchange.com/assets/bounce/ Frame 7471 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_36b64f6e4069a3dac8004dac95ac43d4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60

Request headers

:method
GET
:authority
assets.bounceexchange.com
:scheme
https
:path
/assets/bounce/local_storage_frame16.min.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

x-guploader-uploadid
ABg5-UzvVIVlmDL4w8BmfMUT-PEvPuOBADCMF2QBghTsDhizRHbuxptG7nPTx0CBt7CMg48qzzDUqh3mjL5lS4EEtRPVy-V0aQ
date
Thu, 24 Jun 2021 10:36:48 GMT
expires
Fri, 24 Jun 2022 10:36:48 GMT
last-modified
Mon, 21 Jun 2021 19:38:52 GMT
etag
"27a24346ffe21b40795ceba4e522be11"
x-goog-generation
1624304331926273
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
x-goog-stored-content-length
1055
content-type
text/html; charset=UTF-8
content-encoding
gzip
x-goog-hash
crc32c=4lB/cQ== md5=J6JDRv/iG0B5XOuk5SK+EQ==
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
vary
Accept-Encoding
content-length
1055
access-control-allow-origin
*
access-control-expose-headers
etag Content-Type
server
UploadServer
cache-control
public,max-age=31536000
age
450496
alt-svc
clear
headerstats
as-sec.casalemedia.com/ 		0
428 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/headerstats?s=212590&u=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&v=3
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:04 GMT
X-AK-INITIAL-GEO
CC:[NL], RC:[], CN:[EU], CIP:[159.48.55.7], XFF:[]
Server
Apache
Access-Control-Allow-Origin
https://www.denverpost.com
X-CS-CLIENT-GEO
12
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
X-AK-CLIENT-GEO
12
Expires
Tue, 29 Jun 2021 15:45:04 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5EC4 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6ux1TvTLRne9l9Db3AUo7PH9y2SujHUFTY2Ye5qkQcpFzli-M_nFibC_8yLxWI7gUj5iaSx4Czlo17Jl7MaAd68kNGZJSL7xY_SwOnSeOPb_aIUSnkXFXYhKhmKiMXWcGr6qARDZKG2xOXdMJcYSrnJ1dCKltlI-IyCKxWI5ouerXcSLoBhiSxMSLWKdnXOlWJQ37FV4S77fdFA2uU8kUvxNly0_TVndCDjBKPgFktY61Hh6AjfWDH4nGTLKjlUeEaZEkjUcZZP-rRuWX1dpTDoZMngl0s3OzMDCsq0UHqdpXJroLlnBm6anVYBqfV6pr-2956wSfJt94tOsgnqGO&sig=Cg0ArKJSzMk8Cjfx6t2AEAE&adurl=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 5EC4 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
153
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7112
x-xss-protection
0
server
cafe
etag
12276874145846594193
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:42:31 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 5EC4 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:44:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
54
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:44:10 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5EC4 		125 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2f5a99d439c1d7bc8cd4e02f39d77d0dab1eba4e1fae40d3fc5d06ac3aaf1ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1624879993577808"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38803
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:04 GMT
6371707863693764038
tpc.googlesyndication.com/simgad/ Frame 5EC4 		69 KB
70 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/6371707863693764038
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
977b8bc33fee17f46e451517281d28913afbf69a2649432f501f6bbaa6830283
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 26 Jun 2021 14:20:05 GMT
x-content-type-options
nosniff
age
264299
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
70977
x-xss-protection
0
last-modified
Thu, 24 Jun 2021 17:22:08 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 26 Jun 2022 14:20:05 GMT
osd.js
www.googletagservices.com/activeview/js/current/ 		72 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
29d592e34e3d2c8ca0c55ceafd75940de79cdb6381d8ceb372d226e7820e7220
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1624879999447392"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27719
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:04 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2A43 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvUbIU9gebk_pR4LN8eZWRUn97mx3Pu24Ne7swMtqntMlRqSBk0PNu9zJknxrA3bpZw_OnWD_hvDTyyDH9QZQHG_-_Q-cTiz3rPQMKH3D1jJUTQtbBZApuN9vLCNFaB58S1Oy1yiHIVkl-SLxvQf1MF27ZyRn7iDIS93dmle9OWc3-lJJW0-S6-ElloNjz02O3vGaqqLd0IE559ClrI3LFwpSa0UU2Q_fJis8iHnCQuQ8VXDOH6UKnZV8CaHKSaR-3pF8AHdoyaVES8sfjaT7lC2jvUbJlYYWSA1gzc_Qb5DKGYaCWcWfHZzVrC44gJFsfommO6JOXrn9WNyLZMuHhY&sig=Cg0ArKJSzFm5b8vWtlt6EAE&adurl=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 2A43 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
153
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7112
x-xss-protection
0
server
cafe
etag
12276874145846594193
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:42:31 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 2A43 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:44:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
54
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:44:10 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 2A43 		125 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2f5a99d439c1d7bc8cd4e02f39d77d0dab1eba4e1fae40d3fc5d06ac3aaf1ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1624879993577808"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38803
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:04 GMT
l
www.google.com/ads/measurement/ Frame 2A43 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSzZtTz2dwi1Bg2Qg2vJh5lmzmbCBrvmrc8i5fzxpYmsB3ecCzafLdNM5P-ihEWLENfQ2eO
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
18290518680986555580
tpc.googlesyndication.com/simgad/ Frame 2A43 		180 KB
180 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/18290518680986555580
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9bb221af82778c5bc12399ec9f45a6e19b1d3823a273b0ec62c768b9dbdcd78c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 26 Jun 2021 14:20:05 GMT
x-content-type-options
nosniff
age
264299
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
183960
x-xss-protection
0
last-modified
Thu, 24 Jun 2021 17:22:08 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 26 Jun 2022 14:20:05 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 3728 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssuODjt6pSEFktLVi1VIYFexcoXQofEqdT2nVNp-D5GLpe6UmALEq4nlitc-pjKLI68ZPhmyHjmYbsBrCEuZDCGTOCikvdKjyj1IFfN-2xUs3_WbOVuq32zb0wtzz_hCb-Sn_GuOUwTnwuk5GJJc-0ZskM1Id_lL2652yth9js_Pf2UOGYuYIyQZYoSjcfFFqsQlmLv15_vZWz_5-HZfGFyRzqnL-p9AYmdvh-uFGlZ_tJ89ObhmeFUZ_pqUljeL38xOye-i7Lq9n_CVduwVwV2bkrgTCwCzx3ip6GJ25JU1uxp0Z95NBQXIer45VAHotCwhC7arbC0fz0LRUwDHAQo&sig=Cg0ArKJSzEXAIwl4o8WpEAE&adurl=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 3728 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
153
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7112
x-xss-protection
0
server
cafe
etag
12276874145846594193
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:42:31 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 3728 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:44:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
54
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:44:10 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 3728 		125 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2f5a99d439c1d7bc8cd4e02f39d77d0dab1eba4e1fae40d3fc5d06ac3aaf1ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1624879993577808"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38803
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:04 GMT
l
www.google.com/ads/measurement/ Frame 3728 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQKQr0j0rLS4fDFesGQxHFHH0gSlJHangPO7-hbS_hR0lr61zUY61IqTFF161vG3UE-hqmm
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
4082799040930164681
tpc.googlesyndication.com/simgad/ Frame 3728 		115 KB
116 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/4082799040930164681
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
149fe70de1af5a4c75fa8ffbad0f3680225ab4d0d431cd51f27f01bfcc75546e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 26 Jun 2021 14:20:28 GMT
x-content-type-options
nosniff
age
264276
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
118258
x-xss-protection
0
last-modified
Thu, 24 Jun 2021 17:22:08 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 26 Jun 2022 14:20:28 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 8A5B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuz6GFeP_LTspD_JYBEG_DKC13JxWw4W_s_d0fo-YEgG5lkjD0TOo4zSYuNdHYg0rqyLsU-5Zi6Sq-MVRLwnpDXMzmzraktKFqf91U_mIRZL9GjWqWud_dITaFhLIYL_OrLp5bLVfRYQwB5GZSVTcBZ8zg20XFtVpGMpq2CFTFKn-1voXCIkwNnBqa0Na1YeBHcDHw1R4MMBm7rD3Z9eeWtB7qC28tog7r8UQGGq6pP_8rF1B7XrgOwrb2TwulIMExH3_N2U5jgF8HWHnULDsmaCyTC5rbNZIrYO-Mk4pe49_OHiT5KPnHKURPXsQM_R3GBIEXAnJLHs5gVczrUtgs5aWU&sig=Cg0ArKJSzKsXmMFCJJ_CEAE&adurl=
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 8A5B 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
153
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7112
x-xss-protection
0
server
cafe
etag
12276874145846594193
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:42:31 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 8A5B 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:44:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
54
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:44:10 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8A5B 		125 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2f5a99d439c1d7bc8cd4e02f39d77d0dab1eba4e1fae40d3fc5d06ac3aaf1ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1624879993577808"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38803
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:04 GMT
l
www.google.com/ads/measurement/ Frame 8A5B 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTjyyH0ciQ29LGIBUEupnO-pvWPQWzPwNL8AG0pC7g5hQeC8gPsEwHJ7jW1F5LNNTA-r_7H
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
3239769105341817303
tpc.googlesyndication.com/simgad/ Frame 8A5B 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/3239769105341817303
Requested by
Host: scripts.webcontentassessor.com
URL: https://scripts.webcontentassessor.com/scripts/9d67f9eb2b6f2363971f073a76a50f6b264d1941d6a40bae000c2ca9b8f920a4
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
376101eeb8e0d2c34623732981ac5be2c019523a368466c9ba8a4f26e1ed5b43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 23 Jun 2021 15:47:41 GMT
x-content-type-options
nosniff
age
518243
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27812
x-xss-protection
0
last-modified
Thu, 11 Jan 2018 15:46:24 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 23 Jun 2022 15:47:41 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5EC4 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvSDLxKsJWqHUe-A6y0y6abz-h0ekx9l5DO2HYHZBJxfp-V6qnWloEislpHypKiXXIi5gqeLE1wdkruSyt7KR-E9Ji_EVkf2GAHgV-UDQ7S-eCbQL5mBjWKZo9g2CjRld4qXVyfHVw_tw4CbLHsXVL83ySlLY1mOlhTt0B4cBBxwpQF74treZuisa-EPEiYFXaP5cNtrI22qaq4cdLdRDm_mjX-n3xTNUJUKMAxG8WYj6QqnNN1_h8MLFzDMbj_dWR0yp47CKkdiYaDSKGTlb5KSh36s4RgvUWxpMbqbwxOXk628zisUnff08H4uYSnkkFvpSNT1y84QC11YK4bGZxHufw&sig=Cg0ArKJSzMbinfsHXsy2EAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Tue, 29 Jun 2021 15:45:04 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTcyNzg4NTM0MCIsImVidXkiOiIyODc0OTgyNTAyIiwiZWFkdiI6IjQ1MjY1OTk1ODQiLCJlY2lkIjoiMTM4MzU0MDE4NzY0IiwiZWVudiI6ImoiLCJlcGlkIjoiNTM0NjEwOTQiLCJlc2lkIjoiNTM0NjA4NTQifQ&tv=js-3.0.112&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tvltm=14&tvcfg=wp&tid=34034b87-872f-4469-9fd5-55c68385c90c&pid=33464a6f-95ff-4a78-9792-73515d43784b&dtm=1624981504505&qnm=_matherq&visible=1&tabid=921ec3cb-c366-46a5-b407-78177a668725&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&vp=1600x1200&ds=1600x4997&tofa=1624981505&vid=1&lvidt=1624981505&duid=34d429c5335e6472&fp=1072425006&cid=ma23578&mrk=239876503
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.210.103 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:04 GMT
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length
43
Content-Type
image/gif
truncated
/ Frame 5EC4 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2f8e32230121795d8f03f838adbeb214ebe28de92911896c7ec22c94da072734

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 2A43 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssiL23WdxqxKKml2dDeRrr5_BOSPeDniDfIOdL3A7W4OZzvcabyUgAxSPxvCj56_pX2A7PAx8JPwgBI5p-aPMzeG8KItUwRNvafHCcdx2lZVKet7NIdGjIXuIJYZElFed4OBtziQ5vsZin45t5zawyvxbeMSOBsq5tVTjsgGLLKLeiZSUXGjIgs_3jkmYgmY5FiEZi22771e4W4L42UWr5ADa6r72pbaSzXnr7dl8NrZofuZ0XOqahpmFaR5LArpApDCPeKX4BQqlMWlDam2TjEJGZaWOjltE_oSuEq27iUuXs6ioAWvDiXbM2pygoaVYZv1mOETUdDb-L0Kc1Bwg4Nqi4&sig=Cg0ArKJSzAsormRoo8SQEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Tue, 29 Jun 2021 15:45:04 GMT
truncated
/ Frame 2A43 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0c294a4bf750414447d2128b075c0ce4d0eafe20fc8aaea1e09904a0b928906c

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 3728 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss2ApydTxV0goWAcSClkb2iMA590zqYnUFItA3YebNs0EM4p4G35XaqkB7Kh9NNH-BQXXLhwEwK5VbP_wHHdOzBoOyKKT8HAhBRTTMm3PYJ3ndbjA-SrnQaoAmzuMx_x5rkMvEa7_3tAyLMbleYgPP--Oy5uNE2uPBHAHPI8R1x2Bj50AU8gMUp2EixGoRrFM4anWtEoLQR8j72K_qtsIVbHhEa7brN6kL6fAuwVW3eDTOqiPwPc4fLMeTPp9CDX005y-PJfPBY_xK35mfKA32-cOsHC4n1XlIPEm3yT5lqhl3NaoXXNo9gR9d8W6eG8BWF8_hQEUsctSk69oqwGafFzPo&sig=Cg0ArKJSzLvnlg3UwfhOEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Tue, 29 Jun 2021 15:45:04 GMT
truncated
/ Frame 3728 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2028f4555a7b5009af39ce9ca078c140c7197e9140e92ff8fbe7653d5ccbc094

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 8A5B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuR_6U4rpoj6XhaSK9mB8xQMn1AjjXjad_ahc98tjChnHv1nLRZOO6Vb2wpvZ8jOK_PoCr2WWDZuQUP0mbAf344VV9_16krnUPwufZHYH1OUG6KBXy6ZLkDNmVbPzlEGUWRmCPtz6yJUoQNIafVAJLeBE47IuZTTaABDVHbc5GcMO5WasSPF6cExjfD5aGI54OLMcGGHqJMRFY3YDfvr3l0DWYvUOllw9CKIZgdNoIbFoWuVmcxviEE-WXVx1CbwakuQgrbvyQnDkBIiSQop0LSivahqAlB4YV9RoLtgrM-_n8NHt98VM5Fa_woFpGhj7BYLE7kBsbZk81nPYUhSeTGSCahwQ&sig=Cg0ArKJSzJCrpXQC-2bxEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Tue, 29 Jun 2021 15:45:04 GMT
truncated
/ Frame 8A5B 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
540b7f2f172268ca0ba8bf119b88a0a0d52d2bdc630c2d1af66ee34a06e7cbc0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
SPug
simage4.pubmatic.com/AdServer/ Frame A27D 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=160200&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160200&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTcyNzg4NTM0MCIsImVidXkiOiIyODc0OTgyNTAyIiwiZWFkdiI6IjQ1MjY1OTk1ODQiLCJlY2lkIjoiMTM4MzU0Mzk4NDczIiwiZWVudiI6ImoiLCJlcGlkIjoiNTM0NjEwOTQiLCJlc2lkIjoiNTM0NjA4NTQifQ&tv=js-3.0.112&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tvltm=14&tvcfg=wp&tid=19cf8363-85e4-448f-ba8d-b0985a9d8072&pid=33464a6f-95ff-4a78-9792-73515d43784b&dtm=1624981504530&qnm=_matherq&visible=1&tabid=921ec3cb-c366-46a5-b407-78177a668725&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&vp=1600x1200&ds=1600x4997&tofa=1624981505&vid=1&lvidt=1624981505&duid=34d429c5335e6472&fp=1072425006&cid=ma23578&mrk=239876503
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.210.103 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:05 GMT
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length
43
Content-Type
image/gif
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTcyNzg4NTM0MCIsImVidXkiOiIyODc0OTgyNTAyIiwiZWFkdiI6IjQ1MjY1OTk1ODQiLCJlY2lkIjoiMTM4MzU0MDE4NzcwIiwiZWVudiI6ImoiLCJlcGlkIjoiNTM0NjEwOTQiLCJlc2lkIjoiNTM0NjA4NTQifQ&tv=js-3.0.112&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tvltm=14&tvcfg=wp&tid=a4ddf363-c507-4f33-9b90-2d21a1d1277f&pid=33464a6f-95ff-4a78-9792-73515d43784b&dtm=1624981504552&qnm=_matherq&visible=1&tabid=921ec3cb-c366-46a5-b407-78177a668725&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&vp=1600x1200&ds=1600x4997&tofa=1624981505&vid=1&lvidt=1624981505&duid=34d429c5335e6472&fp=1072425006&cid=ma23578&mrk=239876503
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.210.103 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:05 GMT
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length
43
Content-Type
image/gif
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTU3NzY5MDY4NSIsImVidXkiOiIyNzk2NzQyMDc4IiwiZWFkdiI6IjExMDQwMzczNCIsImVjaWQiOiIxMzgzMzYwOTYxNjMiLCJlZW52IjoiaiIsImVwaWQiOiI1MzQ2MTA5NCIsImVzaWQiOiI1MzQ2MDg1NCJ9&tv=js-3.0.112&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tvltm=14&tvcfg=wp&tid=ad4aaffb-ae81-4074-85c4-89a4b95d2785&pid=33464a6f-95ff-4a78-9792-73515d43784b&dtm=1624981504576&qnm=_matherq&visible=1&tabid=921ec3cb-c366-46a5-b407-78177a668725&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&vp=1600x1200&ds=1600x4997&tofa=1624981505&vid=1&lvidt=1624981505&duid=34d429c5335e6472&fp=1072425006&cid=ma23578&mrk=239876503
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.210.103 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:05 GMT
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length
43
Content-Type
image/gif
envelope
api.rlcdn.com/api/identity/ 		44 B
110 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=13257
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.133.55 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
via
1.1 google
x-content-type-options
nosniff
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods
GET, OPTIONS
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
alt-svc
clear
content-length
44
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pv&page=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&wrdcnt=420&sec=Business&ptype=article&cms=WP&chrcnt=2542&auth=Aldo%20Svaldi&artupt=1624321528&artpubt=1624363224&artid=4614849&tv=js-3.0.112&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tvltm=14&tvcfg=wp&tid=d386a7db-41c1-48fb-81ad-05abfc174737&pid=33464a6f-95ff-4a78-9792-73515d43784b&dtm=1624981504815&qnm=_matherq&visible=1&tabid=921ec3cb-c366-46a5-b407-78177a668725&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&vp=1600x1200&ds=1600x4997&tofa=1624981505&vid=1&lvidt=1624981505&duid=34d429c5335e6472&fp=1072425006&cid=ma23578&mrk=239876503&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTYyNDk4MTUwMDc4NCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxMG1iIiwiaGVhcFQiOiIxMG1iIiwiZnN0UGFpbnQiOiIxNDYyIiwiZmV0Y2hTIjoiMCIsImRvbWFpblMiOiIxIiwiZG9tYWluRSI6IjIiLCJjb25uUyI6IjIiLCJjb25uRSI6IjQ5Iiwic3NsUyI6IjIyIiwicmVxdVMiOiI1MCIsInJlc3BTIjoiNDE1IiwicmVzcEUiOiI2NDIiLCJkb21Mb2FkIjoiNDE5IiwiZG9tSW50ZXIiOiIxNTgxIiwiZG9tTG9hZFMiOiIxNjA0IiwiZG9tTG9hZEUiOiIxNjA4In19
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.210.103 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:05 GMT
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length
43
Content-Type
image/gif
c
ids.cdnwidget.com/ 		31 B
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=63a78c531efae14df2b9f1cd91ff2630&SCH1=4b3f73dc3e8c54be8070a4015557a906&GCS1=020236054&GCS2=MTIzNzdmMTctZGU1MC00N2I0LTliYTAtNDdhODFiMmEwMTIwLmxvY2FsLGZjMTM0ODMzLTEzYjYtNDZhMy1hZmQyLTkxZDYzOTM4ZWYwZi5sb2NhbA==&pe=false&wsid=3994&log=%7B%22config%22%3A%7B%22gmEN%22%3Afalse%2C%22pixEN%22%3Afalse%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A3994%2C%22loadID%22%3A%22mSCQGkSlCQkzohU%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A7%2C%22IDStageStart%22%3A7%2C%22netComplete%22%3A185%2C%22obsReqdata%22%3A425%2C%22obsReqpage%22%3A533%2C%22obsReqview%22%3A1393%2C%22IDStagePrefire%22%3A1394%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Atrue%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A2%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%7D
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.47.17 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
6627c5ab36fa407f18fc9b6987e359eccef005ae6d35b370d2142b7daa770324

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:05 GMT
via
1.1 google
access-control-allow-credentials
true
alt-svc
clear
content-type
application/json
init1.js
api.bounceexchange.com/bounce/ 		36 B
320 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.bounceexchange.com/bounce/init1.js?wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgDYAmAFgE4AOfAVgAYbTrNgAvEKAWn2LswHcApgCMcqYIID6qACZQAzOXKlMAJ0E4QAGzhoMBQnToAPHkbWCYg1etVRsAQy1bUCAOaS4qrVAAWwYAAHHABSeQBBEOIAMSjo-gSAOhlBBAA3a0CQHGBEpBAAWzjeYnw4ukJi4jj8rRBVBxkQTkRBAsC6gE8C1OBOGAa4GU5A31QcMfc4zDTx8Ul8kABrVEEoEIB2ACEo4i1A3bDI4mJ-INDiGgiomhibmIT+ZNSM1SycvML76JKyy5iKt8Tt9avVGs1Wu0uj0EH0Bg4hiMxhNXG5vodiABhXaqQ7XYHAjYAEWwIGWq3W212aTxkSpJ0Er0kdTcbkEMmkCFpMCcOEEUWxJxwcGEBXEEg5Yq0UjGbl83N5-Kxu2FovF7MkwnUDhW7kkCEE-Au1QiPK0fIFKpFYoCGpwWVUwBwkkKgmltoV5qVguIqptEpdgVc6C5wNNistQut6o5wjgYgNOGNRzNFuVUbVto5SFUqB6nrTPr9MckWRcaCQyfDXsjvujWckvWswAcrhhwAL3qtmYDjNSqINRs7tcESAcgUkfNSkmAyMkszEHbD4VT-OJtZkbmiqFUOQAMiBGrTgKo4GuSWkHLuANqBBxsmedQKCAC6UCvFelMyvOGvBRAMhOPOczCNKb6rt+N6NMBYiga+UAnmekG-rMKQgDBqBweBirIdeiwrFI-6AVopbqHysJvohgi4R+qBINK+oOD0b7RIMMg5NYFx0DgBo6qiUR0K4oACZi2hgk0AmQh0IDdL0AkOEg+SIE6AmzA48kCcIClLE09Q0Y6dEMWOEhuPUnRvls8auBoOC4XenT8E4JGBGRvTYV6uFaUgSwwKgziSCk0myRR9iXjeMgwBOqiHjIoEgN5b4ICAwCSNqMidHZDjBSl+QIL5qg9DI7l8rhLJshyrjFdRYW-n2qjMiArIapVsA4TV16Djg7oSPVqo4DmmHslVuHFg2UoyqgcrDe1o0Blqgh8XqnXTT+16zXaDpOi6PTdfBEEzfWAYgEGCAhitN7rbGVmJjg52-pdCy5sxrUeQdPYamW4h0bdL0lW9-oak2jqtgg7Z3Wth2Axkp3uMtv3Vato7jpOgjTrO4wYcA4PQQMqOTiK4PqB4jn+S5GhufDpLklIoDoVoV5spTwiBFAfCCEEUDXgARLR9GCFzAA0XPGYIpmqJ0gvC74o5LCAuiS74rpcy+mCBE674GXzpJQqgDjIFIMD024oW+A4UBAA
Requested by
Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_36b64f6e4069a3dac8004dac95ac43d4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.4.53 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
via
1.1 google
server
istio-envoy
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-encoding
gzip
x-envoy-upstream-service-time
113
content-type
text/html; charset=UTF-8
alt-svc
clear
cjs-logger
e.cdnwidget.com/ 		0
68 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.cdnwidget.com/cjs-logger?source=ID%20generation%20error&severity=Warning&error=Country%2520not%2520allowed&cookieID=&deviceID=&BXWID=3994&warpspeed=2%5EHIykD&loadID=mSCQGkSlCQkzohU&version=1.5.9
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.221.36 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
via
1.1 google
alt-svc
clear
content-type
image/png
activeview
pagead2.googlesyndication.com/pcs/ Frame 5EC4 		42 B
518 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv547Zo78DQzLwqZ8CuzNFUNwBJEFLZKGqIhyJJBENf9m8bwcyVSuLHXZ58Q9g7XBCw7VhNYkjbIl5D8T4pTOGDUVJL2nXprsZlvs-wwE_hQdr1-ssT&sig=Cg0ArKJSzHO69HRsQolGEAE&id=lidar2&mcvt=1000&p=182,436,272,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210628&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=536565947&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1624981504409&rpt=192&isd=0&msd=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 2A43 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvjvuhKqdJb5uF16pjLrnVCcqcZvc4nV6L1V9GgvrgU-UVfl5OMwJQPvIq4l_JyXf-ASg9RiR5OOUvET6hhVihroCHsDY_WARQIw4Ct-DPn6jiX8ONY&sig=Cg0ArKJSzOLjssQXS5KgEAE&id=lidar2&mcvt=1000&p=577,1138,1177,1438&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210628&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=2781879128&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1624981504443&rpt=154&isd=0&msd=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E328 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method
GET
:authority
ads.pubmatic.com
:scheme
https
:path
/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KADUSERCOOKIE=5A172B0A-45DD-4D11-A86B-F32F8222D5B2; chkChromeAb67Sec=1; DPSync3=1626134400%3A219_201_197%7C1625011200%3A174; SyncRTB3=1626220800%3A35%7C1626134400%3A71_220_21_13_161_56_7_54_3; KRTBCOOKIE_27=16735-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&16736-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&23019-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&23114-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c; PUBMDCID=3; KRTBCOOKIE_391=22924-2222419212698096373&KRTB&23263-2222419212698096373; KRTBCOOKIE_377=6810-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&KRTB&22918-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&KRTB&23031-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2; KRTBCOOKIE_57=22776-3021078908452899730; PugT=1624981503; KRTBCOOKIE_336=5844-3292070678450782984; KRTBCOOKIE_80=22987-CAESENhx_sKBpcJ6EwJPAIgJWtQ&KRTB&16514-CAESENhx_sKBpcJ6EwJPAIgJWtQ&KRTB&23025-CAESENhx_sKBpcJ6EwJPAIgJWtQ; SPugT=1624981503
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=18116
expires
Tue, 29 Jun 2021 20:47:02 GMT
date
Tue, 29 Jun 2021 15:45:06 GMT
vary
Accept-Encoding
csync
sync.spotim.market/
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D271858%26extuid%3D%24UID
  • https://sync.spotim.market/csync?t=a&ep=271858&extuid=3021078908452899730
86 B
526 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.spotim.market/csync?t=a&ep=271858&extuid=3021078908452899730
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:07 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
VertaMedia 1.0
Content-Length
86
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:06 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
b9cd509f-9e5e-4c97-867e-2fa9b3cc3c05
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://sync.spotim.market/csync?t=a&ep=271858&extuid=3021078908452899730
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
partner
sync.search.spotxchange.com/
Redirect Chain
  • https://sync.search.spotxchange.com/partner?source=211945
  • https://sync.search.spotxchange.com/partner?source=211945&__user_check__=1&sync_id=fa891760-d8f0-11eb-a599-1afcdea00206
0
589 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.search.spotxchange.com/partner?source=211945&__user_check__=1&sync_id=fa891760-d8f0-11eb-a599-1afcdea00206
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.125 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-spotx-halt-type
Audience Dsp sync Priority Sync endpoint Source ID is not on enabled source whitelist
Date
Tue, 29 Jun 2021 15:45:07 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
140
Connection
keep-alive
Content-Length
0

Redirect headers

Date
Tue, 29 Jun 2021 15:45:07 GMT
Server
nginx
Location
/partner?source=211945&__user_check__=1&sync_id=fa891760-d8f0-11eb-a599-1afcdea00206
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
130
Connection
keep-alive
Content-Length
0
sync
ups.analytics.yahoo.com/ups/58196/
Redirect Chain
  • https://pixel.advertising.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true
  • https://pixel.advertising.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPfa8913b3-d8f0-11eb-93b1-02c8291bccce
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPfa8913b3-d8f0-11eb-93b1-02c8291bccce
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

location
https://ups.analytics.yahoo.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPfa8913b3-d8f0-11eb-93b1-02c8291bccce
date
Tue, 29 Jun 2021 15:45:07 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
/
sync.spotim.market/csync/
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20
  • https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20&__user_check__=1&sync_id=fa893e00-d8f0...
  • https://sync.spotim.market/csync/?t=a&ep=301276&extuid=fa893dc4-d8f0-11eb-981b-1131174c0506
86 B
543 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.spotim.market/csync/?t=a&ep=301276&extuid=fa893dc4-d8f0-11eb-981b-1131174c0506
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:07 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
VertaMedia 1.0
Content-Length
86
Content-Type
image/gif

Redirect headers

Date
Tue, 29 Jun 2021 15:45:07 GMT
Server
nginx
Location
https://sync.spotim.market/csync/?t=a&ep=301276&extuid=fa893dc4-d8f0-11eb-981b-1131174c0506
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
115
Connection
keep-alive
Content-Length
0
710530.gif
di.rlcdn.com/ 		0
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://di.rlcdn.com/710530.gif
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
via
1.1 google
alt-svc
clear
content-length
0
ad-choises.png
publisher-assets.spot.im/yad/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://publisher-assets.spot.im/yad/ad-choises.png
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.133 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f27b4cdbd821100765224a52c7c8d544fa9fdd6d0aba21015eb66c11735e0989

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
last-modified
Mon, 02 Jul 2018 15:08:43 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"643378ef8a85df26380de21f9beb58ba"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31622400
accept-ranges
bytes
content-length
4191
x-amz-cf-id
SFldp4F3D8aBFuJdZMh92BRiziJpOYoD4XVBkdhjvOsP0k4M4wCkcA==
expires
Thu, 30 Jun 2022 15:45:07 GMT
grumi-ip.js
rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/ Frame 61FC 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:9400:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4dc4abcd99f7976c1a0938575631974c55fa42bf76681e84ca56aeea3180966e

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 14:50:23 GMT
content-encoding
br
last-modified
Sun, 20 Jun 2021 12:01:43 GMT
server
AmazonS3
age
3284
etag
W/"1f2e2e253216d7dc0988459b5390d3aa"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
E8tepMuZEI_lmCDKu37WY2.wC8UNRe39
via
1.1 bf5caee39117de5337c47c748b716e80.cloudfront.net (CloudFront)
cache-control
public, max-age: 14400, stale-while-revalidate=14400, immutable
x-amz-cf-pop
AMS1-C1
content-type
application/javascript
x-amz-cf-id
HTOyfZBAbBsQnBdeyckSyQTdOoiJ2ek7ZgawJVAfmnWDfSSvj7vpLg==
hb_270443_140.js
player.spotim.market/prebidlink/451383/ Frame 61FC 		349 KB
109 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
79e27b5710d27d87da2ba1c049a4359ed79b5600693ff185d97f9022ea0f7edb

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
last-modified
Thu, 17 Jun 2021 10:24:46 GMT
server
nginx
etag
W/"60cb22ee-57308"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Tue, 29 Jun 2021 16:45:07 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame 61FC 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
sffe /
Resource Hash
de3e98641c1d746e61b91de6394c62c30825073d247814fde10c2ec7dc49bda6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"915 / 804 of 1000 / last-modified: 1624965047"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24254
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:06 GMT
wrapper_hb_270443_140.js
player.spotim.market/prebidlink/451383/ Frame 61FC 		187 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
1ef86239e26082c826d4a9674729264c4d11a46f33af41b65fdb8da0433f4ede

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
last-modified
Fri, 25 Jun 2021 14:39:23 GMT
server
nginx
etag
W/"60d5ea9b-2ec88"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Tue, 29 Jun 2021 16:45:07 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
PugMaster
image6.pubmatic.com/AdServer/ Frame E328 		5 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=8333304&p=156758&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
4dd6035731ba6e9f3e15ef46d599d47a9066f7334f0660278b48c57f5b5e27a5

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
content-type
text/html; charset=UTF-8
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Pug
simage2.pubmatic.com/AdServer/ Frame C589
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6979242424886753422
42 B
234 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6979242424886753422
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6979242424886753422
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KADUSERCOOKIE=5A172B0A-45DD-4D11-A86B-F32F8222D5B2; KRTBCOOKIE_27=16735-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&16736-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&23019-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&23114-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c; PUBMDCID=3; KRTBCOOKIE_391=22924-2222419212698096373&KRTB&23263-2222419212698096373; KRTBCOOKIE_377=6810-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&KRTB&22918-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&KRTB&23031-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2; KRTBCOOKIE_57=22776-3021078908452899730; KRTBCOOKIE_336=5844-3292070678450782984; KRTBCOOKIE_80=22987-CAESENhx_sKBpcJ6EwJPAIgJWtQ&KRTB&16514-CAESENhx_sKBpcJ6EwJPAIgJWtQ&KRTB&23025-CAESENhx_sKBpcJ6EwJPAIgJWtQ; SPugT=1624981503; chkChromeAb67Sec=2; DPSync3=1625011200%3A174%7C1626134400%3A221_226_227_219_201_197%7C1627516800%3A232; SyncRTB3=1626220800%3A35%7C1625529600%3A223_67_2_15%7C1627516800%3A203%7C1625788800%3A63%7C1626134400%3A56_8_230_5_220_166_81_204_21_54_22_231_233_57_71_161_189_104_7_88_176_222_78_13_99_165_3_55_234%7C1630108800%3A69; KRTBCOOKIE_153=19420-FFTsTxEC7kgPAbAaEAWlHxVTvk8PBrwYRgdY9rHS&KRTB&22979-FFTsTxEC7kgPAbAaEAWlHxVTvk8PBrwYRgdY9rHS; KRTBCOOKIE_22=14911-3249595990992905771; PugT=1624981504
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:04 GMT
content-type
image/gif; charset=utf-8
content-length
42
set-cookie
KRTBCOOKIE_1101=23040-6979242424886753422&KRTB&23278-6979242424886753422; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:04 GMT; path=/ PugT=1624981504; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:04 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:04 GMT; path=/
x-lat
amspug016:0:333
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Server
nginx
Date
Tue, 29 Jun 2021 15:45:06 GMT
Transfer-Encoding
chunked
Connection
keep-alive
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Set-Cookie
UserID1=6979242424886753422; Max-Age=7776000; domain=.adfarm1.adition.com; Path=/; SameSite=None; Secure
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6979242424886753422
redir
rtb-csync.smartadserver.com/ Frame 0A23
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBRkhFN0J0b0FBQURXX2JyS1JJUQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFBRkhFN0J0b0FBQURXX2JyS1JJUQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1&_bee_ppp=1
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAAFHU7BtoAAADW_brKRIQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_curre...
43 B
163 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAAFHU7BtoAAADW_brKRIQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.137.133 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Host
rtb-csync.smartadserver.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 29 Jun 2021 15:45:07 GMT
content-type
image/gif
transfer-encoding
chunked

Redirect headers

Date
Tue, 29 Jun 2021 15:45:07 GMT
location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAAFHU7BtoAAADW_brKRIQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Server
nginx
set-cookie
bito=AAAFHU7BtoAAADW_brKRIQ; Domain=bidr.io; expires=Fri, 29 Jul 2022 11:45:07 GMT; Path=/; SameSite=None; Secure bitoIsSecure=ok; Domain=bidr.io; expires=Fri, 29 Jul 2022 11:45:07 GMT; Path=/; SameSite=None; Secure checkForPermission=""; Domain=bidr.io; expires=Thu, 01 May 2008 00:00:00 GMT; Path=/; SameSite=None; Secure
strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
0
Connection
keep-alive
Pug
simage2.pubmatic.com/AdServer/ Frame 9A35
Redirect Chain
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie=$UID&gdpr=0
0
88 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie=$UID&gdpr=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie=$UID&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KRTBCOOKIE_218=22978-YNtAAwACN0IesgAC&KRTB&23194-YNtAAwACN0IesgAC&KRTB&23209-YNtAAwACN0IesgAC&KRTB&23244-YNtAAwACN0IesgAC; PUBMDCID=3; KRTBCOOKIE_188=3189-10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553; PugT=1624981508
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:08 GMT
content-type
text/html; charset=utf-8
x-lat
amspug017:2:244
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private
content-encoding
gzip

Redirect headers

set-cookie
viewer_token=74ee6141-0ab5-4da1-9820-8b3821beee52; path=/; domain=csync.loopme.me; Expires=Thu, 29-Jul-2021 15:45:09 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie=$UID&gdpr=0
content-length
0
date
Tue, 29 Jun 2021 15:45:09 GMT
server
_
Pug
simage2.pubmatic.com/AdServer/ Frame 1FD3
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3553511853
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3553511853
  • https://sync.1rx.io/usersync/tradedesk/90d2043b-69e9-4cba-b47a-40bbd01c2c60
  • https://sync.targeting.unrulymedia.com/csync/RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003
42 B
292 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KRTBCOOKIE_409=22966-ahic9WSEj0wRc1Rt9yieXDvR; PUBMDCID=3; KRTBCOOKIE_107=1471-uid:rg573CxS1LYfVf5; PugT=1624981512
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:12 GMT
content-type
image/gif; charset=utf-8
content-length
42
set-cookie
KRTBCOOKIE_594=17105-RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003&KRTB&17107-RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/ PugT=1624981512; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:12 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/
x-lat
amspug012:0:331
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
Tengine
date
Tue, 29 Jun 2021 15:45:13 GMT
content-type
text/html
set-cookie
_rxuuid=%7B%22rx_uuid%22%3A%22RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003%22%7D; path=/; expires=Wed, 29 Jun 2022 15:45:13 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003
etag
RX66d05dd59ae34ad9a19a1208c947599a003
dpe
ad4m.at/ad/ Frame EAAF 		42 B
1009 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3039::6815:c036 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox

Request headers

:method
GET
:authority
ad4m.at
:scheme
https
:path
/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
content-type
image/gif
content-length
42
report-to
{"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
expires
0
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
content-security-policy
block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
referrer-policy
same-origin
pragma
no-cache
surrogate-control
no-store
x-fastcgi-cache
BYPASS
x-backend-server
adsrv-wmp3
via
1.1 google
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-request-id
0afa0b208e00009784e938b000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
667047ada8af9784-FRA
Pug
image2.pubmatic.com/AdServer/ Frame 8257
Redirect Chain
  • https://green.erne.co/pubmatic/cm?
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ahic9WSEj0wRc1Rt9yieXDvR
42 B
372 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ahic9WSEj0wRc1Rt9yieXDvR
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method
GET
:authority
image2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ahic9WSEj0wRc1Rt9yieXDvR
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:13 GMT
content-type
image/gif; charset=utf-8
content-length
42
set-cookie
KRTBCOOKIE_409=22966-ahic9WSEj0wRc1Rt9yieXDvR; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:13 GMT; path=/ PugT=1624981513; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:13 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:13 GMT; path=/
x-lat
lhrpug010:0:379
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
openresty
date
Tue, 29 Jun 2021 15:45:13 GMT
content-length
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
set-cookie
u=ahic9WSEj0wRc1Rt9yieXDvR; Max-Age=31536000; Domain=.erne.co; Path=/; Secure; SameSite=None
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ahic9WSEj0wRc1Rt9yieXDvR
strict-transport-security
max-age=0; includeSubDomains;
bridge
cm.adgrx.com/ Frame 40B7 		43 B
408 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.231.180.197 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Host
cm.adgrx.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Date
Tue, 29 Jun 2021 15:45:13 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
server
Cowboy
X-RealServer-NX
ams-delivery-1
Cache-Control
no-cache, no-store, must-revalidate, proxy-revalidate
Pragma
no-cache
Expires
Thu, 23 Sep 2004 17:42:04 GMT
P3P
CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin
*
i.match
s.tribalfusion.com/z/ Frame A39D
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
437 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

:method
GET
:authority
s.tribalfusion.com
:scheme
https
:path
/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
ANON_ID=agnoeUSkTsvAutosiaRhRE4WJN3UPDbqZdKKCAn5X
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
content-type
image/gif; charset=utf-8
content-length
43
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
302
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
set-cookie
ANON_ID=aons6Eq0I1e9yNy6Qwmh5gPD61TQ697u2eWmkxOX8H1Dje5G1YYXPOFZa4ZdJaX2qeI7Ms3hGUaLqHnCt48VBu; path=/; domain=.tribalfusion.com; expires=Mon, 27-Sep-2021 15:45:06 GMT; SameSite=None; Secure; ANON_ID_old=aons6Eq0I1e9yNy6Qwmh5gPD61TQ697u2eWmkxOX8H1Dje5G1YYXPOFZa4ZdJaX2qeI7Ms3hGUaLqHnCt48VBu; path=/; domain=.tribalfusion.com; expires=Mon, 27-Sep-2021 15:45:06 GMT;
cf-cache-status
DYNAMIC
cf-request-id
0afa0b214d00004ee573860000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
667047aeef674ee5-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date
Tue, 29 Jun 2021 15:45:06 GMT
content-type
text/html
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
206
x-reuse-index
343
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
set-cookie
ANON_ID=agnoeUSkTsvAutosiaRhRE4WJN3UPDbqZdKKCAn5X; path=/; domain=.tribalfusion.com; expires=Mon, 27-Sep-2021 15:45:06 GMT; SameSite=None; Secure; ANON_ID_old=agnoeUSkTsvAutosiaRhRE4WJN3UPDbqZdKKCAn5X; path=/; domain=.tribalfusion.com; expires=Mon, 27-Sep-2021 15:45:06 GMT;
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status
DYNAMIC
cf-request-id
0afa0b209700004ee5b63c8000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
667047adbcc34ee5-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Pug
simage2.pubmatic.com/AdServer/ Frame F85D
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%%
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=BkLbbTw2bU5h&pid=557219
1 B
145 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=BkLbbTw2bU5h&pid=557219
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=BkLbbTw2bU5h&pid=557219
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KRTBCOOKIE_409=22966-ahic9WSEj0wRc1Rt9yieXDvR; PUBMDCID=3; KRTBCOOKIE_107=1471-uid:rg573CxS1LYfVf5; PugT=1624981512
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:11 GMT
content-type
text/html; charset=utf-8
content-length
1
set-cookie
PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:11 GMT; path=/
x-lat
amspug016:0:345
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server
bh-deployment-8474b759f8-78x9q
cache-control
private, max-age=0, no-cache, no-store
expires
-1
content-language
en-US
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=BkLbbTw2bU5h&pid=557219
server
Jetty(9.4.14.v20181114)
strict-transport-security
max-age=15768000
set-cookie
INGRESSCOOKIE=fdf77391205c62cc; path=/; HttpOnly; Secure; SameSite=None
rtb-h
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 735D
Redirect Chain
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...
0
147 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
match.taboola.com
:scheme
https
:path
/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
t_gid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
accept-ranges
bytes
date
Tue, 29 Jun 2021 15:45:07 GMT
via
1.1 varnish
x-served-by
cache-fra19141-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1624981508.588719,VS0,VE8
content-length
0

Redirect headers

server
nginx
set-cookie
t_gid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582;Version=1;Path=/;Domain=.taboola.com;Expires=Wed, 29-Jun-2022 15:45:06 GMT;Max-Age=31536000;Secure;SameSite=None
location
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=b342dcde-de32-4f99-a6e6-69a42549df70-tuct7d4c582&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges
bytes
date
Tue, 29 Jun 2021 15:45:06 GMT
via
1.1 varnish
x-served-by
cache-fra19162-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1624981506.206061,VS0,VE8
x-vcl-time-ms
8
content-length
0
141
match.deepintent.com/usersync/ Frame 32E0 		0
44 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.deepintent.com/usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
match.deepintent.com
:scheme
https
:path
/usersync/141?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw%26piggybackCookie%3D%24%7BDI_USER_ID%7D&gdpr=0&gdpr_consent=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

content-length
0
date
Tue, 29 Jun 2021 15:45:13 GMT
server
b
check
pixel.tapad.com/idsync/ex/receive/ Frame C2B1
Redirect Chain
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxODQmdGw9MTU3NjgwMA==&r=https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB&partner_device_id=${PUBMATIC_UID}
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=PUBMATIC_RTB
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
95 B
165 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Jetty(9.4.36.v20210114) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
pixel.tapad.com
:scheme
https
:path
/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
TapAd_TS=1624981509389; TapAd_DID=1b8d35fe-2bda-4cbb-b19b-a3011c521093
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 29 Jun 2021 15:45:09 GMT
strict-transport-security
max-age=31536000
content-type
image/png
content-length
95
server
Jetty(9.4.36.v20210114)
via
1.1 google
alt-svc
clear

Redirect headers

date
Tue, 29 Jun 2021 15:45:09 GMT
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
set-cookie
TapAd_TS=1624981509388;Expires=Sat, 28 Aug 2021 15:45:09 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None TapAd_DID=d3b325b3-b539-49d2-a370-b622d17c0cba;Expires=Sat, 28 Aug 2021 15:45:09 GMT;Path=/;Domain=.tapad.com;Secure;SameSite=None
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=PUBMATIC_RTB
content-length
0
server
Jetty(9.4.36.v20210114)
via
1.1 google
alt-svc
clear
Pug
simage2.pubmatic.com/AdServer/ Frame 6933
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rg573CxS1LYfVf5&gdpr=0&gdpr_consent=
42 B
367 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rg573CxS1LYfVf5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rg573CxS1LYfVf5&gdpr=0&gdpr_consent=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KRTBCOOKIE_409=22966-ahic9WSEj0wRc1Rt9yieXDvR; PugT=1624981513; PUBMDCID=3
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:12 GMT
content-type
image/gif; charset=utf-8
content-length
42
set-cookie
KRTBCOOKIE_107=1471-uid:rg573CxS1LYfVf5; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/ PugT=1624981512; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:12 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/
x-lat
amspug018:0:393
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Cache-Control
no-cache, must-revalidate
Date
Tue, 29 Jun 2021 15:45:12 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:rg573CxS1LYfVf5&gdpr=0&gdpr_consent=
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Pragma
no-cache
Server
PingMatch/v2.0.30-655-g6f0fff2#rel-ec2-master i-066a1c0b271e68364@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Set-Cookie
wfivefivec=rg573CxS1LYfVf5; Domain=.w55c.net; Expires=Fri, 29-Jul-2022 15:45:13 GMT; Path=/; SameSite=None; Secure matchpubmatic=5; Domain=.w55c.net; Expires=Thu, 29-Jul-2021 15:45:13 GMT; Path=/; SameSite=None; Secure
Content-Length
0
Connection
keep-alive
Pug
simage2.pubmatic.com/AdServer/ Frame 007D
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=11
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=pHXeeUKXSTZwn-YYCcnNhJ8wNwc
42 B
219 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=pHXeeUKXSTZwn-YYCcnNhJ8wNwc
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=pHXeeUKXSTZwn-YYCcnNhJ8wNwc
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KRTBCOOKIE_409=22966-ahic9WSEj0wRc1Rt9yieXDvR; PUBMDCID=3; KRTBCOOKIE_107=1471-uid:rg573CxS1LYfVf5; PugT=1624981512; KRTBCOOKIE_594=17105-RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003&KRTB&17107-RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003; KRTBCOOKIE_466=16530-c3a61afa-33d3-45de-9e64-769eb1518c8c
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:12 GMT
content-type
image/gif; charset=utf-8
content-length
42
set-cookie
KRTBCOOKIE_860=16335-pHXeeUKXSTZwn-YYCcnNhJ8wNwc; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/ PugT=1624981512; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:12 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/
x-lat
amspug012:0:317
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Content-Type
text/html; charset=utf-8
Date
Tue, 29 Jun 2021 15:45:13 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=pHXeeUKXSTZwn-YYCcnNhJ8wNwc
Set-Cookie
sa-user-id=s%3A0-a475de79-4297-4936-709f-e61809c9cd84.HXRv3xtbIwqkhXHiGcZF3zAY1GvMZOPflAW6Y%2BOSejM; Max-Age=31536000; Secure; SameSite=None sa-user-id-v2=s%3A0-a475de79-4297-4936-709f-e61809c9cd84%24ip%24159.48.55.7.QfM1Po7p2myCLHLLuG0yYkp5eg5a1DAo8UNhhJPSxlo; Domain=srv.stackadapt.com; Max-Age=31536000; Secure; SameSite=None
Content-Length
159
Connection
keep-alive
Pug
simage2.pubmatic.com/AdServer/ Frame EC10
Redirect Chain
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:61E2B7E0D53D483795802CF503F8FBDF
1 B
164 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:61E2B7E0D53D483795802CF503F8FBDF
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:61E2B7E0D53D483795802CF503F8FBDF
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KADUSERCOOKIE=5A172B0A-45DD-4D11-A86B-F32F8222D5B2; KRTBCOOKIE_27=16735-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&16736-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&23019-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c&KRTB&23114-uid:f55860db-3ffe-4500-8efa-e7690e0cf64c; PUBMDCID=3; KRTBCOOKIE_391=22924-2222419212698096373&KRTB&23263-2222419212698096373; KRTBCOOKIE_377=6810-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&KRTB&22918-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2&KRTB&23031-e07bd15d-ae2d-4f39-a3c1-dd38c22cecf2; KRTBCOOKIE_57=22776-3021078908452899730; PugT=1624981503; KRTBCOOKIE_336=5844-3292070678450782984; KRTBCOOKIE_80=22987-CAESENhx_sKBpcJ6EwJPAIgJWtQ&KRTB&16514-CAESENhx_sKBpcJ6EwJPAIgJWtQ&KRTB&23025-CAESENhx_sKBpcJ6EwJPAIgJWtQ; SPugT=1624981503; chkChromeAb67Sec=2; DPSync3=1625011200%3A174%7C1626134400%3A221_226_227_219_201_197%7C1627516800%3A232; SyncRTB3=1626220800%3A35%7C1625529600%3A223_67_2_15%7C1627516800%3A203%7C1625788800%3A63%7C1626134400%3A56_8_230_5_220_166_81_204_21_54_22_231_233_57_71_161_189_104_7_88_176_222_78_13_99_165_3_55_234%7C1630108800%3A69
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:05 GMT
content-type
text/html; charset=utf-8
content-length
1
set-cookie
PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:05 GMT; path=/
x-lat
amspug003:0:379
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
nginx
date
Tue, 29 Jun 2021 15:45:06 GMT
content-type
text/html
content-length
154
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:61E2B7E0D53D483795802CF503F8FBDF
expires
Mon, 28 Jun 2021 15:45:06 GMT
cache-control
no-cache
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
access-control-allow-origin
*
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Pug
simage2.pubmatic.com/AdServer/ Frame 08F0
Redirect Chain
  • https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
  • https://um.simpli.fi/match_redirect?sifi_redir=https%3A%2F%2Fmatch.bnmla.com%2Fusersync%3Fdspid%3D6%26uuid%3D%24UID
  • https://match.bnmla.com/usersync?dspid=6&uuid=D263009B61A24C448B8638E42A7882FA
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=42042ed4-289b-4cbf-a99d-f7a9cb117001
42 B
258 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=42042ed4-289b-4cbf-a99d-f7a9cb117001
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method
GET
:authority
simage2.pubmatic.com
:scheme
https
:path
/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=42042ed4-289b-4cbf-a99d-f7a9cb117001
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
KRTBCOOKIE_409=22966-ahic9WSEj0wRc1Rt9yieXDvR; PUBMDCID=3; KRTBCOOKIE_107=1471-uid:rg573CxS1LYfVf5; PugT=1624981512; KRTBCOOKIE_594=17105-RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003&KRTB&17107-RX-66d05dd5-9ae3-4ad9-a19a-1208c947599a-003; KRTBCOOKIE_466=16530-c3a61afa-33d3-45de-9e64-769eb1518c8c
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 29 Jun 2021 15:45:12 GMT
content-type
image/gif; charset=utf-8
content-length
42
set-cookie
KRTBCOOKIE_308=22925-42042ed4-289b-4cbf-a99d-f7a9cb117001&KRTB&23158-42042ed4-289b-4cbf-a99d-f7a9cb117001; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/ PugT=1624981512; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 29-Jul-2021 15:45:12 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 27-Sep-2021 15:45:12 GMT; path=/
x-lat
amspug020:0:298
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Server
nginx
Date
Tue, 29 Jun 2021 15:45:13 GMT
Content-Length
0
Connection
keep-alive
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=42042ed4-289b-4cbf-a99d-f7a9cb117001
Cookie set csync
sync.spotim.market/ Frame 290A 		86 B
543 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.spotim.market/csync?t=a&ep=281178&extuid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Host
sync.spotim.market
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
VertaMedia 1.0
Date
Tue, 29 Jun 2021 15:45:06 GMT
Content-Type
image/gif
Content-Length
86
Cache-Control
no-cache, no-store, must-revalidate
Set-Cookie
vmuid=30dad83ba8aafb8b; expires=Mon, 30 Aug 2021 15:45:06 GMT; domain=.spotim.market; path=/; secure; SameSite=None a281178=5A172B0A-45DD-4D11-A86B-F32F8222D5B2; expires=Mon, 30 Aug 2021 15:45:06 GMT; domain=.spotim.market; path=/; secure; SameSite=None
Artemis
aud.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=&fbounce=1
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&addseg=17
7 B
87 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&addseg=17
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.64.189.249 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:13 GMT
content-length
7
content-type
text/plain; charset=utf-8

Redirect headers

date
Tue, 29 Jun 2021 15:45:13 GMT
via
1.1 google
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&addseg=17
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
135
info2
uipglob.semasio.net/pubmatic/1/ Frame E328
Redirect Chain
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&sInitiator=external&gdpr=0&gdpr_consent=
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&sInitiator=external&gdpr=0&gdpr_consent=
42 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&sInitiator=external&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
77.243.60.138 Aalborg, Denmark, ASN42697 (NETIC-AS, DK),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:11 GMT
frontend-id
15
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
42
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:11 GMT
frontend-id
12
location
/pubmatic/1/info2?sType=sync&sExtCookieId=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&sInitiator=external&gdpr=0&gdpr_consent=
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT
mw
mwzeom.zeotap.com/ Frame E328 		95 B
489 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
667047adb9e618e5-FRA
access-control-allow-headers
*
content-length
95
cf-request-id
0afa0b2090000018e59919a000000001
/
loadm.exelator.com/load/ Frame E328
Redirect Chain
  • https://loadm.exelator.com/load/?p=204&g=71&buid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=0&gdpr_consent=&j=0
  • https://loadm.exelator.com/load/?p=204&g=71&buid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=0&gdpr_consent=&j=0&xl8blockcheck=1
0
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loadm.exelator.com/load/?p=204&g=71&buid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=0&gdpr_consent=&j=0&xl8blockcheck=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.78.254.47 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
Software
nginx / Undertow/1
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:08 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date
Tue, 29 Jun 2021 15:45:08 GMT
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://loadm.exelator.com/load/?p=204&g=71&buid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=0&gdpr_consent=&j=0&xl8blockcheck=1
cache-control
no-cache
access-control-allow-credentials
true
content-type
image/gif
content-length
0
sync
ups.analytics.yahoo.com/ups/58292/ Frame E328 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&redir=true&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
Pug
simage2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YNtAAwACN0IesgAC&gdpr=0&gdpr_consent=&_test=YNtAAwACN0IesgAC
1 B
390 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YNtAAwACN0IesgAC&gdpr=0&gdpr_consent=&_test=YNtAAwACN0IesgAC
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
cache-control
no-store, no-cache, private
x-lat
amspug002:0:298
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:07 GMT
via
1.1 varnish
server
Varnish
x-timer
S1624981507.383176,VS0,VE0
x-served-by
cache-hhn4024-HHN
x-cache
HIT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YNtAAwACN0IesgAC&gdpr=0&gdpr_consent=&_test=YNtAAwACN0IesgAC
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
Pug
image2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=FFTsTxEC7kgPAbAaEAWlHxVTvk8PBrwYRgdY9rHS
42 B
429 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=FFTsTxEC7kgPAbAaEAWlHxVTvk8PBrwYRgdY9rHS
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug003:0:619
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:06 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=FFTsTxEC7kgPAbAaEAWlHxVTvk8PBrwYRgdY9rHS
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=e70277b2-7d2f-4030-a0fe-2f9c7a8d6236&ssp=pubmatic
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c3a61afa-33d3-45de-9e64-769eb1518c8c&gdpr=&gdpr_consent=&gdpr_pd=
1 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c3a61afa-33d3-45de-9e64-769eb1518c8c&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:12 GMT
cache-control
no-store, no-cache, private
x-lat
amspug017:0:363
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c3a61afa-33d3-45de-9e64-769eb1518c8c&gdpr=&gdpr_consent=&gdpr_pd=
date
Tue, 29 Jun 2021 15:45:13 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
Pug
simage2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3249595990992905771&gdpr=0&gdpr_consent=&us_privacy=
1 B
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3249595990992905771&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:04 GMT
cache-control
no-store, no-cache, private
x-lat
amspug008:0:411
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3249595990992905771&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 29 Jun 2021 15:45:05 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
current
pubmatic-match.dotomi.com/match/bounce/ Frame E328 		0
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=5A172B0A-45DD-4D11-A86B-F32F8222D5B2&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:07 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
Pug
simage2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:965fa246-2b6e-417d-afb5-74bb5c3e0805&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:965fa246-2b6e-417d-afb5-74bb5c3e0805&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
cache-control
no-store, no-cache, private
x-lat
amspug008:0:540
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:965fa246-2b6e-417d-afb5-74bb5c3e0805&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Tue, 29 Jun 2021 15:45:06 GMT
Server
Apache/2.4.41 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
Pug
image2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&gdpr=0&gdpr_consent=
42 B
388 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:08 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug011:0:279
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:08 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3021078908452899730
42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3021078908452899730
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
cache-control
no-store, no-cache, private
x-lat
amspug012:0:278
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:07 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
e8d0c074-0fae-44c8-b5d4-3e007ea9ca46
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3021078908452899730
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4e4ae2d8-3977-45d2-bc80-301eeb069184
42 B
303 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4e4ae2d8-3977-45d2-bc80-301eeb069184
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
cache-control
no-store, no-cache, private
x-lat
amspug003:0:428
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4e4ae2d8-3977-45d2-bc80-301eeb069184
date
Tue, 29 Jun 2021 15:45:06 GMT
p3p
CP="This is not a P3P policy"
server
nginx
timing-allow-origin
*
content-length
0
content-language
en-US
Pug
simage2.pubmatic.com/AdServer/ Frame E328
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=fa790e2a-d8f0-11eb-8bd0-e91864723560&gdpr=0&gdpr_consent=
1 B
216 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=fa790e2a-d8f0-11eb-8bd0-e91864723560&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:05 GMT
cache-control
no-store, no-cache, private
x-lat
amspug008:0:415
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=fa790e2a-d8f0-11eb-8bd0-e91864723560&gdpr=0&gdpr_consent=
Date
Tue, 29 Jun 2021 15:45:06 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
fa790e2c-d8f0-11eb-8bd0-e91864723560
pubads_impl_2021062408.js
securepubads.g.doubleclick.net/gpt/ Frame 61FC 		332 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
sffe /
Resource Hash
f852dfebba4af97add777a1d789b4739164d6cc93aa34db2c463141a5c3f4d09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Jun 2021 17:13:33 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
118414
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:06 GMT
grumi.js
rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/ Frame 61FC 		220 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:9400:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a6cb4b505bc7778b6a6663dc8760fae0496e8acbef3b68f1474c32afa1b2ca8

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:20:23 GMT
content-encoding
br
last-modified
Tue, 29 Jun 2021 14:31:41 GMT
server
AmazonS3
age
1484
etag
W/"88b02e5e3ab1c6f6a0ec72c4287b41cd"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
ycMoN.G.2Cn27pa8Pjb4b5oAScVfjlLN
via
1.1 bf5caee39117de5337c47c748b716e80.cloudfront.net (CloudFront)
cache-control
public,max-age=1800,stale-while-revalidate=3600,immutable,must-revalidate
x-amz-cf-pop
AMS1-C1
content-type
text/javascript
x-amz-cf-id
8tlibMlD1rnQOkQL7QjTPh49WFZyf6BwMi-UhgAbWYO6sO3bgJdLww==
config.json
player.adtelligent.com/exchange_rates/279896/ Frame 61FC 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://player.adtelligent.com/exchange_rates/279896/config.json?cb=https%3A%2F%2Fwww.denverpost.com
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
d0c7f5d86871d6a83af711b37b8fcbe752895fc309c8b26a7f767a727e013809

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
last-modified
Tue, 29 Jun 2021 12:01:05 GMT
server
nginx
etag
W/"60db0b81-863"
content-type
application/json
access-control-allow-origin
https://www.denverpost.com
expires
Tue, 29 Jun 2021 16:45:07 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
grumi.js
rumcdn.geoedge.be/35362513-af22-4abd-a2c3-bcf6c62814c8/ Frame 61FC 		220 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/35362513-af22-4abd-a2c3-bcf6c62814c8/grumi.js
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:9400:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
985af10a3b7cee63295f892d20b10a52ab709500c720cb7550fad4e92264c663

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:20:23 GMT
content-encoding
br
last-modified
Tue, 29 Jun 2021 14:31:01 GMT
server
AmazonS3
age
1485
etag
W/"aa84bbbbafab91fb93350233122b3c9b"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
qEGXYM1WDqiYOl9_ymHwkclTkjm6Fw6N
via
1.1 bf5caee39117de5337c47c748b716e80.cloudfront.net (CloudFront)
cache-control
public,max-age=1800,stale-while-revalidate=3600,immutable,must-revalidate
x-amz-cf-pop
AMS1-C1
content-type
text/javascript
x-amz-cf-id
2v3u3_4rVf_3tFcuCfjFPrJACKJalt16l42Qfh4QySSTqw8n8EXJBA==
sync.html
s.adtelligent.com/ Frame C765 		1 KB
920 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.adtelligent.com/sync.html?aid=572165
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a0c:5c81:5139::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
f7f50ceea4dcad83eea61dff325d95f0b850b87d8624192f5a4e503dfef3ff3c

Request headers

Host
s.adtelligent.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.denverpost.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

Server
VertaMedia 1.0
Date
Tue, 29 Jun 2021 15:45:06 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
634
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Encoding
gzip
/
hb.spotim.market/geo/ Frame 61FC 		132 B
386 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.spotim.market/geo/
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.227.137.155 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
cdb650777343337b6af60839c621a42a4eafe6f55f80188993096aca161ee618

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.denverpost.com
Date
Tue, 29 Jun 2021 15:45:06 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
Content-Length
132
Content-Type
application/json
tracking
hb.spotim.market/adunit/ Frame 61FC 		43 B
289 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.spotim.market/adunit/tracking?event=11&type=0&client_id=270443&site_id=140&full_page_url=https%3A%2F%2Fwww.denverpost.com&adid=i817m2.58&vpbv=0791&lifecycle_tte=1197
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.227.137.155 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://www.denverpost.com
Date
Tue, 29 Jun 2021 15:45:06 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
Content-Length
43
Content-Type
image/gif
j.html
p.zetarail.com/prebidlink/18807/ Frame FDC0 		1 KB
879 B 		Document
General
Check archive.org
Download Go to
Full URL
https://p.zetarail.com/prebidlink/18807/j.html?i=8200
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
cf35c9e8af47d8cd7233bebf1b785af16546782547f31501432cb7ad97d84714

Request headers

:method
GET
:authority
p.zetarail.com
:scheme
https
:path
/prebidlink/18807/j.html?i=8200
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

date
Tue, 29 Jun 2021 15:45:08 GMT
content-type
text/html; charset=utf-8
server
nginx
last-modified
Wed, 16 Sep 2020 14:50:15 GMT
etag
W/"5f622627-434"
cache-control
max-age=3600
content-encoding
gzip
expires
Tue, 29 Jun 2021 16:45:08 GMT
access-control-allow-origin
*
csync
sync.adtelligent.com/ Frame C765
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep...
  • https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
86 B
561 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
Requested by
Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=572165
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Referer
https://s.adtelligent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:09 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
VertaMedia 1.0
Content-Length
86
Content-Type
image/gif

Redirect headers

date
Tue, 29 Jun 2021 15:45:09 GMT
via
1.1 google
server
Jetty(9.4.36.v20210114)
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
alt-svc
clear
content-length
0
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.denverpost.com%2F&domain=www.denverpost.com&cw=1&lsw=1
Protocol
H2
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.denverpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
https://www.denverpost.com
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1553
date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
vary
Accept-Encoding
rtb
trends.revcontent.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://trends.revcontent.com/rtb?apiKey=b7b594eb3a542d84f1718555eb51303d1083ca46&userId=152441
Protocol
H2
Server
52.16.154.221 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-154-221.eu-west-1.compute.amazonaws.com
Software
Grizzly/2.4.4 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.denverpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 29 Jun 2021 15:45:09 GMT
content-type
text/plain
content-length
13
server
Grizzly/2.4.4
allow
POST,OPTIONS
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
sid
mug.criteo.com/ Frame 61FC
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.denverpost.com%2F&domain=www.denverpost.com&cw=1&lsw=1
  • https://mug.criteo.com/sid?cpp=qv_W3nxxU3AySjdQVk85V2s3eGN0NmlYeldYME56dlJlNER1ZDBaem5Dam5NNXM1bUFFVkwraUtnbDVOa0s2YkpJckgrR0lQZGZCRmErMkI5emh4WUZaaGl1MllMTmdTaEg5cU1zWlhCOFdoVWdRK3JXUjdBQTFpTXAvRD...
353 B
607 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=qv_W3nxxU3AySjdQVk85V2s3eGN0NmlYeldYME56dlJlNER1ZDBaem5Dam5NNXM1bUFFVkwraUtnbDVOa0s2YkpJckgrR0lQZGZCRmErMkI5emh4WUZaaGl1MllMTmdTaEg5cU1zWlhCOFdoVWdRK3JXUjdBQTFpTXAvRDFOeTVTVVM3VE1NNmpQQ1c4am9EeTNjckxPeDNtQTNjYnJDWjFMeDNYQkU0d0k4WFIvT0E0SEN1YlNjckNHYjNGNmRBajFWTnJMclVCeFphSUdtOFROTzNaWVFrN0d6NW9yVG1tMDQ3WGU3UW83cExFVTJObGNXbnU1YzJjRU01N3hYT2NRUm9vfA&cppv=2
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
cf56147b84506334bed054904118912183c225d75a6474b0760d6cc38b3a672c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Tue, 29 Jun 2021 15:45:07 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2109
expires
0

Redirect headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Tue, 29 Jun 2021 15:45:07 GMT
location
https://mug.criteo.com/sid?cpp=qv_W3nxxU3AySjdQVk85V2s3eGN0NmlYeldYME56dlJlNER1ZDBaem5Dam5NNXM1bUFFVkwraUtnbDVOa0s2YkpJckgrR0lQZGZCRmErMkI5emh4WUZaaGl1MllMTmdTaEg5cU1zWlhCOFdoVWdRK3JXUjdBQTFpTXAvRDFOeTVTVVM3VE1NNmpQQ1c4am9EeTNjckxPeDNtQTNjYnJDWjFMeDNYQkU0d0k4WFIvT0E0SEN1YlNjckNHYjNGNmRBajFWTnJMclVCeFphSUdtOFROTzNaWVFrN0d6NW9yVG1tMDQ3WGU3UW83cExFVTJObGNXbnU1YzJjRU01N3hYT2NRUm9vfA&cppv=2
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1886
content-length
509
expires
0
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 61FC 		264 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17184&site_id=163630&zone_id=829892&size_id=15&alt_size_ids=16%2C159&rp_schain=1.0,1!spotim.market,sp_sXPv48AD,1,,,&eid_pubcid.org=677ed5d1-04fc-476d-bc53-1794b8d5b7d9%5E1&rf=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&tk_flint=pbjs_lite_v4.41.0-pre&x_source.tid=b61ee907-72fe-4309-a257-980c7042b3dd&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8819673093334166
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
ae48bf3d48283f157ef3bb9c3e76f8d85ea4381a55c9a024430d14030d7a98f0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:07 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.denverpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
264
Expires
Wed, 17 Sep 1975 21:32:10 GMT
bid
ap.lijit.com/rtb/ Frame 61FC 		24 B
759 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.41.0-pre
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx /
Resource Hash
0079d7d5068905b4c64ffafb932caa5798dc9aa3463a75ecedbf361f25dc6d87

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 29 Jun 2021 15:45:08 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap4ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
bidRequest
c2shb.ssp.yahoo.com/ Frame 61FC 		62 B
478 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694c0017474985ad89cda5ed603fd&pos=4850946&cmd=bid&secure=1
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS/7.1.2.128 /
Resource Hash
5e58f37928f661bf35a08caa0252ed9835774184c05d054a46fe55384ed28ad7

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 29 Jun 2021 15:45:08 GMT
Server
ATS/7.1.2.128
Age
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST,GET,HEAD,OPTIONS
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
62
bidRequest
c2shb.ssp.yahoo.com/ Frame 61FC 		62 B
478 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694c0017474985ad89cda5ed603fd&pos=5242527&cmd=bid&secure=1
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS/7.1.2.128 /
Resource Hash
6159947194614c1950bbe297c780cd82e33dc22ee5ed1f2693484f0fcda444d9

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 29 Jun 2021 15:45:09 GMT
Server
ATS/7.1.2.128
Age
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST,GET,HEAD,OPTIONS
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
62
bidRequest
c2shb.ssp.yahoo.com/ Frame 61FC 		62 B
478 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9694c0017474985ad89cda5ed603fd&pos=8a969435017777a74966b045e6a00410&cmd=bid&secure=1
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS/7.1.2.128 /
Resource Hash
d07496ae283d808f356ce506323f23b8944ec2a7ac517599371270214d73f1d6

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 29 Jun 2021 15:45:09 GMT
Server
ATS/7.1.2.128
Age
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST,GET,HEAD,OPTIONS
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
62
/
ghb.adtelligent.com/v2/auction/ Frame 61FC 		459 B
615 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ghb.adtelligent.com/v2/auction/
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
542d494fc08854df823ca5cfb338d6b69f37e63c5a1dedd7b59743953c51217e

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 29 Jun 2021 15:45:08 GMT
Content-Encoding
gzip
Server
VertaMedia 1.0
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Length
322
/
ghb1.adtelligent.com/v2/auction/ Frame 61FC 		121 B
390 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ghb1.adtelligent.com/v2/auction/
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
874d318feda969118c8e56d4cc0941c31068aeaa685e450db23782f345552b7b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.denverpost.com
Date
Tue, 29 Jun 2021 15:45:07 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
Content-Length
121
Content-Type
application/json; charset=UTF-8
v1
hb-api.omnitagjs.com/hb-api/prebid/ Frame 61FC 		0
0
cdb
bidder.criteo.com/ Frame 61FC 		0
191 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.41.0-pre&cb=53992482242
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
bidder.par.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:07 GMT
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Finatra
timing-allow-origin
*
vary
Origin
rtb
trends.revcontent.com/ Frame 61FC 		0
0
prebid
lockerdome.com/ladbid/ Frame 61FC 		11 B
834 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lockerdome.com/ladbid/prebid
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.154.142.214 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
214.142.154.104.bc.googleusercontent.com
Software
/
Resource Hash
846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 29 Jun 2021 15:45:09 GMT
Content-Encoding
gzip
P3P
CP='LockerDome does not have a P3P policy. Learn why here: http://lockerdome.com/p3p'
Access-Control-Allow-Origin
https://www.denverpost.com
Cache-Control
no-cache, max-age=0, must-revalidate, no-store
Access-Control-Allow-Credentials
true
Content-Type
application/json; charset=utf-8
Content-Length
31
bids
prebid-us.creativecdn.com/bidder/prebid/ Frame 61FC 		0
180 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid-us.creativecdn.com/bidder/prebid/bids
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.184.10.30 , Poland, ASN203690 (RTB-HOUSE-ASH, PL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.denverpost.com
date
Tue, 29 Jun 2021 15:45:09 GMT
access-control-allow-credentials
true
access-control-max-age
3600
vary
Origin
access-control-allow-methods
POST
arj
spot-im-d.openx.net/w/1.0/ Frame 61FC 		173 B
478 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://spot-im-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=b61ee907-72fe-4309-a257-980c7042b3dd%2Cb61ee907-72fe-4309-a257-980c7042b3dd%2Cb61ee907-72fe-4309-a257-980c7042b3dd&nocache=1624981507705&pubcid=677ed5d1-04fc-476d-bc53-1794b8d5b7d9&schain=1.0%2C1!spotim.market%2Csp_sXPv48AD%2C1%2C%2C%2C&aus=300x250%2C336x280%2C320x250%7C300x250%2C336x280%2C320x250%7C300x250%2C336x280%2C320x250&divids=div-gpt-ad-1579006100744-0%2Cdiv-gpt-ad-1579006100744-0%2Cdiv-gpt-ad-1579006100744-0&aucs=%2C%2C&auid=540934835%2C541192057%2C543856208
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.209.0 /
Resource Hash
f89595368770542c484dd51b0db3b8272c57c668ee503e60eb95f07b1516ec2b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
server
OXGW/16.209.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.denverpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 61FC 		19 B
851 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:07 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
fae0f933-afd2-4dab-b870-6cb7f3df4318
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.denverpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
htlb.casalemedia.com/ Frame 61FC 		25 B
372 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=356568&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2238f7a6892d6cc9b%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%224.41.0-pre%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22msd%22%3A2%2C%22msi%22%3A2%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22spotim.market%22%2C%22sid%22%3A%22sp_sXPv48AD%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22391584eff7d3c74%22%2C%22ext%22%3A%7B%22siteID%22%3A356568%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A0%7D%7D%2C%7B%22id%22%3A%22409ef6bef9a9526%22%2C%22ext%22%3A%7B%22siteID%22%3A%22494467%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A0%7D%7D%2C%7B%22id%22%3A%22417e5f6dea5af2f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22532859%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A0%7D%7D%2C%7B%22id%22%3A%2242a21988856057b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22581365%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A0%7D%7D%2C%7B%22id%22%3A%22391584eff7d3c74%22%2C%22ext%22%3A%7B%22siteID%22%3A356568%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A0%7D%7D%2C%7B%22id%22%3A%22391584eff7d3c74%22%2C%22ext%22%3A%7B%22siteID%22%3A356568%2C%22sid%22%3A%22320x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A250%2C%22topframe%22%3A0%7D%7D%5D%7D
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-38-181.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
119ac8bf1e0d35d42fb6a0ecc829d049ad5d6047e0378871a5d54fd879daaf18

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[NL], RC:[], CN:[EU], CIP:[159.48.55.7], XFF:[]
server
Apache
vary
Is-Traffic-Invalid,Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.denverpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
45
x-ak-client-geo
12
expires
Tue, 29 Jun 2021 15:45:07 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 61FC 		138 B
971 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
ce4cb6a60aa463697bbcae3d597f7db8e9562ff5846e4535ab1fd4b36f6be3b1
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:07 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
b49d5a94-3bcf-4607-8274-4c5780e74396
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.denverpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=qv_W3nxxU3AySjdQVk85V2s3eGN0NmlYeldYME56dlJlNER1ZDBaem5Dam5NNXM1bUFFVkwraUtnbDVOa0s2YkpJckgrR0lQZGZCRmErMkI5emh4WUZaaGl1MllMTmdTaEg5cU1zWlhCOFdoVWdRK3JXUjdBQTFpTXAvRDFOeTVTVVM3VE1NNmpQQ1c4am9EeTNjckxPeDNtQTNjYnJDWjFMeDNYQkU0d0k4WFIvT0E0SEN1YlNjckNHYjNGNmRBajFWTnJMclVCeFphSUdtOFROTzNaWVFrN0d6NW9yVG1tMDQ3WGU3UW83cExFVTJObGNXbnU1YzJjRU01N3hYT2NRUm9vfA&cppv=2
Protocol
H2
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
null
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
null
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1196
date
Tue, 29 Jun 2021 15:45:07 GMT
content-encoding
gzip
vary
Accept-Encoding
csyncs
hb.spotim.market/ Frame 61FC 		886 B
704 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.spotim.market/csyncs?aid1=537181&aid2=572165&aid3=573838&aid4=605039&aid5=623328
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.227.137.155 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
71b6b6ac60e26eb01b3e6aa32331a5d76b3dc489f00dea6f0b7a2e0fed776fde

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:07 GMT
Content-Encoding
gzip
Server
VertaMedia 1.0
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Length
411
csync
sync.adtelligent.com/ Frame 61FC
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=117&redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309017%26extuid%3D%7BuserId%7D
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D309...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553&partner_url=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep...
  • https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
86 B
561 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:09 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
VertaMedia 1.0
Content-Length
86
Content-Type
image/gif

Redirect headers

date
Tue, 29 Jun 2021 15:45:09 GMT
via
1.1 google
server
Jetty(9.4.36.v20210114)
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://sync.adtelligent.com/csync?t=a&ep=309017&extuid=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
alt-svc
clear
content-length
0
Cookie set csync
sync.adtelligent.com/ Frame 77CC
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=189529&cb=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D323546%26extuid%3D
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D323546%26extuid%3D&s=189529&C=1
  • https://sync.adtelligent.com/csync?t=a&ep=323546&extuid=YNtABxyDNkYfEfFd2h9O.QAA%261131
86 B
540 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.adtelligent.com/csync?t=a&ep=323546&extuid=YNtABxyDNkYfEfFd2h9O.QAA%261131
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Host
sync.adtelligent.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.denverpost.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
vmuid=7c836048bb3c30b4; a323548=3021078908452899730; a309017=10696990-d4f7-4b59-ab7a-3d0260e12e98-60db4004-5553
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

Server
VertaMedia 1.0
Date
Tue, 29 Jun 2021 15:45:11 GMT
Content-Type
image/gif
Content-Length
86
Cache-Control
no-cache, no-store, must-revalidate
Set-Cookie
vmuid=7c836048bb3c30b4; expires=Mon, 30 Aug 2021 15:45:11 GMT; domain=.adtelligent.com; path=/; secure; SameSite=None a323546=YNtABxyDNkYfEfFd2h9O.QAA&1131; expires=Mon, 30 Aug 2021 15:45:11 GMT; domain=.adtelligent.com; path=/; secure; SameSite=None

Redirect headers

Server
Apache
Content-Length
279
Content-Type
text/html; charset=iso-8859-1
Location
https://sync.adtelligent.com/csync?t=a&ep=323546&extuid=YNtABxyDNkYfEfFd2h9O.QAA%261131
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires
Tue, 29 Jun 2021 15:45:11 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:11 GMT
Connection
keep-alive
Set-Cookie
CMID=YNtABxyDNkYfEfFd2h9O.QAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Wed, 29 Jun 2022 15:45:11 GMT CMPS=5191;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Mon, 27 Sep 2021 15:45:11 GMT CMPRO=1131;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Mon, 27 Sep 2021 15:45:11 GMT CMST=YNtAB2DbQAcA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Wed, 30 Jun 2021 15:45:11 GMT
usync.html
eus.rubiconproject.com/ Frame E8AA
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17184-d
  • https://eus.rubiconproject.com/usync.html?p=17184-d
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=17184-d
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-42-132.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.denverpost.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
khaos=KQI817Z1-4-JHRH; rsid=1|GdCqMVQW/e7eWy+6n8k7DE/csJlhJKmtjCZRUZWfOg59q4X5OWrgRtTAOdWE5/rIRx3CvDzGDmXGQhinGXK9BwvuslMKlFofuhUuVZDhR1578z/6X/8LU678VKTcWVuPAdSa+k89aUDxov4=; ses15=; vis15=163630^1; audit=1|hLZGFuTafB0MjeGTsjr0fSeRKmKyZr5v6Mh8xV5EymGEtgZXFiCOBdkHFWgzATdUmwugVScbZlbgcRgjl6EitUxkBIWMWoVW3OlDu/ORdD8=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 23 Feb 2021 20:47:52 GMT
ETag
"402b0-119-5bc0708346e00"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 29 Jun 2021 15:45:09 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=17184-d
Date
Tue, 29 Jun 2021 15:45:09 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
csync
sync.adtelligent.com/ Frame 61FC
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D323548%26extuid%3D%24UID
  • https://sync.adtelligent.com/csync?t=a&ep=323548&extuid=3021078908452899730
86 B
530 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.adtelligent.com/csync?t=a&ep=323548&extuid=3021078908452899730
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:08 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
VertaMedia 1.0
Content-Length
86
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:08 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
f989a82a-93cb-4888-b456-50bd1bf40e87
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://sync.adtelligent.com/csync?t=a&ep=323548&extuid=3021078908452899730
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pbm_307825_8200.js
p.zetarail.com/prebidlink/18807/ Frame FDC0 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/j.html?i=8200
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
ab0d2c967ff2af6ef1612628c5163eb2063cd92c163cd3267acfe44e008eea83

Request headers

Referer
https://p.zetarail.com/prebidlink/18807/j.html?i=8200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:08 GMT
content-encoding
gzip
last-modified
Fri, 25 Jun 2021 14:46:35 GMT
server
nginx
etag
W/"60d5ec4b-88a3"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=3600
expires
Tue, 29 Jun 2021 16:45:08 GMT
tracking
ghb.adtelligent.com/adunit/ Frame FDC0 		43 B
416 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ghb.adtelligent.com/adunit/tracking?pubbid=0&event=11&full_page_url=https%3A%2F%2Fwww.denverpost.com&adid=185dfc04be7336&vpbv=M053&client_id=307825&site_id=8200&lifecycle_tte=1378
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
https://p.zetarail.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
https://p.zetarail.com
Date
Tue, 29 Jun 2021 15:45:08 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
Content-Length
43
Content-Type
image/gif
prebid
ib.adnxs.com/ut/v3/ Frame FDC0 		138 B
967 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
f60a9b89662cd0c3a0269bb4873033bf94478d54a9b0f50012d6f2110f8973ca
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://p.zetarail.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:08 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
40bc0bcf-c213-4683-a009-aa141533418e
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://p.zetarail.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ Frame FDC0 		0
187 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=31&wv=3.22&cb=80937886577
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
bidder.par.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://p.zetarail.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://p.zetarail.com
date
Tue, 29 Jun 2021 15:45:08 GMT
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Finatra
timing-allow-origin
*
vary
Origin
prebid-request
onetag-sys.com/ Frame FDC0 		0
0
hb
ice.360yield.com/ Frame FDC0 		99 B
515 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ice.360yield.com/hb?jsonp=%7B%22bid_request%22%3A%7B%22secure%22%3A1%2C%22id%22%3A%2215113f8b4375827%22%2C%22version%22%3A%226.1.0-JS-6.3.0%22%2C%22referrer%22%3A%22https%3A%2F%2Fwww.denverpost.com%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221480220608fcc71%22%2C%22currency%22%3A%22USD%22%2C%22pid%22%3A22386767%2C%22tid%22%3A%221330a71415107b4%22%2C%22banner%22%3A%7B%7D%7D%5D%7D%7D
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.57.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
3f8637ac65cdc773a52c1b9bbc4a98a1259c0a50e2684081fdbed0a99c07d6b6

Request headers

Referer
https://p.zetarail.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
https://p.zetarail.com
date
Tue, 29 Jun 2021 15:45:09 GMT
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
content-length
99
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
bids
prebid-eu.creativecdn.com/bidder/prebid/ Frame FDC0 		0
0
multitracking
hb.spotim.market/adunit/ Frame 61FC 		0
209 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.spotim.market/adunit/multitracking
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.227.137.155 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.denverpost.com
Date
Tue, 29 Jun 2021 15:45:07 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
usync.js
eus.rubiconproject.com/ Frame E8AA 		31 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-42-132.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
ad7f5d82e23fafe6f8edb75b2568d4b145bf6a4525cbe2eeb4b30b9f0db74795

Request headers

Referer
https://eus.rubiconproject.com/usync.html?p=17184-d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:09 GMT
Content-Encoding
gzip
Last-Modified
Mon, 14 Jun 2021 16:13:39 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=58810
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9274
Expires
Wed, 30 Jun 2021 08:05:19 GMT
sync.php
pixel.rubiconproject.com/exchange/ Frame E8AA 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=17184-d
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type
image/gif
index.js
d1wa9546y9kg0n.cloudfront.net/ 		6 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d1wa9546y9kg0n.cloudfront.net/index.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.84.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8431f4973d02bcceeadba217953b9a058dad0b1d958f9ba25f9fccfe95d7ae42

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 00:55:16 GMT
Via
1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
Last-Modified
Tue, 23 Feb 2016 09:35:10 GMT
Server
AmazonS3
Age
53692
ETag
"cf67eb51479caf3b57c3577a08b6a038"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Connection
keep-alive
X-Amz-Cf-Pop
AMS1-C1
Accept-Ranges
bytes
Content-Length
6494
X-Amz-Cf-Id
5AUmLNHur5IWKLPGRT0VHD0wOcU8r5tg7619ZUveTOv9J_T77ZofVA==
rubicon
match.adsrvr.org/track/cmf/ Frame E8AA 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.242.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:09 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame E8AA
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FJODE3WjEtNC1KSFJI
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FJODE3WjEtNC1KSFJI
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:10 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1FJODE3WjEtNC1KSFJI
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame E8AA
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjRiMTAxOTI1Zjg0MDdlYzc4MzkyMzgxZjI2NTk5ZDY4MTAyNGZhMA
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjRiMTAxOTI1Zjg0MDdlYzc4MzkyMzgxZjI2NTk5ZDY4MTAyNGZhMA
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:10 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjRiMTAxOTI1Zjg0MDdlYzc4MzkyMzgxZjI2NTk5ZDY4MTAyNGZhMA
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame E8AA
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/8IYibNKj75tb1Gg1vr2uVg?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2512432862959234791
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2512432862959234791
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type
image/gif

Redirect headers

date
Tue, 29 Jun 2021 15:45:10 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2512432862959234791
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame E8AA
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=16f260db-4005-4f00-afe6-d20f581f7d3a
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=16f260db-4005-4f00-afe6-d20f581f7d3a
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type
image/gif

Redirect headers

Date
Tue, 29 Jun 2021 15:47:41 GMT
Server
MT3 3799 851f7e8 master cdg-pixel-x11
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=16f260db-4005-4f00-afe6-d20f581f7d3a
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 29 Jun 2021 15:47:40 GMT
v1
ads.yahoo.com/cms/ Frame E8AA
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KQI817Z1-4-JHRH&sigv=1&esig=2~ba879af882017bb2b8e029455ac61d3aa09f4a0e
0
445 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KQI817Z1-4-JHRH&sigv=1&esig=2~ba879af882017bb2b8e029455ac61d3aa09f4a0e
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:10 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KQI817Z1-4-JHRH&sigv=1&esig=2~ba879af882017bb2b8e029455ac61d3aa09f4a0e
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
sync.php
pixel.rubiconproject.com/exchange/ Frame E8AA 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type
image/gif
tap.php
pixel.rubiconproject.com/ Frame E8AA
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELNUZ1YyiYa0fDmdEBJzTFg&google_cver=1
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELNUZ1YyiYa0fDmdEBJzTFg&google_cver=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17184-d
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:09 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELNUZ1YyiYa0fDmdEBJzTFg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
mut
ghb.adtelligent.com/adunit/ Frame FDC0 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ghb.adtelligent.com/adunit/mut
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://p.zetarail.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://p.zetarail.com
Date
Tue, 29 Jun 2021 15:45:09 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
integrator.js
adservice.google.nl/adsid/ Frame 61FC 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.nl/adsid/integrator.js?domain=www.denverpost.com
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 61FC 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 61FC 		86 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3490867613922114&correlator=1661675418201196&output=ldjh&impl=fifs&eid=31061649%2C21068110%2C31061329%2C31061499%2C44740386&vrg=2021062408&ptt=17&sc=1&sfv=1-0-38&ecs=20210629&iu_parts=39694909%2CReactions%2CReact-DenverPost&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C336x280%7C320x250&prev_scp=reactionsSpotId%3Dsp_sXPv48AD%26source_version%3Dv17.2.1%26topSpotId%3Dsp_sXPv48AD%26source%3Dreactions%26pageViewId%3D5ca5cd9a-2978-4df7-9f9c-9477f64943bf%26isStandaloneAdUnit%3Dtrue%26excl_cat%3DPREPOST&eri=5&cookie_enabled=1&cdm=www.denverpost.com&bc=31&abxe=1&dt=1624981509703&dlt=1624981506097&idt=143&ea=0&frm=23&biw=1600&bih=1200&isw=336&ish=280&oid=3&adxs=160&adys=3613&adks=4013319095&ucis=cswq3i26e7zx&ifi=1&ifk=1633335050&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=www.denverpost.com&loc=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&top=www.denverpost.com&vis=1&dmc=8&scr_x=0&scr_y=0&psz=336x280&msz=336x0&ga_vid=1188237042.1624981510&ga_sid=1624981510&ga_hid=625540733&ga_fc=false&fws=260&ohw=336&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
0e4724ebd008a3450c12fadd809e7c7ca440c98eb6cb30cb38e8ad5125243ae8
Security Headers
Name Value
Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP6Rn-2XvfECFRiIdwodMIwA_w&gqi=&layout=/sadbundle/%24csp%253Der3%24/9167489660878128863/index.html
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP6Rn-2XvfECFRiIdwodMIwA_w&gqi=&layout=/sadbundle/%24csp%253Der3%24/9167489660878128863/index.html
content-encoding
br
x-content-type-options
nosniff
google-creative-id
-1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28454
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
date
Tue, 29 Jun 2021 15:45:10 GMT
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 61FC 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
publishertag.prebid.js
static.criteo.net/js/ld/ Frame 61FC 		83 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a98e1f08dd27c121a337ddc31691d4044f56ae83301b574728548b78d3068d3b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:09 GMT
content-encoding
gzip
last-modified
Wed, 02 Jun 2021 14:09:58 GMT
server
nginx
etag
W/"60b79136-14aab"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 30 Jun 2021 15:45:09 GMT
publishertag.prebid.js
static.criteo.net/js/ld/ Frame 61FC 		83 KB
27 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a98e1f08dd27c121a337ddc31691d4044f56ae83301b574728548b78d3068d3b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:09 GMT
content-encoding
gzip
last-modified
Wed, 02 Jun 2021 14:09:58 GMT
server
nginx
etag
W/"60b79136-14aab"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 30 Jun 2021 15:45:09 GMT
container.html
de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0A98 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html?n=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Tue, 29 Jun 2021 15:45:09 GMT
expires
Wed, 29 Jun 2022 15:45:09 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/ Frame 61FC 		72 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
29d592e34e3d2c8ca0c55ceafd75940de79cdb6381d8ceb372d226e7820e7220
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:10 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1624879999447392"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27719
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:10 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 61FC 		11 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021062408&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b199065402b7ccacd72e19aef59f05e17240180a129632042df47748417e60ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8470
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 61FC 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:10 GMT
grumi.js
rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/ Frame 0A98 		220 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:9400:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a6cb4b505bc7778b6a6663dc8760fae0496e8acbef3b68f1474c32afa1b2ca8

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:20:23 GMT
content-encoding
br
last-modified
Tue, 29 Jun 2021 14:31:41 GMT
server
AmazonS3
age
1488
etag
W/"88b02e5e3ab1c6f6a0ec72c4287b41cd"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
ycMoN.G.2Cn27pa8Pjb4b5oAScVfjlLN
via
1.1 bf5caee39117de5337c47c748b716e80.cloudfront.net (CloudFront)
cache-control
public,max-age=1800,stale-while-revalidate=3600,immutable,must-revalidate
x-amz-cf-pop
AMS1-C1
content-type
text/javascript
x-amz-cf-id
CM56TVizse9eCJRAQyoEG9KpN6cUQ1lNXurr8trSAu6OGbI8lzUOuQ==
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame F56E 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/224/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5029
date
Tue, 29 Jun 2021 15:34:48 GMT
expires
Wed, 29 Jun 2022 15:34:48 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
622
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 9CA2 		783 B
812 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
b72dd2a1b8aec291a94aa69116646c1b487ba64688a769a0f39423328c96d48f
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-hGBeWpsm8ChYgtT1P95z/Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

expires
Tue, 29 Jun 2021 15:45:10 GMT
date
Tue, 29 Jun 2021 15:45:10 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-hGBeWpsm8ChYgtT1P95z/Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
513
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js
pagead2.googlesyndication.com/bg/ Frame F56E 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
986cc890ff4c6e29618576b21fee055d58f91ed87402e7344453fc39dd5465bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 13:01:14 GMT
content-encoding
br
x-content-type-options
nosniff
age
9836
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5744
x-xss-protection
0
last-modified
Tue, 22 Jun 2021 16:28:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 29 Jun 2022 13:01:14 GMT
init
gw.geoedge.be/api/ Frame 0A98 		0
267 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gw.geoedge.be/api/init
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:7600:10:43f:4340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Tue, 29 Jun 2021 15:45:10 GMT
via
1.1 f54d9ad301a95e7dcfde675e1cd5ba89.cloudfront.net (CloudFront)
server
nginx/1.10.3 (Ubuntu)
x-amz-cf-pop
AMS1-C1
x-powered-by
Express
x-cache
Miss from cloudfront
access-control-allow-origin
*
content-length
0
x-amz-cf-id
1hzqRthxH5BqKNMn1BRA46FqoNnMPTrztL7-Iy81d2lfTQua79APAA==
index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/ Frame 6F93 		19 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de489e9461297aa0072801fb77f5a6a0692090cbb3ca16be893c1abba2230848
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sadbundle/$csp%3Der3$/9167489660878128863/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-type
text/html
access-control-allow-origin
*
content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
date
Mon, 28 Jun 2021 15:11:55 GMT
expires
Tue, 28 Jun 2022 15:11:55 GMT
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
x-content-type-options
nosniff
x-dns-prefetch-control
off
content-encoding
gzip
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
content-length
3920
age
88395
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
adview
securepubads.g.doubleclick.net/pagead/ Frame 0A98 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CO5r1BUDbYL77LZiQ3gOwmIL4D7n75PBen77_hvUNwYTA_PoBEAEghczmMWCRhICA7BegAfLbn-EDyAEJqQKL6noP4vqzPuACAKgDAcgDCKoE7QFP0K_UaIt523tQbqx8yFQtzZ5ZlWU_l-85H9kwdcUW4vF3E4649omIsx3_-3xVcn0dg1G_9d0P1n0HNCY7B9jNNgrzVbIJvlskbMjgkBuQMkx3EVMOFY1mHbLUw_NVloTN9vhGY0GjM0T7oe7_tjYCVT2QWOb8CoVb-CnAJ10n0c_UDFaX3rG44IDDjGRBu9-dqfukwOiG6tT6YXOqWH2cU48BukvvWLRkplvYuzv9CxSvkdajLdXeeh9CKtZpzaBQIOf_g-9Vn7ZKh2lUlZIQfu-SuHBbtuWoKDXVsainihAL1SnwngSSqdzinPTABIPJtpvTAuAEAZIFBAgEGAGSBQQIBRgEoAYugAf2o-AeqAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEOidBdIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTU3NTg3MzMzNzA4NTEzNoAKA8gLAdgTDdAVAZgWAYAXAbIXGgoYCAASFHB1Yi01NjE2MDQ2MTg3NTQ1MDE5&sigh=-bvnDhQwsLo&template_id=419
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
/
Resource Hash

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 0A98 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:42:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
159
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7112
x-xss-protection
0
server
cafe
etag
12276874145846594193
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:42:31 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 0A98 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:44:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
60
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:44:10 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0A98 		125 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2f5a99d439c1d7bc8cd4e02f39d77d0dab1eba4e1fae40d3fc5d06ac3aaf1ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:10 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1624879993577808"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38803
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:10 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 0A98 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
400
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6207
x-xss-protection
0
server
cafe
etag
17140096307539089235
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 13 Jul 2021 15:38:30 GMT
l
www.google.com/ads/measurement/ Frame 0A98 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQfLgrrHvSlLnR2hYHG0ThXjr6eYdIGGQ5YZNE9alYp08mJh0evzvs2KNCh6fBtr-VEGy3t4rucjQRVIGjDrCbZ9GF4cw
Requested by
Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
s
googleads.g.doubleclick.net/pagead/drt/ Frame 8462 		143 B
253 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com
URL: https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUnJJYYKpZvGz103cdxIgawoDAunBQXzyD9b5lUEndS79whQUEfffMC41eDVwDc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 29 Jun 2021 15:09:03 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
2167
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 6F93 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 28 Jun 2021 16:31:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
83627
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3271
x-xss-protection
0
server
cafe
etag
7483759447172721109
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Tue, 29 Jun 2021 16:31:23 GMT
addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 6F93 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 28 Jun 2021 20:19:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69912
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10382
x-xss-protection
0
server
cafe
etag
12806417668659483808
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Tue, 29 Jun 2021 20:19:58 GMT
ce61deba574f307c2f9a94d50212da4b.js
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/ Frame 6F93 		61 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/ce61deba574f307c2f9a94d50212da4b.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d74df69f52e621ac02e6986f9e8bfe89a7fadc52160200518842b448f589e4b6
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16635
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
truncated
/ Frame 0A98 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44fa5687b6c8cf14dad1d8106f4d4cbc29a6b13d3add1c17556051dfbdde5b51

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
6f8a4cebe86f39b0228e0546b4548898.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/6f8a4cebe86f39b0228e0546b4548898.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85a1ccc99157ff4a59ee46bcf2cbec92fe69a7cd050ba3099dcdb00a7c925c06
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6314
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
40b7ce48f5643b3c7e8c96dae715d877.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/40b7ce48f5643b3c7e8c96dae715d877.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e2568260d189ed6c4fedd510b1fae6819fed64cd981f581258e22a105bf5f87
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7425
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
b2d7c77acdd2ac15b0d4a87c9d81a1e2.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/b2d7c77acdd2ac15b0d4a87c9d81a1e2.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8e42b47eee47c94ec277021f076224c9deeaac56087020545127f19041bbdb26
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7662
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
75d621c147442ce4e13fc0650a2f2ae7.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/75d621c147442ce4e13fc0650a2f2ae7.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4605120fc8858f4c81bcb9392f416afa72d6db32137c94dfa6c394fffc61dab4
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8328
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
ccdd0d58477f1de3b7f1f4347acdde22.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ccdd0d58477f1de3b7f1f4347acdde22.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2611383a900389cfd82c89f624017b9807815a4e63c4b09b34451904414bee04
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7776
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
a8deb8ce7e2ae9b8c2e0579c758f91bc.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/a8deb8ce7e2ae9b8c2e0579c758f91bc.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e5f43fdc1b9ebd24cfa16326faad0819d6d8382c894b2f7a789918a94c3cdc98
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8088
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
53c3b79297cf005809cc7b54c76976a8.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/53c3b79297cf005809cc7b54c76976a8.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
030363b9252adae45e8afd43858b6f59c4a8e092f875bd7104cfec2b3d39a74c
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1833
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
ee61dae2c3315e7bfa00f3e5f3f3ca5c.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ee61dae2c3315e7bfa00f3e5f3f3ca5c.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e905c9ad3c68e274a124f3be01bf19afa003d3112fbce01966ab6e293213e6af
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2776
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
a61e635e0ba7a98cd8169b9622c3df85.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/a61e635e0ba7a98cd8169b9622c3df85.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7202890bca8d1fa4bb1440b9e3776bf9e29721eb4e7be8625c5889b910517f7f
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3282
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
5594ac884bffea796cc881c3c6a42be7.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/5594ac884bffea796cc881c3c6a42be7.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e6919b568b4f481609c00116c7573db1a1606dc050307b4067bd0f23aa04e6e0
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1709
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
0deb152b319350f81c254f5ab1b93412.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/ Frame 6F93 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/media/0deb152b319350f81c254f5ab1b93412.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/9167489660878128863/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6177e9b854ee61c4bc3327a2989cd42ea3c25885793bf51d751a75ac12002308
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
92952
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1620
x-xss-protection
0
last-modified
Mon, 28 Jun 2021 09:23:48 GMT
server
sffe
date
Mon, 28 Jun 2021 13:55:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jun 2022 13:55:58 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 8462
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com
URL: https://de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUnJJYYKpZvGz103cdxIgawoDAunBQXzyD9b5lUEndS79whQUEfffMC41eDVwDc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Tue, 29 Jun 2021 15:45:10 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Tue, 29-Jun-2021 16:45:10 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Tue, 29 Jun 2021 15:45:10 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Tue, 29 Jun 2021 15:45:10 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
v3_270443_140.json
player.spotim.market/prebidlink/2708302/ Frame 61FC 		149 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://player.spotim.market/prebidlink/2708302/v3_270443_140.json?cb=www.denverpost.com
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.1 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
320273751b6b32f291ce255d87b998f4db7fa6707576058570a3125b92ccdb0c

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:10 GMT
content-encoding
gzip
last-modified
Fri, 25 Jun 2021 14:39:23 GMT
server
nginx
etag
W/"60d5ea9b-254d7"
content-type
application/json
access-control-allow-origin
https://www.denverpost.com
expires
Tue, 29 Jun 2021 16:45:10 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 61FC 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021062408&jk=3490867613922114&bg=!RUalRgLNAAYo4NJEKOA7ACkAdvg8WoztrRa7wdFR_yOEmt-15dPGzx_jfXM4jfbfr5hXh-TO3V8a7gIAAAB5UgAAAA1oAQeZAove1VHOf1k4ns3n3V6kjsLkzxuvKZoK1UqopKer-lDM67mLMffpZczjoxYo0cb3s88HbgaM0fmFEwREximSemKwY1bH6vlVMMt8-gPt_3ZlBKnVMr7Ji1XvThZA1RDx4_YW7IVByQMJySeBSXUE2sQHWMf7wDNA8yrDJ-hwRSjuwIVewqJ2zDTJkvMRkDTj7RiWU-SiNrNzydNjSKVUVp38IfBSfYSnI7dt5PZPWkgZjL1IvP89N0AMFkyuqo7eoEena-aMWFDXy_4hSR9LRw36vd65TdFy89kLScF47pVGz_hCHI86sxiM3po9y7XV_IT9y4JIi8xGUFzvW5rSiQcrinfPcV0C25rj-P_gtl6JtcBMitM_vsU2ORqNnJAyszLl4xMzPWP8BU787NDFl314bPMNSkDJYa9U6GH0SCPxaJAYeOiEPRPFJLbT6oOkc-Q9u9XzPTCllQQAHHC-jWUreeTbtxcQllmylQC_k4KWGC2IYS2eMsLE0smnko3_ckAIqv33a61YTIJHyFoM95d-Zp4_qC4goE4qqzgy_P1kleAjl5UHuyb3LODyWHei77VmTRXIEFeJpAWd4kpXmtfY4U_7eXITKxSm4rkmU9MmiH2Wm73TNL931gv-bNXL2bo9OGmNnUdb_yauZ8m9S0qC4ih2t-5G4HeNFbdtYG6LHYVTXTu1Ni-_RpvUGAPMg7QGbBOLTTPIWL72qqKVUcJ7LWtyaZTAOKUW3d_M9_ID1uPA4xGKNYHvQv0OtDRj-DoOuoJMz9fRSJdparJPk2XI56hKRzdQAWig7dZYnfYUa7GGcRp9ViwZAyvwlsXkuQFbf0zPVVMpUlZBHHsMj4gTA3jgf3rcd5zTKHo
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:10 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 0004 		995 B
875 B 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
8730c26defc411dd8a51f1da47e5ae3804fab6868f7914a26b09d8e0791bbe39

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://p.zetarail.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
uuid2=3021078908452899730
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://p.zetarail.com/

Response headers

Server
nginx/1.13.10
Last-Modified
Fri, 20 May 2016 02:07:09 GMT
ETag
"573e714d-3e3"
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
506
Cache-Control
max-age=31536000
Expires
Wed, 29 Jun 2022 15:45:10 GMT
Date
Tue, 29 Jun 2021 15:45:10 GMT
Connection
keep-alive
Vary
Accept-Encoding
multitracking
hb.spotim.market/adunit/ Frame 61FC 		0
209 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.spotim.market/adunit/multitracking
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/wrapper_hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
23.227.137.155 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://www.denverpost.com
Date
Tue, 29 Jun 2021 15:45:09 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
async_usersync
secure.adnxs.com/ Frame 0004 		0
727 B 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/async_usersync?cbfn=AN_async_load
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:10 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
97db8cb9-a1cd-4226-8432-5c0b3d833a05
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
mut
ghb.adtelligent.com/adunit/ Frame FDC0 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ghb.adtelligent.com/adunit/mut
Requested by
Host: p.zetarail.com
URL: https://p.zetarail.com/prebidlink/18807/pbm_307825_8200.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software
VertaMedia 1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://p.zetarail.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://p.zetarail.com
Date
Tue, 29 Jun 2021 15:45:11 GMT
Access-Control-Allow-Credentials
true
Server
VertaMedia 1.0
Connection
Keep-Alive
692.json
id5-sync.com/g/v2/ Frame 61FC 		9 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/692.json
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
152.228.227.57 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
2eebc868b8b516022cbf617417ec6c8db124029866061123a635488c2e43e863
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 29 Jun 2021 15:45:12 GMT
Vary
Origin
Content-Language
en-US
Access-Control-Allow-Origin
https://www.denverpost.com
Access-Control-Allow-Credentials
true
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
text/html;charset=UTF-8
Transfer-Encoding
chunked
rid
match.adsrvr.org/track/ Frame 61FC 		109 B
545 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=1qnzqyj&fmt=json
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.242.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
600987de56aa0f0934587f3c7560cf0a398a0b63b904d13698321668b762dbee

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 29 Jun 2021 15:45:12 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.denverpost.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Thu, 29 Jul 2021 15:45:12 GMT
envelope
api.rlcdn.com/api/identity/ Frame 61FC 		44 B
110 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=1432
Requested by
Host: player.spotim.market
URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.133.55 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 29 Jun 2021 15:45:12 GMT
via
1.1 google
x-content-type-options
nosniff
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods
GET, OPTIONS
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.denverpost.com
access-control-allow-credentials
true
alt-svc
clear
content-length
44
pixels
pix.spot.im/api/v1/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://pix.spot.im/api/v1/pixels
Requested by
Host: launcher.spot.im
URL: https://launcher.spot.im/spot/sp_sXPv48AD
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.165 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pe&tv=js-3.0.112&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&tzoff=-120&lang=en-US&cs=UTF-8&navt=link&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tvltm=14&tvcfg=wp&f_privb=0&tid=b6bafffe-0c81-4fbc-a5a0-d06117d82918&pid=33464a6f-95ff-4a78-9792-73515d43784b&dtm=1624981514813&qnm=_matherq&visible=1&tabid=921ec3cb-c366-46a5-b407-78177a668725&url=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&vp=1600x1200&ds=1600x5190&tofa=1624981515&vid=1&lvidt=1624981515&duid=543e8a8eb2bba5bf&fp=1072425006&cid=ma23578&mrk=239876503&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTYyNDk4MTUwMDc4NCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxMG1iIiwiaGVhcFQiOiIxMG1iIiwiZnN0UGFpbnQiOiIxNDYyIiwiZmV0Y2hTIjoiMCIsImRvbWFpblMiOiIxIiwiZG9tYWluRSI6IjIiLCJjb25uUyI6IjIiLCJjb25uRSI6IjQ5Iiwic3NsUyI6IjIyIiwicmVxdVMiOiI1MCIsInJlc3BTIjoiNDE1IiwicmVzcEUiOiI2NDIiLCJkb21Mb2FkIjoiNDE5IiwiZG9tSW50ZXIiOiIxNTgxIiwiZG9tTG9hZFMiOiIxNjA0IiwiZG9tTG9hZEUiOiIxNjA4In19
Requested by
Host: www.denverpost.com
URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.210.103 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:14 GMT
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length
43
Content-Type
image/gif
syncframe
gum.criteo.com/ Frame 6B52 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.denverpost.com
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
7512ae62108af074eaa90622e9df04625f120ecf4a909443fa6dc1a2b071c7a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

:method
GET
:authority
gum.criteo.com
:scheme
https
:path
/syncframe?origin=publishertag&topUrl=www.denverpost.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

cache-control
private, max-age=0
content-type
text/html; charset=utf-8
content-encoding
gzip
vary
Accept-Encoding
strict-transport-security
max-age=31536000
cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
server-processing-duration-in-ticks
2049
set-cookie
uid=72ec13c8-d615-476a-a6d8-d3a0efcd627f; expires=Wed, 29 Jun 2022 15:45:17 GMT; domain=.criteo.com; path=/; secure; samesite=none
date
Tue, 29 Jun 2021 15:45:17 GMT
content-length
1129
sync
eb2.3lift.com/ Frame 093B
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: ib.3lift.com
URL: https://ib.3lift.com/sync.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.169.15 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d144021a128bc51c9239911a84cdad31f1fdf9071a08736bfb762227e53ee35

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
tluid=824509530055284037
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

date
Tue, 29 Jun 2021 15:45:18 GMT
content-type
text/html; charset=utf-8
content-length
476
set-cookie
sync=CgoIgQIQ7_HIw6UvCgoIkQIQ7_HIw6UvCgoI4gEQ7_HIw6UvCgoIkgIQ7_HIw6UvCgoI5gEQ7_HIw6UvCgoIhwIQ7_HIw6UvCgkIOhDv8cjDpS8KCQgLEO_xyMOlLwoJCF8Q7_HIw6UvCgkIHxDv8cjDpS8=; Max-Age=7776000; Expires=Mon, 27 Sep 2021 15:45:18 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=824509530055284037; Max-Age=7776000; Expires=Mon, 27 Sep 2021 15:45:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

date
Tue, 29 Jun 2021 15:45:18 GMT
content-length
0
set-cookie
tluid=824509530055284037; Max-Age=7776000; Expires=Mon, 27 Sep 2021 15:45:18 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sodar
pagead2.googlesyndication.com/getconfig/ 		11 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021062408&st=env
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f7f5ba86b5028a3a5a6e4f3f3fe7e58b642a6a3cf802680d898077333cc6fd3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 29 Jun 2021 15:45:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8379
x-xss-protection
0
track
dc.services.visualstudio.com/v2/ 		223 B
340 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
79D1ECB9-207D-4554-8979-0ED8630AF49E
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Tue, 29 Jun 2021 15:45:18 GMT
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
content-length
223
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021062408.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
expires
Tue, 29 Jun 2021 15:45:18 GMT
cs.js
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain
  • https://sb.scorecardresearch.com/c2/6035443/cs.js
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
0
350 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/internal-c2/default/cs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.77.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:28:20 GMT
via
1.1 8e4700eb43d0f5579f360cfc02e71fad.cloudfront.net (CloudFront)
etag
"d41d8cd98f00b204e9800998ecf8427e"
last-modified
Mon, 01 Mar 2021 20:42:20 GMT
server
AmazonS3
age
1019
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-pop
AMS1-C1
accept-ranges
bytes
content-length
0
x-amz-cf-id
ZEBBQKiRieSXdDAKS4m1XOTB-FHkHsQoT1Yc0J7PMgK0NkIjwCl4yA==

Redirect headers

date
Tue, 29 Jun 2021 15:45:18 GMT
via
1.1 8e4700eb43d0f5579f360cfc02e71fad.cloudfront.net (CloudFront)
x-amz-cf-pop
AMS1-C1
vary
Accept
x-cache
Miss from cloudfront
content-type
text/plain; charset=utf-8
location
/internal-c2/default/cs.js
content-length
48
x-amz-cf-id
T7zbrd_PCW7iNvbVoO2LO3HcmhVZjdWzsMpjYKoThHNi97LGwWZSxQ==
collect
www.google-analytics.com/j/ 		2 B
209 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j91&a=450566955&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&dr=&dp=%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ul=en-us&de=UTF-8&dt=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article%20Scroll%20Tracking&ea=0%25&el=%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&_u=aGjACEAjBAAAAC~&jid=1815394324&gjid=332306252&cid=1143692882.1624981503&tid=UA-61435456-7&_gid=1358882759.1624981518&_r=1&gtm=2wg6n0TLFP4R&cd2=denverpost.com&cd3=denverpost.com&cd4=&cd5=2021-06-22T06%3A00%3A24-06%3A00&cd6=2021-06-22T06%3A00%3A24-06%3A00&cd7=2021-06-21T18%3A25%3A28-06%3A00&cd9=no&cd10=Business&cd11=5.7.2&cd12=&cd13=WP&cd14=Business&cd15=Business&cd16=&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd22=colorado-unemployment-fraud-phishing&cd23=4614849&cd24=article&cd25=DENVER&cd26=Aldo%20Svaldi&cd27=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&cd28=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd29=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=Denver&cd34=true&cd35=&cd36=2542&cd37=420&cd38=Aldo%20Svaldi&cd49=true&cd50=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&cd51=&cd54=asvaldi%40denverpost.com&cd55=The%20Denver%20Post&cd125=8b00c746-e983-4052-a01c-366c4ab7697f&cd126=PERSONAL&cd127=Engagement%20Score%3A%7C%5BBC%20Dev%5D%20Unknown%20last%20visit%20%3E180%20days%7CBANG%20prop%20score%20js%20segment%7CAllvisitorslast7%7CMNG%20Nonsub%20Unknown%7CVariants%20Viewed%20Distribution%7C%5BBC%20Dev%5D%20Anonymous%20Profiles%7CDP%20Non-Subscribers%7Cextras.mercurynews%20non-subscribers%7CBANG%20Non-Subscribers%7CVisitors%20not%20in%20segment%20%22bv%20data%20exports%22%7C%5BBlueConic%20Dev%5D%20Anonymous%20Profiles%20not%20modified%20in%20last%20365%20days%7CVisitors%20not%20in%20segment%20%22BANG%20confirmation%20number%20true%22%7ClastModified_s3bucketDelta%7CVisitors%20not%20in%20segment%20%22BDC_checkout_abandoners%22%7CAll%20Visitors%7CTwin%20Cities%20Non-Subscribers%7C%5BBC%20DEV%5D%20BlueConic%20Test%20User&cd129=0&cd135=low&cd136=0&cd137=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd138=1624981501955&cd139=1624981502860&cd145=web&cd146=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd147=www.denverpost.com&cd151=1&cd152=denverpostfunnel%20%3A%20started%20at%20%27All%20site%20visitors%27&cd154=1624981502849&cd162=DP%20-%20live%20-%20all%20article%20fixes%20%2F%20Variant%20A&cd53=1143692882.1624981503&z=2037169866
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
111 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
6852bd0b.akstat.io/ 		0
359 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://6852bd0b.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/TWTC4-NWJAU-FVVAU-VQNPU-LATGK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:2b9::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:18 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.denverpost.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Tue, 29 Jun 2021 15:45:18 GMT
track
dc.services.visualstudio.com/v2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Server
13.69.106.215 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,sdk-context
Origin
https://www.denverpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-methods
POST
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin
*
access-control-max-age
3600
x-content-type-options
nosniff
date
Tue, 29 Jun 2021 15:45:18 GMT
content-length
0
collect
stats.g.doubleclick.net/j/ 		4 B
70 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=1815394324&gjid=332306252&_gid=1358882759.1624981518&_u=aGjACEAjBAAAAC~&z=1510001739
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 29 Jun 2021 15:45:18 GMT
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame F2F8 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/224/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5029
date
Tue, 29 Jun 2021 15:34:48 GMT
expires
Wed, 29 Jun 2022 15:34:48 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
630
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 56DE 		783 B
758 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
5ead8a9d3886a9f702b4606eb13288e6d4ffe83670103006593cb1160c4ef1f3
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-2M7Ot/CnMQq9jC7KWJQ8aQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.denverpost.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.denverpost.com/

Response headers

expires
Tue, 29 Jun 2021 15:45:18 GMT
date
Tue, 29 Jun 2021 15:45:18 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-2M7Ot/CnMQq9jC7KWJQ8aQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
513
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js
pagead2.googlesyndication.com/bg/ Frame F2F8 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
986cc890ff4c6e29618576b21fee055d58f91ed87402e7344453fc39dd5465bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 13:01:14 GMT
content-encoding
br
x-content-type-options
nosniff
age
9844
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5744
x-xss-protection
0
last-modified
Tue, 22 Jun 2021 16:28:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 29 Jun 2022 13:01:14 GMT
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=1815394324&_u=aGjACEAjBAAAAC~&z=899565816
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=1815394324&_u=aGjACEAjBAAAAC~&z=899565816
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
generic
match.adsrvr.org/track/cmf/ Frame 093B 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.242.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
xuid
eb2.3lift.com/ Frame 093B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm=&google_sc=&gdpr=1&gdpr_consent=&google_tc=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELRFDC1-OWTsK_eYVEfvP6w&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
37 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELRFDC1-OWTsK_eYVEfvP6w&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.169.15 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:18 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELRFDC1-OWTsK_eYVEfvP6w&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 093B
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODI0NTA5NTMwMDU1Mjg0MDM3
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODI0NTA5NTMwMDU1Mjg0MDM3
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODI0NTA5NTMwMDU1Mjg0MDM3
date
Tue, 29 Jun 2021 15:45:18 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
c.gif
c.bing.com/ Frame 093B 		42 B
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=824509530055284037&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:17 GMT
etag
"506f5bd17ad71:0"
last-modified
Tue, 23 Feb 2021 19:11:50 GMT
x-msedge-ref
Ref A: 683D9670F1F9417484169998F50F5B36 Ref B: FRAEDGE1311 Ref C: 2021-06-29T15:45:18Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
xuid
eb2.3lift.com/ Frame 093B
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/824509530055284037?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-gZIeu8FE2oQ.tttiNCnL17Ngozj_DfEAvONUsxc_EA--~A&dongle=0883
37 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-gZIeu8FE2oQ.tttiNCnL17Ngozj_DfEAvONUsxc_EA--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.169.15 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:18 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Tue, 29 Jun 2021 15:45:18 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-gZIeu8FE2oQ.tttiNCnL17Ngozj_DfEAvONUsxc_EA--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
xuid
eb2.3lift.com/ Frame 093B
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=1%26gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Feb2.3lift.com%252Fxuid%253Fmid%253D3335%2526xuid%253D%2524UID%2526dongle%253D4d58%2526gdpr%3D1%2526gdpr_consent%3D
  • https://eb2.3lift.com/xuid?mid=3335&xuid=5501602819095909930&dongle=4d58&gdpr=1&gdpr_consent=
37 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3335&xuid=5501602819095909930&dongle=4d58&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.169.15 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:18 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:18 GMT
X-Proxy-Origin
159.48.55.7; 159.48.55.7; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
84a2e8fe-3712-4e60-bc7d-9e67088f44bb
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://eb2.3lift.com/xuid?mid=3335&xuid=5501602819095909930&dongle=4d58&gdpr=1&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
iu3
s.amazon-adsystem.com/ Frame 093B
Redirect Chain
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=824509530055284037
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=824509530055284037&dcc=t
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=824509530055284037&dcc=t
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.94.232.32 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:18 GMT
Server
Server
Vary
User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=824509530055284037&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
xuid
eb2.3lift.com/ Frame 093B
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
37 B
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.169.15 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:19 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

Location
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:18 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
95
Content-Type
text/html; charset=utf-8
setuid
ib.adnxs.com/prebid/ Frame 093B 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=1&gdpr_consent=&uid=824509530055284037
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
setuid
ib.adnxs.com/prebid/ Frame 093B 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=triplelift&gdpr=1&gdpr_consent=&uid=824509530055284037
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021062408&jk=566418539731751&bg=!1dal1pLNAAYo4NJEKOA7ACkAdvg8Wo7EqVArJLcr-GVIuNlaOo54w25aedArZNlBJEZtBm35jJYxUgIAAABSUgAAAAtoAQcKAGX3HO4SBkgwG09yxDbUqSKZruMHipm0pQYr1894Cz28gFvXwW40wa6nU5mhW1bhtS-Rw7zR4Uio91WsiOmgJAQG5ydtytExtc7Cvj9ybVc4FcYopOzEf4NdG_5Zc3ZFi4Wln7Jo75kCcu1zAaB9iNe2_E3bM5aQEgjaGggIcicoOuqq8VYrLeTsf_U956pGNjdPd8_X3cAL6mBg2cHTX5QfgJvFaXXHIZVhNzVQhEaVu6VRXvezK3aYENsEfWzcBWDg8nXpQZ47-mLrwpIADbknmHiDmeIQ6L3a80PptTvAKUBLvIxn0up9OpGfWTFlV6xPpsjf5RehlK8rYeuCJGSHlr0kD60ZyIpHCSOvdi3H_Py-Ldtpj0Jllw6GazNmcXnt-ITgjB4Qm9PWHYNZdpvQrB0WqErkktyneD1Li4UAc8ySFk1PYVzhv98i2ARlXZlrLf7DxSjruOflcdY3AYA5uEifIKDLrghGHYGYyDJLnyBr0NuJ05aTnx9Q1eW5nrVbtxsw3blfXfqN1BwCJKE742_nJy5O69hw0gOugtrDN3squG1wJ1Gqyspkh7DfwfCmbDrZxB8K7kKnPuzsjGAWrzgcI9EI7YQ0qgPY1yRO8tvTDx6akoyZT2ySaWl4XACr05n5ZB_ThJ9kSQzNBfIUoVJY2Jul1gTpaJeQVl29KzEyj0qNMk9tY-EHGL1WuQoC2yihiDF2a8BwK6-IVCQKF-8evNQ2yqaVTjkfgWvSaAsm03ZD_v7RFRpb0uDcspAzNkSNKYzny2XMESdoWbRyB6Kkrdu9nVG_nRW9SCcaQ5WUKNIFei4vewHSMtDypKULAmKLbg64h0yc9B0kQZTXASKz8ne4cQpPK5aXI7CJUtbV3445Q7M6He7F1_4Cmi3wcEQXCyZwne2S8sayLOWloM5i--UdOMCffn0lElQBYc6LDfEzTmLns0HVYjH650Aq7erOEK3R8wuc
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
self
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 		585 B
887 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1624981519913
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.5.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca10cf72c7ed1fd0e6bd5099e4ea303d6e2e657026067da23090024c8153f694

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5ZQOsK2hXwNpuQhHMNNp%2F4ds1q5GnB%2FCuBj0QQVPPD888E1LeKlE61%2FpllIZlXfzXFIru0gfUbsMghLAtw%2BWeJBXEeI%2FvQ7y1wtnLMday1rmZLQ8S6VQCqa32kVezg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=1800
cf-ray
66704803fae00635-LHR
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0afa0b5676000006350f9a3000000001
vendors~Auth0UniversalLoginAuthSystem.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		143 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/vendors~Auth0UniversalLoginAuthSystem.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FC7) /
Resource Hash
6f87d87de84dc36cab28965d9e1d940c250f399860acafe55f3dac01d54399ad

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
gzip
content-md5
o/3Cfwyx2Hdo/xXi+KtqIw==
age
12064
x-cache
HIT
content-length
43195
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:48 GMT
server
ECAcc (frc/8FC7)
etag
0x8D9056E3D50F079
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
f91f9420-d01e-00ec-66e1-6c2e06000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
Auth0UniversalLoginAuthSystem.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/Auth0UniversalLoginAuthSystem.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F80) /
Resource Hash
dde5f5e3043fff6c7a7f24a307eac6ac7317e7d6db0085fbbe268eb11ba08699

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
gzip
content-md5
E5fyjsIr92YKgvTS5SE4ZA==
age
21104
x-cache
HIT
content-length
3400
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:32 GMT
server
ECAcc (frc/8F80)
etag
0x8D9056E339D05A5
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
48a22731-401e-0025-49cc-6cbecc000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
Auth0AuthSystem.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/Auth0AuthSystem.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F30) /
Resource Hash
99bea1588717259aa23413b0659c1eb6a0fe227b10eb213e8d9068fd1aa23b96

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
gzip
content-md5
jBig/iW/Mpw+sfYWVt9mLw==
age
6050
x-cache
HIT
content-length
2320
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:31 GMT
server
ECAcc (frc/8F30)
etag
0x8D9056E3391B836
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
90d427b8-201e-0058-64ef-6c2204000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
CustomAuthSystem.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/CustomAuthSystem.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F12) /
Resource Hash
80e63f47bb601d1782367bf3015482e86cad9fa03cbfce5ec26502c016d4d47b

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
gzip
content-md5
WtHQ46VooZh5jhibUEIm/g==
age
21105
x-cache
HIT
content-length
2146
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:32 GMT
server
ECAcc (frc/8F12)
etag
0x8D9056E33BE9F96
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
9c9b4922-f01e-009d-46cc-6c5c3f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
JanrainAuthSystem.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/JanrainAuthSystem.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F95) /
Resource Hash
1d4e66ef8f5ea94ffe457c995d263d41163c06c199cb6900dfc368b2214794a0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
gzip
content-md5
3loC7XOiphfHLLmAxSEZ5g==
age
21084
x-cache
HIT
content-length
2639
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:32 GMT
server
ECAcc (frc/8F95)
etag
0x8D9056E33C99EC8
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
901b04e6-801e-00ff-2acc-6c1be7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
MG2AuthSystem.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/MG2AuthSystem.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FAB) /
Resource Hash
8cf0bb9486df56f8bfc90a4ba4d7317243f9ca37aa6ec6193214e9a0d640744c

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
gzip
content-md5
53DSePPJylXjWw4MlYhYcA==
age
8604
x-cache
HIT
content-length
2456
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:32 GMT
server
ECAcc (frc/8FAB)
etag
0x8D9056E33DFC44A
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
f3cbfb25-001e-012d-3ae9-6ce3ea000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
NewzwareAuthSystem.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/NewzwareAuthSystem.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F8E) /
Resource Hash
2fcc3c30a10f35c852ff3d27a846dcde5c87dfe2b6c2abd7c2a58f67791f9df2

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-encoding
gzip
content-md5
XXTxgTgPuF9lg38Cul1d8Q==
age
8203
x-cache
HIT
content-length
4009
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:32 GMT
server
ECAcc (frc/8F8E)
etag
0x8D9056E33EAC378
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
78bda84a-901e-0123-36ea-6c0fe1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
LikeButtons4.js
cdn.ayc0zsm69431gfebd.xyz/prod/dfm/ 		114 B
242 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/LikeButtons4.js
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F1E) /
Resource Hash
64ff9f874a5fd24a871b1d9cd7ee49e4d92bc27ce63c05e94bedc4f7adcc0a11

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Jun 2021 15:45:20 GMT
content-md5
0is0k5hNwCAMRJ10IGm41w==
age
15829
x-cache
HIT
content-length
114
x-ms-lease-status
unlocked
last-modified
Thu, 22 Apr 2021 09:08:32 GMT
server
ECAcc (frc/8F1E)
etag
0x8D9056E33D49E04
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
3348fa9a-a01e-00e8-13d8-6cdb84000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
accept-ranges
bytes
views
prod-dfm-proxy-connext.azurewebsites.net/api/ 		65 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=b56ed13e2c3d8ddbfe4e3a2a84931e17&ConfigCode=DENVERPRODWP&SiteCode=DFM&SettingsKey=PMP%2CDP
Requested by
Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
b95b7840dd4e76f60f9b3d9c3a7dcff21135b740611568ab4044853964694fec

Request headers

authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE2MjQ5OTU5MDN9.g6v_IpSF0RDGh_RThRHFYvyVoi_jKebCwoF0VYQaCxo
source-system
Plugin
site-code
DFM
autoqa
false
access-control-allow-origin
*
settingskey
PMP,DP
ssid
c66d71608de292b7317e7d81ea23d940
environment
prod
attr
DP
config-code
DENVERPRODWP
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type
application/json
location
System
accept
application/json
Referer
https://www.denverpost.com/
version
Version: 2.5.4.3_swg

Response headers

Pragma
no-cache
Date
Tue, 29 Jun 2021 15:45:20 GMT
Content-Encoding
gzip
Expires
-1
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
177
X-Server-Time
6/29/2021 3:45:20 PM
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
views
prod-dfm-proxy-connext.azurewebsites.net/api/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=b56ed13e2c3d8ddbfe4e3a2a84931e17&ConfigCode=DENVERPRODWP&SiteCode=DFM&SettingsKey=PMP%2CDP
Protocol
HTTP/1.1
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Origin
https://www.denverpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
X-Powered-By
ASP.NET
Date
Tue, 29 Jun 2021 15:45:19 GMT
Content-Length
0
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j91&a=450566955&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ul=en-us&de=UTF-8&dt=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MeterStart&el=%7B%22ConversationName%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ConversationDateStarted%22%3A%22Not%20Set%22%2C%22ConversationDateEnded%22%3A%22Not%20Set%22%2C%22ConversationDateExpiratation%22%3A%22Not%20Set%22%2C%22ConversationPaywallLimit%22%3A%22Not%20Set%22%2C%22ArticleViews%22%3A%22Not%20Set%22%7D&_u=aGjACEAjBAAAAC~&jid=928272309&gjid=1846453358&cid=1143692882.1624981503&tid=UA-61435456-7&_gid=1817080414.1624981521&_r=1&gtm=2wg6n0NFD2QGD&cd3=denverpost.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1624981520872.2uj9yru&cd101=b56ed13e2c3d8ddbfe4e3a2a84931e17&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=Not%20Set&cd108=Not%20Set&cd109=Not%20Set&cd110=Not%20Set&cd111=Not%20Set&cd112=Not%20Set&cd113=Not%20Set&cd114=Not%20Set&cd115=Not%20Set&cd116=article&cd117=1624981520872.0.11fgmg0kbs&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=1661282538
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		48 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Jun 2021 17:36:57 GMT
server
Golfe2
age
312
date
Tue, 29 Jun 2021 15:40:08 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19661
expires
Tue, 29 Jun 2021 17:40:08 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j91&a=450566955&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ul=en-us&de=UTF-8&dt=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=PageView&el=%7B%22Page%22%3A%22Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor%22%2C%22ContentType%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%7D&_u=aGjACEAjBAAAAC~&jid=&gjid=&cid=1143692882.1624981503&tid=UA-61435456-7&_gid=1817080414.1624981521&gtm=2wg6n0NFD2QGD&cd3=denverpost.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1624981520947.utj7430l&cd101=b56ed13e2c3d8ddbfe4e3a2a84931e17&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=DENVER%20PROD%20CONVERSATION%20v1.1&cd108=1&cd109=1&cd110=2&cd111=2021-06-29T15%3A45%3A20Z&cd112=Not%20Set&cd113=2021-08-28T15%3A45%3A20Z&cd114=Not%20Set&cd115=Not%20Set&cd116=article&cd117=1624981520947.0.57pe93v5jkn&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=185826101
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 07:32:15 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
29585
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
70 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=928272309&gjid=1846453358&_gid=1817080414.1624981521&_u=aGjACEAjBAAAAC~&z=1489922818
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0a::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 29 Jun 2021 15:45:20 GMT
content-type
text/plain
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
connext-user-check.php
uploads.denverpost.com/pax/ 		28 B
411 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://uploads.denverpost.com/pax/connext-user-check.php?key=undefined
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
63.147.65.174 Peoria, United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Apache/2.4.37 (centos) OpenSSL/1.1.1g / PHP/7.2.24
Resource Hash
8075a7a142a8797313394bdf757c4d028aeea271fff5ed41deeb02b38fa4a66b

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 29 Jun 2021 15:45:21 GMT
Server
Apache/2.4.37 (centos) OpenSSL/1.1.1g
X-Powered-By
PHP/7.2.24
Transfer-Encoding
chunked
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.denverpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=928272309&_u=aGjACEAjBAAAAC~&z=1515040984
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-61435456-7&cid=1143692882.1624981503&jid=928272309&_u=aGjACEAjBAAAAC~&z=1515040984
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.denverpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Jun 2021 15:45:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
analytics.rlcdn.com/ Frame 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pixel.onaudience.com
URL
https://pixel.onaudience.com/?partner=214&mapped=5A172B0A-45DD-4D11-A86B-F32F8222D5B2
Domain
hb-api.omnitagjs.com
URL
https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&SafeFrame=true&CanonicalUrl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&PublisherDomain=https%3A%2F%2Fwww.denverpost.com
Domain
trends.revcontent.com
URL
https://trends.revcontent.com/rtb?apiKey=b7b594eb3a542d84f1718555eb51303d1083ca46&userId=152441
Domain
onetag-sys.com
URL
https://onetag-sys.com/prebid-request
Domain
prebid-eu.creativecdn.com
URL
https://prebid-eu.creativecdn.com/bidder/prebid/bids
Domain
analytics.rlcdn.com
URL
https://analytics.rlcdn.com/

Verdicts & Comments Add Verdict or Comment

246 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| scriptHelpers function| loadCSS object| _wpemojiSettings object| environment object| log boolean| apstagLOADED object| apstag object| regeneratorRuntime object| ZeusAdapter string| zeusAdUnitPath object| zeusKeyvalues function| generateConfigOverride object| MNG_MPULSE object| BOOMR number| MNG_SSO_TOOLS_GLOBAL_START_TIME function| $ function| jQuery object| MG2 function| PluginInitOverride object| MG2Loader string| loaderVersion string| loaderBuild object| appInsights object| deferredResources number| _swclk_ number| _swsts_ object| PushlySDK object| dfm_pushly_options function| BOOMR_check_doc_domain object| ErrorStackParser object| UserTimingCompression object| BOOMR_mq object| blueConicPreListeners function| BCClass object| blueConicClient function| mg2WidgetAPI object| DFM_AD_MODS_LEVEL function| analyticsEvent function| analyticsSocial function| analyticsVPV function| analyticsClearVPV function| analyticsForm object| dataLayer object| googletag object| zeus function| closeMobileAdhesionAd string| biJsHost boolean| dfmCanRunAds string| siteName object| webpackChunkknowlton function| Headroom function| Hammer boolean| dml object| DML object| wp function| _typeof object| PARSELY object| _stq object| twemoji object| AI object| Microsoft function| __extends function| _endsWith function| st_go function| linktracker_init object| wpcom object| criteo_pubtag object| criteo_pubtag_109 object| Criteo object| Criteo_109 object| PubMaticSync function| InteractionTypeImpl object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data string| GoogleAnalyticsObject function| ga object| _atrk_opts string| comscoreID object| _qevents string| sp_cid function| fbq function| _fbq object| atsScript object| ggeac object| google_js_reporting_queue function| _Utilities function| AsyncManager function| AsyncCall function| Identity function| LTK function| _Order function| _TRKT function| _Product function| _Customer function| _Client function| _Assembler function| _LTKClick function| _LTKSubscriber function| _Profile function| _ProfileItem function| _LTKSignup function| isWatermark function| SessionTracker function| SCAItem function| getCookieDomain function| _Session function| tapToJoinHandler string| _protocol object| _ltk_util object| match string| _ltkwmt object| _ltk object| customEvent object| jQueryLoadCall number| _jQueryLoadInterval object| ltkLoadCall number| _ltkLoadInterval number| c_start string| ua object| matched object| browser object| lists object| LoaderConfig function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| gaplugins object| gaGlobal object| gaData function| atrk boolean| _atrk_fired object| ensBootstraps object| Bootstrapper object| _mather object| _mg2q object| _matherq object| _sp_ function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| bc_json326 object| Mustache function| BlueConicMetaDataService object| _bcp function| RuleService object| bc function| jwt_decode object| justDetectAdblock object| bcConnectionUtil function| md5 function| BlueConicDataLayerUtil object| jsonpath string| psj0 string| psj1 string| fpVersion string| fpBuild object| DeviceDetector object| Fingerprint object| __OW_CONFIG__ object| webpackChunk_spotim_launcher string| OW_AD_UNIT_TYPE object| __OPEN_WEB__ string| __SPOTIM_PAGE_VIEW_ID__ object| __SPOTIM__ object| webpackChunkads object| process boolean| __OW_STANDALONE_SCRIPT_RUN__ object| __OW_ASYNC_CALL_POST_IDS__ string| pubcidCookie object| core function| setImmediate function| clearImmediate object| ats object| g2ExtendInits object| G2Analytics object| G2Insights object| MG2Insights object| nxtBundle object| webpackJsonpnxtBundle object| NxtInner object| Connext object| CnnXt object| MG2DL object| bc_json327 object| headertag object| SPOTIM object| bc_json328 number| c_end object| bouncex object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| bxgraph function| reload_campaigns function| setBounceCookie function| getBounceCookie function| setBounceVisitCookie function| getBounceVisitCookie function| clearBounceCookie object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| tid function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb string| $$SPOTIM_VID$$ string| $$SPOTIM_BID$$ function| owActionQueue string| bcx_vars object| __OW_AD_OPS_CONFIG__ function| __SPOTIM_DISABLE_ADS__ object| gPartners number| BOOMR_onload object| GoogleGcLKhOms object| google_image_requests

5 Cookies

Domain/Path Name / Value
.denverpost.com/ Name: _gat_UA-61435456-7
Value: 1
.criteo.com/ Name: uid
Value: 72ec13c8-d615-476a-a6d8-d3a0efcd627f
.denverpost.com/ Name: _gid
Value: GA1.2.1358882759.1624981518
.denverpost.com/ Name: _ga
Value: GA1.2.1143692882.1624981503
.denverpost.com/ Name: RT
Value: "z=1&dm=denverpost.com&si=bbc1a51d-1e55-4b80-b4a9-79db499f6a8e&ss=kqi812ls&sl=1&tt=dkw&bcn=%2F%2F6852bd0b.akstat.io%2F&ld=dl0"

60 Console Messages

Source Level URL
Text
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 11)
Message:
%cERROR background-color:#ff0000;color:#fff;font-weight:bold;border-radius:4px;padding:4px 6px;
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 12)
Message:
%cUncaught SyntaxError: Unexpected end of input background-color:#dd00cc;color:#fff;font-weight:bold;border-radius:4px;padding:4px 6px;
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 13)
Message:
Thrown in %s at %d:%d https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/ 169 1
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 14)
Message:
console.groupEnd
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 15)
Message:
console.groupEnd
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 11)
Message:
%cERROR background-color:#ff0000;color:#fff;font-weight:bold;border-radius:4px;padding:4px 6px;
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 12)
Message:
%cUncaught TypeError: Cannot read property 'getItem' of null background-color:#dd00cc;color:#fff;font-weight:bold;border-radius:4px;padding:4px 6px;
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 13)
Message:
Thrown in %s at %d:%d https://www.denverpost.com/_static/??-eJyVzUEKwjAQQNELmQ6pYHUhHkVKMtUJySRkJhVzemnBnRu3Dz4fXsW4zIqsUGJ7EAv4Jd07NoFZBFVAqoOws9nYpOxlSMRDkAP86Msza+aFYoQV2ecKhZy2ihv9F8a5v4U6fn+3dLWncTxeprO14QPPX0bI 1 84
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 14)
Message:
console.groupEnd
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 15)
Message:
console.groupEnd
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 11)
Message:
%cERROR background-color:#ff0000;color:#fff;font-weight:bold;border-radius:4px;padding:4px 6px;
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 12)
Message:
%cUncaught TypeError: Cannot read property 'getItem' of null background-color:#dd00cc;color:#fff;font-weight:bold;border-radius:4px;padding:4px 6px;
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 13)
Message:
Thrown in %s at %d:%d https://www.denverpost.com/_static/??-eJydz8sKwjAQheEXMh1awctCfJY0SdvUzExwJopvb0AXCiLW7Q8fnAPXbByTBlLQKWAQsCJBBUStRgezgGNEpsZNhU4NRmpmWcEPLnO6DTElWYJ6Tt6xrSF9YbWgFaYXmHg0kUxfVOvYpZRNxNFY1fMnmlMZIwn4AY31BtnLG6/tcWQ5lo4u0Qf+Q2bWuvoJj3hoN1233m93bTvfAVvurl8= 11 262
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 14)
Message:
console.groupEnd
console-api log URL: https://www.denverpost.com/2021/06/22/colorado-unemployment-fraud-phishing/(Line 15)
Message:
console.groupEnd
console-api info URL: https://c.go-fet.ch/a/embed.js?ver=1.0.0(Line 2)
Message:
Powered by DML âš¡ : 20210623-header-height-fix-1-gd06ef36_prod_master
console-api info URL: https://c.go-fet.ch/a/embed.js?ver=1.0.0(Line 2)
Message:
DML Host : denverpost.com
console-api debug URL: https://mng-denverpost.zeustechnology.com/main.js(Line 2)
Message:
[customSSP] Registering custom bidder [object Object]
console-api log (Line 1)
Message:
Aldo Svaldi
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'setItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api info URL: https://c.go-fet.ch/a/embed.js?ver=1.0.0(Line 2)
Message:
DML.gpt.refresh slotsToRefreshQueue
console-api warning URL: https://mng-denverpost.zeustechnology.com/main.js(Line 2)
Message:
--ZEUS_LOGGER-- CCPA string not set [object Object]
console-api warning URL: https://mng-denverpost.zeustechnology.com/main.js(Line 2)
Message:
--ZEUS_LOGGER-- no configs [object Object]
console-api log URL: https://medianewsgroup.blueconic.net/plugin/library/cdddbd3f7ba12d52e8f289352ad95f36(Line 3321)
Message:
JQMIGRATE: Migrate is installed, version 3.3.2
console-api log URL: https://medianewsgroup.blueconic.net/plugin/library/cdddbd3f7ba12d52e8f289352ad95f36(Line 3326)
Message:
JQMIGRATE: Migrate is installed, version 3.3.2
console-api log URL: https://medianewsgroup.blueconic.net/plugin/library/cdddbd3f7ba12d52e8f289352ad95f36(Line 3317)
Message:
JQMIGRATE: Migrate is installed, version 3.3.2
console-api log URL: https://cdn.blueconic.net/medianewsgroup.js(Line 139)
Message:
[BC]DataLayer available
console-api log (Line 14)
Message:
enter exclusiveCheck
console-api log (Line 10)
Message:
in exclusiveCheck
console-api log (Line 11)
Message:
exclusiveCheck boolfalse
console-api log (Line 1)
Message:
Aldo Svaldi
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'getItem' of null
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
TypeError: Cannot read property 'setItem' of null
console-api log URL: https://launcher.spot.im/spot/sp_sXPv48AD(Line 4)
Message:
[OpenWeb Launcher] v2.56.3
console-api error URL: https://www.denverpost.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3(Line 8)
Message:
SyntaxError: Unexpected token u in JSON at position 0
console-api log URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/dfm/t8y9347t.min.js?(Line 1)
Message:
[object Object] Utf8
console-api log URL: https://cdn.blueconic.net/medianewsgroup.js(Line 139)
Message:
[BC]Pushing event: BlueConic.VIEW
console-api log (Line 1)
Message:
Aldo Svaldi
console-api log URL: https://cdn.blueconic.net/medianewsgroup.js(Line 139)
Message:
[BC]Pushing event: BlueConic.VIEW
console-api log (Line 1)
Message:
Aldo Svaldi
console-api warning URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js(Line 1)
Message:
AI: UrlTooLong message:"input is too long, it has been truncated to 2048 characters." props:"{data:GET https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=566418539731751&correlator=2743647028077934&output=ldjh&impl=fifs&eid=31061649%2C31061415%2C21065724&vrg=2021062408&ptt=17&sc=1&sfv=1-0-38&ecs=20210629&iu_parts=8013%2Cdenverpost.com%2Cbusiness%2CSponsorship_1%2Cinterstitial%2Ctop_leaderboard%2COutstream_Video%2CCube1_RRail_ATF%2CCube2_RRail_mid%2CCube3_RRail_lower&enc_prev_ius=%2F0%2F1%2F2%2F3%2C%2F0%2F1%2F2%2F4%2C%2F0%2F1%2F2%2F5%2C%2F0%2F1%2F2%2F6%2C%2F0%2F1%2F2%2F7%2C%2F0%2F1%2F2%2F8%2C%2F0%2F1%2F2%2F9&prev_iu_szs=300x50%2C1x1%2C728x90%7C970x90%7C970x250%2C480x360%2C300x250%7C300x600%7C300x1050%7C160x600%2C300x600%7C300x250%2C300x600%7C300x250&prev_scp=POS%3DSponsorship_1%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Sponsorship_1.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3Dinterstitial%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_interstitial.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3Dtop_leaderboard%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_top_leaderboard.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3DOutstream_Video%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Outstream_Video.init.dsk%7CPOS%3DCube1_RRail_ATF%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Cube1_RRail_ATF.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3DCube2_RRail_mid%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Cube2_RRail_mid.init.dsk%26amznbid%3D2%26amznp%3D2%7CPOS%3DCube3_RRail_lower%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_Cube3_RRail_lower.init.dsk%26amznbid%3D2%26amznp%3D2&eri=1&cust_params=zeus%3Dapplied%26kv%3Dbusiness%252Ccolorado-department-of-labor%252Cfraud%252Cjobs%252Cmore-business-news%252Cunemployment%252Caldo-svaldi%26page%3Darticle%26RPN%3D392372150881%26rurl%3D%26articleid%3D4614849&cookie_enabled=1&bc=31&abxe=1&lmt=1624981503&dt=1624981503801&dlt=1624981501203&idt=1545&frm=20&biw=1600&bih=1200&oid=3&adxs=1439%2C800%2C800%2C637%2C1287%2C1287%2C1287&adys=17%2C177%2C182%2C1019%2C487%2C790%2C1671&adks=422864591%2C883939939%2C536565947%2C2201960385%2C2781879128%2C3203588830%2C4273369955&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=1&u_tz=120}"
console-api warning URL: https://mng-denverpost.zeustechnology.com/main.js(Line 2)
Message:
--ZEUS_LOGGER-- request error [object Object]
console-api warning URL: https://player.spotim.market/prebidlink/451383/hb_270443_140.js(Line 3)
Message:
fun-hooks: referenced 'registerAdserver' but it was never created
console-api log (Line 1)
Message:
Aldo Svaldi
console-api log (Line 1)
Message:
Aldo Svaldi
console-api warning URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js(Line 1)
Message:
AI: UrlTooLong message:"input is too long, it has been truncated to 2048 characters." props:"{data:POST https://www.google-analytics.com/j/collect?v=1&_v=j91&a=450566955&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&dr=&dp=%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&ul=en-us&de=UTF-8&dt=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Article%20Scroll%20Tracking&ea=0%25&el=%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&_u=aGjACEAjBAAAAC~&jid=1815394324&gjid=332306252&cid=1143692882.1624981503&tid=UA-61435456-7&_gid=1358882759.1624981518&_r=1&gtm=2wg6n0TLFP4R&cd2=denverpost.com&cd3=denverpost.com&cd4=&cd5=2021-06-22T06%3A00%3A24-06%3A00&cd6=2021-06-22T06%3A00%3A24-06%3A00&cd7=2021-06-21T18%3A25%3A28-06%3A00&cd9=no&cd10=Business&cd11=5.7.2&cd12=&cd13=WP&cd14=Business&cd15=Business&cd16=&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd22=colorado-unemployment-fraud-phishing&cd23=4614849&cd24=article&cd25=DENVER&cd26=Aldo%20Svaldi&cd27=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&cd28=https%3A%2F%2Fwww.denverpost.com%2F2021%2F06%2F22%2Fcolorado-unemployment-fraud-phishing%2F&cd29=Fraudsters%20sneaking%20into%20Colorado%20unemployment%20accounts%20via%20a%20backdoor&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=Denver&cd34=true&cd35=&cd36=2542&cd37=420&cd38=Aldo%20Svaldi&cd49=true&cd50=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&cd51=&cd54=asvaldi%40denverpost.com&cd55=The%20Denver%20Post&cd125=8b00c746-e983-4052-a01c-366c4ab7697f&cd126=PERSONAL&cd127=Engagement%20Score%3A%7C%5BBC%20Dev%5D%20Unknown%20last%20visit%20%3E180%20days%7CBANG%20prop%20score%20js%20segment%7CAllvisitorslast7%7CMNG%20Nonsub%20Unknown%7CVariants%20Viewed%20Distribution%7C%5BBC%20Dev%5D%20Anonymous%20Profiles%7CDP%20Non-Subscribers%7Cextras.mercurynews%20non-su}"
console-api log (Line 1)
Message:
Regular browsing
console-api log (Line 1)
Message:
Aldo Svaldi
console-api log (Line 1)
Message:
loading content
console-api log (Line 1)
Message:
[object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob:; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6852bd0b.akstat.io
91f93964906eeade2573798ddcfa8220.safeframe.googlesyndication.com
a.tribalfusion.com
acdn.adnxs.com
ad.doubleclick.net
ad.turn.com
ad4m.at
ads.avct.cloud
ads.playground.xyz
ads.pubmatic.com
ads.yahoo.com
adservice.google.com
adservice.google.nl
ajax.googleapis.com
analytics.rlcdn.com
ap.lijit.com
api-2-0.spot.im
api-mg2.db-ip.com
api.bounceexchange.com
api.rlcdn.com
as-sec.casalemedia.com
assets.bounceexchange.com
at1.listrakbi.com
ats.rlcdn.com
aud.pubmatic.com
az416426.vo.msecnd.net
b1sync.zemanta.com
bh.contextweb.com
bidder.criteo.com
c.amazon-adsystem.com
c.bing.com
c.go-fet.ch
c.go-mpulse.net
c1.adform.net
c2shb.ssp.yahoo.com
cdn.ayc0zsm69431gfebd.xyz
cdn.blueconic.net
cdn.listrakbi.com
cdn.p-n.io
cdn.parsely.com
cdn3.optimizely.com
certify.alexametrics.com
check.analytics.rlcdn.com
cm.adgrx.com
cm.g.doubleclick.net
cmp.osano.com
connect.facebook.net
cs.choozle.com
csync.loopme.me
d1eoo1tco6rr5e.cloudfront.net
d1wa9546y9kg0n.cloudfront.net
d2lv4zbk7v5f93.cloudfront.net
d31qbv1cthcecs.cloudfront.net
d5p.de17a.com
data.cdnbasket.net
dc.services.visualstudio.com
de6cc07bf6c63cd3535fd763e43d3d53.safeframe.googlesyndication.com
di.rlcdn.com
direct-events-collector.spot.im
dis.criteo.com
dsp.adfarm1.adition.com
e.cdnwidget.com
eb2.3lift.com
eus.rubiconproject.com
events-collector.spot.im
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
geo.privacymanager.io
ghb.adtelligent.com
ghb1.adtelligent.com
googleads.g.doubleclick.net
green.erne.co
gum.criteo.com
gw.geoedge.be
hb-api.omnitagjs.com
hb.spotim.market
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.3lift.com
ib.adnxs.com
ice.360yield.com
id5-sync.com
ids.cdnwidget.com
idsync.rlcdn.com
idx.liadm.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
insight.adsrvr.org
js-sec.indexww.com
js.matheranalytics.com
launcher.spot.im
loader-cdn.azureedge.net
loadm.exelator.com
lockerdome.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.bnmla.com
match.deepintent.com
match.prod.bidr.io
match.taboola.com
medianewsgroup.blueconic.net
mid.rkdms.com
mng-denverpost.zeustechnology.com
mug.criteo.com
mwzeom.zeotap.com
nexus.ensighten.com
onescript-recscont.listrakbi.com
onetag-sys.com
p.zetarail.com
p1.parsely.com
page.cdnbasket.net
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pix.spot.im
pixel-sync.sitescout.com
pixel.advertising.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
pixel.wp.com
player.adtelligent.com
player.spotim.market
pm.w55c.net
polyfill.io
pr-bh.ybp.yahoo.com
prebid-eu.creativecdn.com
prebid-us.creativecdn.com
prod-dfm-proxy-connext.azurewebsites.net
prodmg2.blob.core.windows.net
publisher-assets.spot.im
pubmatic-match.dotomi.com
redirect.prod.experiment.routing.cloudfront.aws.a2z.com
rtb-csync.smartadserver.com
rtb.gumgum.com
rules.quantcount.com
rumcdn.geoedge.be
s.adtelligent.com
s.amazon-adsystem.com
s.tribalfusion.com
s1.listrakbi.com
sb.scorecardresearch.com
scripts.webcontentassessor.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
spot-im-d.openx.net
ssum-sec.casalemedia.com
static-cdn.spot.im
static.criteo.net
stats.g.doubleclick.net
stats.wp.com
sync-tm.everesttech.net
sync.1rx.io
sync.adtelligent.com
sync.ipredictive.com
sync.mathtag.com
sync.search.spotxchange.com
sync.spotim.market
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
tag.wknd.ai
tags.bluekai.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
trc.taboola.com
trends.revcontent.com
uipglob.semasio.net
um.simpli.fi
uploads.denverpost.com
ups.analytics.yahoo.com
us-u.openx.net
view.cdnbasket.net
visitor.fiftyt.com
www.denverpost.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
x.bidswitch.net
analytics.rlcdn.com
hb-api.omnitagjs.com
onetag-sys.com
pixel.onaudience.com
prebid-eu.creativecdn.com
trends.revcontent.com
104.154.142.214
104.26.5.15
107.178.250.234
107.22.208.198
13.224.193.121
13.224.193.38
13.224.194.75
13.248.242.197
13.69.106.215
13.82.152.48
13.85.16.224
130.211.47.17
142.250.184.194
142.250.185.198
142.250.186.66
151.101.1.26
151.101.114.217
151.101.114.49
151.101.13.44
152.228.227.57
159.253.128.183
162.55.6.210
173.231.180.197
178.250.0.165
178.250.2.146
178.250.2.151
178.62.202.251
18.156.0.31
18.158.226.176
18.195.42.228
18.196.169.15
18.210.5.212
18.215.138.99
185.184.10.30
185.29.135.233
185.33.220.240
185.33.221.11
185.64.189.110
185.64.189.112
185.64.189.114
185.64.189.115
185.64.189.249
185.64.190.80
185.86.137.133
185.94.180.125
192.0.66.2
192.0.76.3
198.148.27.140
2.18.232.130
2.18.233.180
2.18.234.21
2001:678:cb4:bbbb::11
213.155.156.182
213.174.135.1
213.19.147.45
216.52.2.19
23.227.137.155
23.37.32.235
23.37.38.181
23.37.42.132
23.37.43.59
23.55.161.133
23.55.161.154
23.55.161.165
23.55.161.167
2600:9000:20eb:1200:3:b7e:8940:93a1
2600:9000:20eb:e000:c:2267:880:93a1
2600:9000:2104:7000:6:44e3:f8c0:93a1
2600:9000:2104:7600:10:43f:4340:93a1
2600:9000:2104:9400:4:b37b:9440:93a1
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:10::6816:1957
2606:4700:3039::6815:c036
2606:4700::6812:c05
2620:116:800d:21:f916:5049:f87f:108e
2620:1ec:c11::200
2a00:1288:110:c305::8000
2a00:1288:80:800::7001
2a00:1450:4001:801::2002
2a00:1450:4001:801::2003
2a00:1450:4001:811::2004
2a00:1450:4001:827::2001
2a00:1450:4001:828::2001
2a00:1450:4001:828::2002
2a00:1450:4001:828::200a
2a00:1450:4001:829::2002
2a00:1450:4001:82a::200a
2a00:1450:4001:82f::2008
2a00:1450:4001:830::200e
2a00:1450:4001:831::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c0a::9b
2a02:2638:1::3
2a02:2638::1c
2a02:26f0:6c00:1b8::11a6
2a02:26f0:6c00:2b9::11a6
2a02:26f0:6c00::210:ba20
2a02:fa8:8806:12::1400
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:3::300
2a0c:5c81:5139::2
2a0c:5c81:5142::2
3.120.90.149
3.126.158.103
3.88.253.15
34.107.221.36
34.117.4.53
34.120.133.55
34.120.253.250
34.231.165.20
34.234.106.43
34.98.107.212
34.98.64.218
34.98.72.95
35.174.31.79
35.175.85.111
35.190.24.100
35.201.96.126
35.227.219.197
35.227.221.36
35.227.248.159
35.244.174.68
37.157.6.253
38.27.122.126
38.91.45.7
52.15.171.234
52.16.154.221
52.205.167.202
52.208.167.91
52.21.104.248
52.212.126.234
52.216.89.156
52.28.203.152
52.58.57.174
52.59.102.119
52.94.232.32
54.166.210.103
54.194.211.3
54.78.254.47
62.149.0.72
63.147.65.174
65.9.77.17
65.9.77.20
65.9.77.24
65.9.77.3
65.9.77.48
65.9.77.91
65.9.77.97
65.9.81.12
65.9.84.32
65.9.86.127
65.9.86.150
65.9.86.61
66.155.71.149
69.173.144.139
69.173.144.140
70.42.32.95
75.101.131.192
77.243.60.138
85.114.159.93
94.23.171.206
99.80.189.193
0079d7d5068905b4c64ffafb932caa5798dc9aa3463a75ecedbf361f25dc6d87
013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6
030363b9252adae45e8afd43858b6f59c4a8e092f875bd7104cfec2b3d39a74c
03b8ba92e44af300657ebe52034fba14fd6f1398df9f1f4b9f9e47bad7e85109
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06c572e99c878362d40d1f358efdfe400ae1310f35cf22174dcdd5db022dd810
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
092de8574d38ed761b0630d125bc529387eed04dd9d8d5ace8bc681eced9f3dc
099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0a6cb4b505bc7778b6a6663dc8760fae0496e8acbef3b68f1474c32afa1b2ca8
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0c294a4bf750414447d2128b075c0ce4d0eafe20fc8aaea1e09904a0b928906c
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0e4724ebd008a3450c12fadd809e7c7ca440c98eb6cb30cb38e8ad5125243ae8
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0f4b08d07ecca9f8fcaf108ea78bb163fc98cfc19a844bd0f87412ab34a41873
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
119ac8bf1e0d35d42fb6a0ecc829d049ad5d6047e0378871a5d54fd879daaf18
1387a68ba4dfad608ce6fc1a8de4fa1193cda7cf876aa9d6628ed9cd038b2a12
149fe70de1af5a4c75fa8ffbad0f3680225ab4d0d431cd51f27f01bfcc75546e
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1994c60967493250d994f00dac0d8fa3b6ac442a090bc147691e0ce948f5b26c
1cc9e0ac0ff231ba3fc0c9c42b40ebcc6c5a3058722ca99eeb0fed41f3efb997
1d4e66ef8f5ea94ffe457c995d263d41163c06c199cb6900dfc368b2214794a0
1ea03e7bb14df931f8a649756cffe9465c815aa0efc23acce14b50e21c3d20ad
1ef86239e26082c826d4a9674729264c4d11a46f33af41b65fdb8da0433f4ede
2028f4555a7b5009af39ce9ca078c140c7197e9140e92ff8fbe7653d5ccbc094
2075a71af3c720d0e39567930c41634a5d4d1ef7f26e2f01bd1bfa9b0fcee3b6
2282ced248e7dfa95a0db3f829d2797b09a17eae029a540441586bfea5c1affa
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
2590d66919bcebebcab8820a8e98a672c795c718f39f53d1c62cdd26ced8660b
2611383a900389cfd82c89f624017b9807815a4e63c4b09b34451904414bee04
2660f2b99e85e68fa8824e34184467a69e55c4023287042919cd3623db8ac01c
28582e6a99ab6b2a37befb7303b16c1de90f8dba9bfaa2c12420de9213d2e68c
29d592e34e3d2c8ca0c55ceafd75940de79cdb6381d8ceb372d226e7820e7220
2b143984860cdbf2a0db9f2372ecbb1c9d601f424b4776e12d82d9664cfbade1
2dbb376f558046efd43a3d612350058d711f34ccd55f9b9fb985851ab0356fba
2dddf985c75bb11fff47619a780ef9528f01961ec11d6c7d0acc38349fdb9e93
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2eab49f65f53d3e7bdd7afbe21369f1aa082075f913e05fc104253ac0f2b74e7
2eebc868b8b516022cbf617417ec6c8db124029866061123a635488c2e43e863
2ef693f04a86bd6c802b168f1f35ef62f65a024148c53f734821393986cdb094
2f8e32230121795d8f03f838adbeb214ebe28de92911896c7ec22c94da072734
2fcc3c30a10f35c852ff3d27a846dcde5c87dfe2b6c2abd7c2a58f67791f9df2
31a54a93488f9711927aeb875ff1dd63a8c41359847f10f9cea7488dc65179b7
320273751b6b32f291ce255d87b998f4db7fa6707576058570a3125b92ccdb0c
323075a1922843a6c7f5371bc7fa55500b77944f1268d83461964e3906942141
33147c2ad24d8acefca49e60ee628fe122273e18546a576b56c4847c889d909b
340a7ed7157d63efd4118785f6951b83bd1b84fc0c615955fe65c592dc047334
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1
34c0228d1b17ca63361b7a098fe7060c38349770cadd4011178fce664a34e8bf
3656ad0b9309abc5993e3cd41a5b83b18ae7e261fd007d16cb44d5e102520632
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
376101eeb8e0d2c34623732981ac5be2c019523a368466c9ba8a4f26e1ed5b43
3aa29d6340c1d354b2594b02413c66ec2775832ca183a3787514b03215069157
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f8637ac65cdc773a52c1b9bbc4a98a1259c0a50e2684081fdbed0a99c07d6b6
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
44fa5687b6c8cf14dad1d8106f4d4cbc29a6b13d3add1c17556051dfbdde5b51
45cf251fc08e9fc86ab96c7a43b0d90040f353ca4942ead5e3cdfdd6876a1108
4605120fc8858f4c81bcb9392f416afa72d6db32137c94dfa6c394fffc61dab4
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4a167d4099e1480af5dc1dd04cd1fbd600fcdd2d93ade21244537f28adb1fda5
4c6628a9ef3638f4dd7b264171f54937c2c28a00cb4047a09ce88fef14619061
4dc4abcd99f7976c1a0938575631974c55fa42bf76681e84ca56aeea3180966e
4dd6035731ba6e9f3e15ef46d599d47a9066f7334f0660278b48c57f5b5e27a5
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
52aa0ad5355a91a61bec3dd4e95e468162168a19d35644fa0937554b97244fa4
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0
540b7f2f172268ca0ba8bf119b88a0a0d52d2bdc630c2d1af66ee34a06e7cbc0
542d494fc08854df823ca5cfb338d6b69f37e63c5a1dedd7b59743953c51217e
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
56ce57f0210be734225d723221ec671fd92f96421f8df1707d34e293284d50b4
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a
5babb783c5a65a749bdd1e4beb448b779bfe845b05fe6be6d341eba3ef8d7860
5c764ba1ccecd6b069fa3af48c26616aa22fd6076413d7d3585172ca50df6af4
5e58f37928f661bf35a08caa0252ed9835774184c05d054a46fe55384ed28ad7
5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f
5ead8a9d3886a9f702b4606eb13288e6d4ffe83670103006593cb1160c4ef1f3
5ec473c7cce7c6753ceb7037a43c201b36aae6409d646f4e303f1045694d4da9
5f73db920d574a8ba16efc308a57e03f838227d4935e9892ec4d7403cf663517
600987de56aa0f0934587f3c7560cf0a398a0b63b904d13698321668b762dbee
60ae6a4bb71a75329fc3c3e5616989c9f855c27dbbc9c5c2f1e05523f3fdd579
60d6fc1981f48c234863305f39049a93b9014860159d63dcd97e7e2072041554
6159947194614c1950bbe297c780cd82e33dc22ee5ed1f2693484f0fcda444d9
6177e9b854ee61c4bc3327a2989cd42ea3c25885793bf51d751a75ac12002308
6436303b662b2886d7757c3e092e03ab1da4e4176fc66c2c561373a10985c49a
64ff9f874a5fd24a871b1d9cd7ee49e4d92bc27ce63c05e94bedc4f7adcc0a11
6627c5ab36fa407f18fc9b6987e359eccef005ae6d35b370d2142b7daa770324
66d17cbd715a1c9ccc09e9eb0c81a322469362e0f2279fa13f2d2a8495c42946
6991413d71917c9f3f4d1fb2537c011236bdd7f73049a13bcf264524e2066f01
6a52dd58d7afae1b6bb657cbe920e39e8bad4b789b9f7a726bb499ffa34c966b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f87d87de84dc36cab28965d9e1d940c250f399860acafe55f3dac01d54399ad
70c4634f438568a86bb98789e25bd251a5b979f0e1f68c57956f5c038f53a914
71b6b6ac60e26eb01b3e6aa32331a5d76b3dc489f00dea6f0b7a2e0fed776fde
7202890bca8d1fa4bb1440b9e3776bf9e29721eb4e7be8625c5889b910517f7f
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
7458fe0eaee3baef97e59b37758968138b1c6b54e7afec32ea300800e2e6d59b
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7512ae62108af074eaa90622e9df04625f120ecf4a909443fa6dc1a2b071c7a1
758135feb6954c2501153f4a7846378a69e4189243d09272685850b10632358f
788823f9d4b7e823e4c22dbd1e55634f4748204804893fdcd27a9d4953c0b642
79297cf1e36e4e293f4c1d0d7a2761cef47e79c6696c56449ea6e6461f0059ab
79e27b5710d27d87da2ba1c049a4359ed79b5600693ff185d97f9022ea0f7edb
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551
8075a7a142a8797313394bdf757c4d028aeea271fff5ed41deeb02b38fa4a66b
80e63f47bb601d1782367bf3015482e86cad9fa03cbfce5ec26502c016d4d47b
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8431f4973d02bcceeadba217953b9a058dad0b1d958f9ba25f9fccfe95d7ae42
846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b
84c9c9d4de88f5cf5e9ed1803bc3dc4a3a60be607d5b1d1c690151144e6a8a5c
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85088ebb23822ac7b631bad39b8e0f46a86659afb0df488846e4c9b3769f61fe
85a1ccc99157ff4a59ee46bcf2cbec92fe69a7cd050ba3099dcdb00a7c925c06
85eb44416cc1c0c3312fc9bf0e6bb210a105a9dab0534cc376529084bebdafdf
864171daa3d07a43d8a53f27975fe588295bd4931fe4411a26c2bea75326c204
8730c26defc411dd8a51f1da47e5ae3804fab6868f7914a26b09d8e0791bbe39
874d318feda969118c8e56d4cc0941c31068aeaa685e450db23782f345552b7b
884c4cba946fc8a2c5479e4abb423711013a05af259ac7a7a31cafdb9d0e7dd1
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a6a6febfbf44efb2f7814a5e1179bc7ec1774cade721250270a2bdc7e8bab93
8a9ba7bbc88ec23d81a2d63845638a3b6603de473261872f301803cef84ef335
8c02d2c7bda764aa1e9d14a92c5d096e91114382dccbbb32f7fd080d2e6bb7bf
8cf0bb9486df56f8bfc90a4ba4d7317243f9ca37aa6ec6193214e9a0d640744c
8d144021a128bc51c9239911a84cdad31f1fdf9071a08736bfb762227e53ee35
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e42b47eee47c94ec277021f076224c9deeaac56087020545127f19041bbdb26
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9513b644b93838ff1052fb79cf519259a12ad5562c91a7e544441a8d356a7c85
96b34914f736b96f184920bea4cf3b30a7b76583c51bf1e9caf2add39705bffd
977b8bc33fee17f46e451517281d28913afbf69a2649432f501f6bbaa6830283
985af10a3b7cee63295f892d20b10a52ab709500c720cb7550fad4e92264c663
986cc890ff4c6e29618576b21fee055d58f91ed87402e7344453fc39dd5465bb
99bea1588717259aa23413b0659c1eb6a0fe227b10eb213e8d9068fd1aa23b96
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9bb221af82778c5bc12399ec9f45a6e19b1d3823a273b0ec62c768b9dbdcd78c
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9d7ae5b7196c72a8c09f3a766e06e61b2ef1d6192076016838b479136435b678
9e2568260d189ed6c4fedd510b1fae6819fed64cd981f581258e22a105bf5f87
9eca93bb4e6c04a645696299609a03d3949ee8b75838e868dabd2d3182ece65e
9f0624a5f72fa4c0942c21c83960fd1f80b6a49391d27a616a758b098672a00a
9fc85bf1a68db7ec6b485d5eb16da8931df59308f4abce149bdc4b45fd774e49
a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a615849237c0ce94e73fc69d86e5f9c58bdaca8d9756a5ff4c88fa86b14e6177
a7193b4a580e14658a91dd634cc0ef32ebccae115e311886a993b5e07ca5102d
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7a48125b1cb0c7d692ab45894b86aba4d9566ab5d2b380d5630926522c2526d
a98e1f08dd27c121a337ddc31691d4044f56ae83301b574728548b78d3068d3b
a993d84168913a07e214ea72d07fafee0f9716680910bf1202ea9f2fc603e29a
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
ab0d2c967ff2af6ef1612628c5163eb2063cd92c163cd3267acfe44e008eea83
ab5186d21dd8de73feda81815eb24a9906b827a0ff943d5a8d59a22e30245952
ad15918ec10a62580864ae3198a9d9545f260fe70e6cb9aa65901a5b02584fec
ad7f5d82e23fafe6f8edb75b2568d4b145bf6a4525cbe2eeb4b30b9f0db74795
ae48bf3d48283f157ef3bb9c3e76f8d85ea4381a55c9a024430d14030d7a98f0
af7208e97c75d11c6cf82e711567ecd8bd26fb08d71fe878dea38a1ce5bbd738
b003b4bb9f910d93e4f42f609cc96dff2fe12888d3caaf9dea8b17c6b0901c9a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b199065402b7ccacd72e19aef59f05e17240180a129632042df47748417e60ff
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
b6314c8400868242589514cba66862e787c8ec59275942e0417a65f821a0a976
b72dd2a1b8aec291a94aa69116646c1b487ba64688a769a0f39423328c96d48f
b77291dddf887f1184f2cc2e7364b71d4f72d364f2374fb4c707757988b3688d
b95b7840dd4e76f60f9b3d9c3a7dcff21135b740611568ab4044853964694fec
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
bc23b2b97a417647628b766fa16c0df3c5bd3ae8ad469a88ffca3dba2dd3751c
bcc12496cca31bf3ce07009f2b035c7405081719cc9bcc534e1272649c6afd9f
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
c0d0348c2cf2b5675820d596a0b9325f5c2c962f46785973441d9425e41681b6
c1282ebb5e04d4df8b4a32d9cdee9f617b59fbabf3f32d2259f2d49a1a4d6a30
c66dbf6b5716d3f7c8ece663d59bd0a576cc6bcc799e05c342255bcdce5338bf
c815be0139a92202ff8f262cc335f6ae103594bb1d92c1c479ed604adf384a16
c95951dc2494343aee7a9757b0c2d5af315b98fca45d5475504d9f7d58e3263c
ca10cf72c7ed1fd0e6bd5099e4ea303d6e2e657026067da23090024c8153f694
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cab9075ee8befa04884e463d30c2d393f3cfa8e80851ccc8a5e27973e450b2b7
cd19e78169e09d87c19d1360446509f97ef2a22f50c6900875455ad6632a8652
cdb650777343337b6af60839c621a42a4eafe6f55f80188993096aca161ee618
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
ce4cb6a60aa463697bbcae3d597f7db8e9562ff5846e4535ab1fd4b36f6be3b1
cf35c9e8af47d8cd7233bebf1b785af16546782547f31501432cb7ad97d84714
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf56147b84506334bed054904118912183c225d75a6474b0760d6cc38b3a672c
cffabe0948ab31d5e6574c15c4e0d494ecc146d91cd0434d684c9ace31f9c068
d048cd3c852f67da3ffb5ae455897b5e9ab33521454fcd3fbdbe7cbe34e9d8f7
d07496ae283d808f356ce506323f23b8944ec2a7ac517599371270214d73f1d6
d0c7f5d86871d6a83af711b37b8fcbe752895fc309c8b26a7f767a727e013809
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
d1fc811cb918e99c124039ed41021b91ce278410d6c4476fe101be24188a0cd2
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
d423dc7be0bfe97679cc9e916cab7c7de756d65055359b560d6a2fc8db6228df
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d74df69f52e621ac02e6986f9e8bfe89a7fadc52160200518842b448f589e4b6
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c
da47d25bde260aaac30fba5ce9ff1ccd5b62b15e3884f1fc40d4d5c5222b8740
dbae94cba2ba3d07d6ae6e79a7c60c4efc36deb442e193ab18e0fd0cd4d97eef
dd18ab6d18362066cbd1783ac281accdd1e301360335466e27de80bdc0816de0
dde5f5e3043fff6c7a7f24a307eac6ac7317e7d6db0085fbbe268eb11ba08699
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de3e98641c1d746e61b91de6394c62c30825073d247814fde10c2ec7dc49bda6
de489e9461297aa0072801fb77f5a6a0692090cbb3ca16be893c1abba2230848
ded1eaea7a81c448692b51438a3d7eb0753ce304aba0e4a8d73fb8ca439ccfb6
df88bec424942a5245856059224aa3e2043561588d0343acf441302d3184e3fc
e2f5a99d439c1d7bc8cd4e02f39d77d0dab1eba4e1fae40d3fc5d06ac3aaf1ea
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4cb92545debc096ddbad5c1b5aabc2d81619b50a13ae3e4553c7856bf48533b
e5b116fcb9ac4bb4acdb2eec031b39eed112fd86b3938c87caac511db03a33e1
e5cca754d6c8f3de3634cf3458ecf82acd9e8c4ebe7671b017ed7446a9850f8e
e5f43fdc1b9ebd24cfa16326faad0819d6d8382c894b2f7a789918a94c3cdc98
e6919b568b4f481609c00116c7573db1a1606dc050307b4067bd0f23aa04e6e0
e6e71f05d9bdd38041bcb651a99bc15ea64027dc04191c9c7c142f7282c62436
e905c9ad3c68e274a124f3be01bf19afa003d3112fbce01966ab6e293213e6af
ebb5eadcd1f3fe9b71b13e5175e5f1ddaf9eca9583c055b4c276e02abcf16471
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f27b4cdbd821100765224a52c7c8d544fa9fdd6d0aba21015eb66c11735e0989
f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4fc1abb3cbd3768658934960ff9fc3cac7a0388ae9dadbf9db21bbe5ce737ce
f60a9b89662cd0c3a0269bb4873033bf94478d54a9b0f50012d6f2110f8973ca
f7f50ceea4dcad83eea61dff325d95f0b850b87d8624192f5a4e503dfef3ff3c
f7f5ba86b5028a3a5a6e4f3f3fe7e58b642a6a3cf802680d898077333cc6fd3d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f852dfebba4af97add777a1d789b4739164d6cc93aa34db2c463141a5c3f4d09
f89595368770542c484dd51b0db3b8272c57c668ee503e60eb95f07b1516ec2b
fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218
ff00148160575c60967bc550a95ecb8b90b05a0149d9b05d7614245acf383767