nypost.com Open in urlscan Pro
192.0.66.32 Public Scan

ec2-52-1-91-70.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:09 GMT
AN-X-Request-Uuid: 0fde202c-4e57-456d-ac3d-b289eb81f521
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://nypost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 f34a8612-9c89-4e7a-adeb-71a2902d9634-models.bin Show response
cdn.permutive.com/models/v2/ 7 KB
6 KB 127ms
46ms XHR
application/x-binary 104.19.150.54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.permutive.com/models/v2/f34a8612-9c89-4e7a-adeb-71a2902d9634-models.bin
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.150.54 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ac7b96a802f6e1d79f7da9acfe0d5f0169378042ce3de8b5adec8feaecfffe9

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:09 GMT
content-encoding: gzip
cf-cache-status: HIT
x-goog-meta-oid: 0cf17917-395b-4f25-91cc-db3bdd6044b0
age: 0
x-guploader-uploadid: ADPycduPDSuA94BpgXVDTn6bKsPgR1rlZDOjFCAvSQabAviofFVoE6wNjKczGyQpBqYfpkE6l0x7M9kkw3hd5WiN4aE7mNOYPG9_
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 5333
last-modified: Mon, 03 Jul 2023 06:03:33 GMT
server: cloudflare
etag: "23d285809c673e2572e587403092f89e"
vary: Accept-Encoding
x-goog-generation: 1688364213425858
content-type: application/x-binary
access-control-allow-origin: *
x-goog-hash: crc32c=ir9xmw==, md5=I9KFgJxnPiVy5YdAMJL4ng==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=900, no-transform
x-goog-stored-content-length: 5333
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7e4d6c31ea7667bd-MIA
expires: Tue, 11 Jul 2023 01:20:49 GMT

GET
H2 200 geoip Show response
api.permutive.com/v2.0/ 285 B
391 B 215ms
140ms XHR
application/json 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/geoip?include=geo&include=isp&include=ip_hash&k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: f826f59070a141c3599d0b89ee2683cb7bf9527dd350a227096f62f45f9144fa

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:09 GMT
content-encoding: gzip
via: 1.1 google
server: Permutive
vary: Origin
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 201

POST
H2 200 watson Show response
api.permutive.com/v2.0/ 2 B
87 B 218ms
145ms XHR
application/json 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/watson?k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:09 GMT
content-encoding: gzip
via: 1.1 google
server: Permutive
vary: Origin
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1689040509682&aid=a-01qt&se=e30&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&tna=v2.7.2&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordin...
https://rp4.liadm.com/j?dtstmp=1689040509682&aid=a-01qt&se=e30&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&tna=v2.7.2&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordi...

43 B
582 B

436ms
63ms

XHR
application/json

52.1.91.70
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1689040509682&aid=a-01qt&se=e30&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&tna=v2.7.2&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ext__pubcid=a878d8e0-8a80-4366-920e-95a5dee32438&us_privacy=1---&wpn=lc-bundle&c=PHRpdGxlPldlbGxzIEZhcmdvIFZQIENhcmwgTmVsc29uICdpbnZpdGVkIHN1Ym9yZGluYXRlIHRvIGV4ZXJjaXNlIGFuZCBzaG93ZXIgd2l0aCBoaW0nOiBsYXdzdWl0PC90aXRsZT48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly9ueXBvc3QuY29tLzIwMjMvMDUvMTAvd2VsbHMtZmFyZ28tdnAtaW52aXRlZC1zdWJvcmRpbmF0ZS10by1leGVyY2lzZS1hbmQtc2hvd2VyLXdpdGgtaGltLyI-PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IkNhcmwgTmVsc29uIGFuZCBXZWxscyBGYXJnbyBhcmUgbmFtZWQgaW4gYSBsYXdzdWl0IGZpbGVkIGluIExvcyBBbmdlbGVzIFN1cGVyaW9yIENvdXJ0IG9uIFR1ZXNkYXkuIj48aDEgY2xhc3M9ImhlYWRsaW5lIGhlYWRsaW5lLS1zaW5nbGUiPgoJCVdlbGxzIEZhcmdvIFZQIENhcmwgTmVsc29uIOKAmGdhdmUgZmVtYWxlIHN1Ym9yZGluYXRlIHVud2FudGVkIG1hc3NhZ2VzLCBpbnZpdGVkIGhlciB0byBleGVyY2lzZSBhbmQgc2hvd2VyIHdpdGggaGlt4oCZOiBsYXdzdWl0CTwvaDE-PHRpdGxlPkJhY2sgQnV0dG9uPC90aXRsZT48dGl0bGU-U2VhcmNoIEljb248L3RpdGxlPjx0aXRsZT5GaWx0ZXIgSWNvbjwvdGl0bGU-&i6=MjAwMTo1NTA6MWQwNToxOjo0&n3pc=true

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Server

52.1.91.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

561f49e7560b02f72da6625f7acdbc628765225984bbed60c93209020471620b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
x-pixel-event-id: 64d32689-968b-4e40-afa8-50e07df93c08
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: DENY
vary: Origin
content-type: application/json
request-time: 1
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: d408dc313eb18cde
content-length: 43
x-xss-protection: 1; mode=block

Redirect headers

date: Tue, 11 Jul 2023 01:55:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1689040509682&aid=a-01qt&se=e30&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&tna=v2.7.2&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ext__pubcid=a878d8e0-8a80-4366-920e-95a5dee32438&us_privacy=1---&wpn=lc-bundle&c=PHRpdGxlPldlbGxzIEZhcmdvIFZQIENhcmwgTmVsc29uICdpbnZpdGVkIHN1Ym9yZGluYXRlIHRvIGV4ZXJjaXNlIGFuZCBzaG93ZXIgd2l0aCBoaW0nOiBsYXdzdWl0PC90aXRsZT48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly9ueXBvc3QuY29tLzIwMjMvMDUvMTAvd2VsbHMtZmFyZ28tdnAtaW52aXRlZC1zdWJvcmRpbmF0ZS10by1leGVyY2lzZS1hbmQtc2hvd2VyLXdpdGgtaGltLyI-PG1ldGEgbmFtZT0iZGVzY3JpcHRpb24iIGNvbnRlbnQ9IkNhcmwgTmVsc29uIGFuZCBXZWxscyBGYXJnbyBhcmUgbmFtZWQgaW4gYSBsYXdzdWl0IGZpbGVkIGluIExvcyBBbmdlbGVzIFN1cGVyaW9yIENvdXJ0IG9uIFR1ZXNkYXkuIj48aDEgY2xhc3M9ImhlYWRsaW5lIGhlYWRsaW5lLS1zaW5nbGUiPgoJCVdlbGxzIEZhcmdvIFZQIENhcmwgTmVsc29uIOKAmGdhdmUgZmVtYWxlIHN1Ym9yZGluYXRlIHVud2FudGVkIG1hc3NhZ2VzLCBpbnZpdGVkIGhlciB0byBleGVyY2lzZSBhbmQgc2hvd2VyIHdpdGggaGlt4oCZOiBsYXdzdWl0CTwvaDE-PHRpdGxlPkJhY2sgQnV0dG9uPC90aXRsZT48dGl0bGU-U2VhcmNoIEljb248L3RpdGxlPjx0aXRsZT5GaWx0ZXIgSWNvbjwvdGl0bGU-&i6=MjAwMTo1NTA6MWQwNToxOjo0&n3pc=true
access-control-allow-origin: https://nypost.com
request-time: 0
access-control-allow-credentials: true
trace-id: c89dc27741336e2a
content-length: 0
x-xss-protection: 1; mode=block

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 217ms
60ms Preflight
text/plain 199.127.204.162
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.162 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Tue, 11 Jul 2023 01:55:09 GMT

POST
H/1.1 200
OK auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
468 B 893ms
173ms XHR
application/json 69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 5c59039af6915f1eff48f5cff821c72916f2912407e2d82f6166f75009dead15

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
x-prebid: pbs-java/1.123.0
Content-Type: application/json
access-control-allow-origin: https://nypost.com
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 173
Expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
820 B 219ms
74ms XHR
application/json 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:09 GMT
AN-X-Request-Uuid: 5c668651-0ddb-4880-a1a8-6809f52969f2
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://nypost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 23 B
360 B 293ms
131ms XHR
application/json 35.211.194.207
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson?sp=trustx
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.194.207 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 207.194.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a1fc5b095d6043f61d8da10e2eaeca73c6dc9a1dd38d37f12d1224cf963c7da4

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 11 Jul 2023 01:55:09 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 48

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
539 B 220ms
60ms XHR
application/json 34.232.232.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.39.0&referrer=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&tmax=6000&us_privacy=1---

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.232.232.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:09 GMT
accept-ch: sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model
x-auction-status: 12
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
158 B 275ms
158ms XHR
text/plain 199.127.204.162
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.127.204.162 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://nypost.com
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
541 B 228ms
150ms XHR
application/json 104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=509523
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68adbba90bf3db0d4a004e3b1ae14a83719e4a5397c6ee1c4a62b53d45255230

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BzBtTi7x4SZibV8Km3ZVFxzdTDewSqAfgqN1XQlEX81uca%2Batl0MTpzQE4mJNYy06tQkAOhXKQeh3umfO%2FZZ6e%2BMYaOaCkrMtfl012gsKFhMrGXXcnWo4x08rwS4eLCqs0ktR6gw"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7e4d6c324cd18dd9-MIA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 sprite.svg Show response
static-cdn.spot.im/production/icons/sprites/ 24 KB
10 KB 190ms
63ms Fetch
image/svg+xml 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/icons/sprites/sprite.svg
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/initial-bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 937085b9310af935b47f756a6326f86351c9fa0066de9e313e8cd6623ca0f888

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 06:51:26 GMT
x-amz-version-id: pTYPLm0WXSUOn4wsgJLXLuv5LYGbB.2s
content-encoding: br
via: 1.1 779925c9c68a6d4d8c35b729b0516a76.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C3
age: 68624
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 24 May 2023 11:40:02 GMT
server: AmazonS3
etag: W/"2a4e43326a158b47d0598571fd4099b6"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-amz-cf-id: _pIEaT273AN27z0MYlMN1xhBPI9rnNJu08llc-xR3MEfqKcQPUBiwQ==

GET
H2 200 device-load Show response
api-2-0.spot.im/v1.0.0/ 36 B
955 B 219ms
70ms Fetch
text/plain 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/device-load

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/initial-bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

fasthttp /

Resource Hash

8ad9ad7c523bdd69b6d7ca11f631af8cd659ab6fb882d9c7aa185c0a4d7c7fac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:09 GMT
via: 1.1 f8b0654d6e6bbf12f54a635de5db7ee4.cloudfront.net (CloudFront)
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
content-length: 36
x-guid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
server: fasthttp
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
x-amz-cf-id: ZMyfnzMW609l6l9H0LS88q9YyJUJoH2-OCKwJPlhuvX6j5ZCeo7RyA==

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/khH7Ei3klcvfRI74FvDcfuOo/ Frame 0EDB 55 KB
24 KB 199ms
65ms Stylesheet
text/css 2607:f8b0:4006:821::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/khH7Ei3klcvfRI74FvDcfuOo/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Leg3vIiAAAAAByX7xhKbJS8ZzblWErZEWeeILD1&co=aHR0cHM6Ly9ueXBvc3QuY29tOjQ0Mw..&hl=en&v=khH7Ei3klcvfRI74FvDcfuOo&size=invisible&cb=t15d8z6ujp7a

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 19:05:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 283762
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Sat, 24 Jun 2023 15:59:54 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 06 Jul 2024 19:05:47 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/khH7Ei3klcvfRI74FvDcfuOo/ Frame 0EDB 427 KB
172 KB 196ms
63ms Script
text/javascript 2607:f8b0:4006:821::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/khH7Ei3klcvfRI74FvDcfuOo/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

237f4a5b7b8e81b7ad01c54cbb6205368aa9d55e1d6fd1ef38454facdc01353c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 14:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42637
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 175692
x-xss-protection: 0
last-modified: Sat, 24 Jun 2023 15:59:54 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 09 Jul 2024 14:04:32 GMT

POST
H2 200 / Show response
r.skimresources.com/api/ 208 B
404 B 161ms
62ms XHR
application/json 35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/93051X1547088.skimlinks.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

openresty/1.19.9.1 /

Resource Hash

e832034ad794d0bd7e1ad8e68e8fa7a8a8c486ed4860410ec091b3ad4e0405e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 11 Jul 2023 01:55:09 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
server: openresty/1.19.9.1
via: 1.1 google
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
BLOB 200
OK 950cae27-d94f-474a-bd8f-3ab543c99b0f
https://nypost.com/ 105 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://nypost.com/950cae27-d94f-474a-bd8f-3ab543c99b0f
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 645f2622b1ef56af7976e82f92687a5362fe3d100e898fe41a5a5030332c2207

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Length: 107648
Content-Type

GET
BLOB 200
OK 3a167a9d-0980-4ae5-a0b4-0406fc96dcab
https://nypost.com/ 105 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://nypost.com/3a167a9d-0980-4ae5-a0b4-0406fc96dcab
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 645f2622b1ef56af7976e82f92687a5362fe3d100e898fe41a5a5030332c2207

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Length: 107648
Content-Type

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=6390601&cs_it=b8&cv=3.6&ns__t=1689040509806&ns_c=UTF-8&cj=1&c7=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-...
https://sb.scorecardresearch.com/b2?c1=2&c2=6390601&cs_it=b8&cv=3.6&ns__t=1689040509806&ns_c=UTF-8&cj=1&c7=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise...

0
225 B

69ms
68ms

Image
text/plain

13.35.93.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=6390601&cs_it=b8&cv=3.6&ns__t=1689040509806&ns_c=UTF-8&cj=1&c7=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&c8=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&c9=
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 13.35.93.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-31.jfk50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 cea4663e4864185add284e6e883e90f2.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: JFK50-P8
x-amz-cf-id: oUqN59q9wNzf72sgl98IOz9M-AEXvnVo403SV7JWbY0j5j_JaeEuKA==
x-cache: Miss from cloudfront

Redirect headers

date: Tue, 11 Jul 2023 01:55:09 GMT
via: 1.1 cea4663e4864185add284e6e883e90f2.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: JFK50-P8
x-cache: Miss from cloudfront
location: /b2?c1=2&c2=6390601&cs_it=b8&cv=3.6&ns__t=1689040509806&ns_c=UTF-8&cj=1&c7=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&c8=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&c9=
content-length: 0
x-amz-cf-id: DwGP2n1mPJXkauKQg2kETH81YcF2eihvddI_SPP6H3BOBbpCjuYR_Q==

GET
H2 200 get Show response
mv.outbrain.com/Multivac/api/ 21 KB
10 KB 819ms
211ms Script
text/x-json 199.232.38.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://mv.outbrain.com/Multivac/api/get?url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&idx=0&rand=3772&widgetJSId=SL_2&va=true&format=vjapi&pubInState=0&settings=true&recs=true&key=NANOWDGT01&adblck=false&abwl=false&ab=0&wl=0&umv=1&activeTab=true&version=2010370&sig=zeq6QPLM&apv=false&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&dpr=1&secured=true&cmpStat=0&ccpa=1---&ccpaStat=1&chs=1&ogn=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.38.132 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e69f7dfb5ec72c879642e011e028c8f7d28dd94809f005b5fd30b5765f80eae0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: br
via: 1.1 varnish
traffic-path: SADC1, LGA, USA_EAST1
x-cache: MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
x-traceid: fb2e1a947046d51a78e4a4f1dabfc7d8
content-length: 9820
x-served-by: cache-lga21940-LGA
pragma: no-cache
x-timer: S1689040510.458814,VS0,VE145
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 404 flyout Show response
api.nypdev.com/cdp/zephr/content/ 89 B
437 B 65ms
64ms Fetch
application/json 34.231.203.95
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.nypdev.com/cdp/zephr/content/flyout?gaClientId=777521527.1689040509

Requested by

Host: nypost.com
URL: https://nypost.com/wp-content/plugins/nyp-zephr/build/app.bundle.min.js?ver=bcdb84b11dc015415df7

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.231.203.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-231-203-95.compute-1.amazonaws.com

Software

nginx /

Resource Hash

ce49964544f9bac812578067fbcaffa3a710b3bb6dc062eed3bc66bdc75f29bd

Security Headers

Name	Value
Content-Security-Policy	default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
Authorization: Basic QGxsZXk6dmZEVEJPM1Y3cnJ5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-security-policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'
x-content-type-options: nosniff
strict-transport-security: max-age=63072000
server: nginx
x-frame-options: DENY
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
access-control-allow-headers: Content-Type,Authorization
content-length: 89

GET
H2 200 i Show response
v2.pixel.newscgp.com/ 43 B
203 B 71ms
71ms XHR
image/gif 34.102.180.215
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://v2.pixel.newscgp.com/i?stm=1689040510041&e=pv&url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&page=Page-View&eid=f23df90c-9eb8-4c1a-8e8c-3c52440886ef&tv=js-3.4.0&tna=_ncg__0&aid=newsconnect-global&p=web&cookie=1&cs=UTF-8&lang=en-US&res=1600x1200&cd=24&tz=Etc%2FUnknown&dtm=1689040510040&vp=1600x1200&ds=1600x6714&vid=1&sid=c00b2ac6-60e5-4356-b4a2-3b83d530caaf&duid=30996b67-0434-497a-b6f4-d40d7bd42d8d&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoiaWdsdTpjb20ubmV3c2NncC9ha2EvanNvbnNjaGVtYS8xLTAtMCIsImRhdGEiOnsidXNlcl9pZCI6IiIsInVzZXJfcHJvdmlkZXIiOiIiLCJ1c2VyX21lbXR5cGUiOiJhbm9ueW1vdXMiLCJ1c2VyX25ld3NsZXR0ZXJfaWQiOiIiLCJ1c2VyX25ld3NsZXR0ZXJfcHJvdmlkZXIiOiIiLCJicm93c2VyX2RtcF9pZCI6IjBhYTZkN2Y1LTE2ZGYtNDMzNS04ZTZlLWRjZDQ2NjkzOWY1MCIsImJyb3dzZXJfZG1wX3Byb3ZpZGVyIjoicGVybXV0aXZlIiwiYnJvd3Nlcl9hZHNfcHBpZCI6IiIsImJyb3dzZXJfYWRzX3Byb3ZpZGVyIjoiIiwiYnJvd3Nlcl9hbmFseXRpY3NfaWQiOiIiLCJicm93c2VyX2FuYWx5dGljc19wcm92aWRlciI6IiIsImJyb3dzZXJfbmNnX2lkIjoiIn19LHsic2NoZW1hIjoiaWdsdTpjb20ubmV3c2NncC9hcnRpY2xlL2pzb25zY2hlbWEvMS0wLTAiLCJkYXRhIjp7ImFydGljbGVfaWQiOiIyNjg5NzEyNiIsImFydGljbGVfc291cmNlIjoiQXJpZWwgWmlsYmVyIiwiYXJ0aWNsZV9wdWJsaXNoZWRfdGltZSI6IjIwMjMvMDUvMTAgMTM6MzU6MzAiLCJjb250ZW50X3R5cGUiOiJhcnRpY2xlIiwic2VjdGlvbiI6ImJ1c2luZXNzIiwic3Vic2VjdGlvbiI6IndlbGxzIGZhcmdvIiwic3Vic3Vic2VjdGlvbiI6IiIsInN1YnN1YnN1YnNlY3Rpb24iOiIiLCJzdWJzdWJzdWJzdWJzZWN0aW9uIjoiIiwiYXJ0aWNsZV9wYWlkX2NvbnRlbnRfdHlwZSI6IiJ9fSx7InNjaGVtYSI6ImlnbHU6Y29tLnNub3dwbG93YW5hbHl0aWNzLnNub3dwbG93L3dlYl9wYWdlL2pzb25zY2hlbWEvMS0wLTAiLCJkYXRhIjp7ImlkIjoiYWUxNTBiN2UtNGI4ZC00ZWU4LWIxNzQtOTI2YTEwZTRlZjZmIn19XX0
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/ncg/ncg.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.180.215 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 215.180.102.34.bc.googleusercontent.com
Software: akka-http/10.2.7 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:09 GMT
via: 1.1 google
server: akka-http/10.2.7
content-type: image/gif
access-control-allow-origin: https://nypost.com
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

POST
H3 200 identify Show response
api.permutive.com/v2.0/ 50 B
88 B 215ms
144ms XHR
application/json 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/identify?k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: 5b499dff10ff56ef3932b9ef329bc504a9fd312f85fe79ee9f70e58d789d06ec

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
via: 1.1 google
server: Permutive
vary: Origin
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 18D1
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&dcc=t

342 B
1 KB

81ms
81ms

Document
text/html

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&dcc=t

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

1c291992c1fd69a36327bf8c07b415535eb6a3350db0e57ce784907b2fce299d

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 342
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 11 Jul 2023 01:55:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 2G7M3X94X4XEQG8KY6M8

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 11 Jul 2023 01:55:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: N80QKPF0KS3M3032AM96

GET
H2 200 ts_.htm Show response
t.nypost.com/a/ Frame ADB7 2 KB
1 KB 113ms
93ms Document
text/html 18.164.96.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.nypost.com/a/ts_.htm?ver=1.1183.65&cid=c057
Requested by: Host: t.nypost.com
URL: https://t.nypost.com/1/e/tcs.dhj?dmn=nypost.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-7.jfk50.r.cloudfront.net
Software: /
Resource Hash: f52a25986db575f3b50734266b36cfe7d8e6889805d089e9963ae3b064aa7dc3

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=604800
content-encoding: gzip
content-length: 1149
content-type: text/html
date: Tue, 11 Jul 2023 01:55:10 GMT
expires: Tue, 18 Jul 2023 01:55:10 GMT
via: 1.1 48fa2d8b9525abe889eff7ccc8591f7e.cloudfront.net (CloudFront)
x-amz-cf-id: 8a1FEY7vBygX4AOi3p6cwaYMxTSNELowsTXZkL4wkZT_OFI6h__vyw==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
x-robots-tag: noindex, nofollow

GET
H/1.1 200
OK 7901054_240.jpg
img5.zergnet.com/ 16 KB
16 KB 353ms
75ms Image
image/jpeg 18.164.96.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img5.zergnet.com/7901054_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-3.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1d056762f1152db6d51baa2fc0ad8a5f6cf9f1ba0cf0413a0833386357565b22

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 10 Jul 2023 20:04:28 GMT
x-amz-version-id: yEeDaSvNUlm_wCvH0I7KtNGSDtksBo.J
Via: 1.1 f5527f719bbc0d2932043daaeff80252.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 21043
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 15996
Last-Modified: Mon, 10 Jul 2023 20:03:37 GMT
Server: AmazonS3
ETag: "e01a2015a722eccb30421f08616f3844"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: 9scKfsuH9kYkd9j1vniTJgrEAe1KWILaAtiSNdgVWOze58PdQGPEFA==
Expires: Wed, 10 Jul 2024 20:03:36 GMT

GET
H/1.1 200
OK 7860418_240.jpg
img5.zergnet.com/ 21 KB
21 KB 348ms
70ms Image
image/jpeg 18.164.96.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img5.zergnet.com/7860418_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-3.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5c1040d7798158584cca235a980658e4c965a9ec7b301d94e12ccadbf045afc5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Wed, 14 Jun 2023 21:45:00 GMT
x-amz-version-id: XOYNNQauER.GyResEUq5c52fjL6QCiA1
Via: 1.1 241db89625f6ef70a00b0e19e0cfc332.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 2261411
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 21128
Last-Modified: Wed, 14 Jun 2023 21:42:57 GMT
Server: AmazonS3
ETag: "3ebf770ab7694b76526e95afcb338bba"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: pQUZwDDj1fWUj5yt7KGtFSz4ICsz3agpAzq2kNnqUtJN8-IUafkBCw==
Expires: Fri, 14 Jun 2024 21:42:56 GMT

GET
H/1.1 200
OK 7873911_240.jpg
img4.zergnet.com/ 15 KB
16 KB 349ms
73ms Image
image/jpeg 18.164.96.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img4.zergnet.com/7873911_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-129.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 86427d8b831aaed4762d3457151d4f389cf54e0ffbb6aa619bb4981341fc221e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 23 Jun 2023 15:36:28 GMT
x-amz-version-id: ag3j8pK_MUItnvATMXQG7LlBRr.dkkLy
Via: 1.1 f8b0654d6e6bbf12f54a635de5db7ee4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 1505923
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 15716
Last-Modified: Fri, 23 Jun 2023 15:33:57 GMT
Server: AmazonS3
ETag: "a4a936133d6b959f21d877b225a3e6b6"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: snv5HIiKJn33LU7W5Ph-vKArIKBvLfCxM-6Tf8p2COkEJb-uSRhmxw==
Expires: Sun, 23 Jun 2024 15:33:56 GMT

GET
H/1.1 200
OK 7808632_240.jpg
img1.zergnet.com/ 16 KB
17 KB 353ms
75ms Image
image/jpeg 18.164.96.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img1.zergnet.com/7808632_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-129.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e536e15aba0f23d92436f28134a2372f84cf6c09391a144d636914d7778fefaa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Wed, 17 May 2023 00:13:20 GMT
x-amz-version-id: 1pdt3pGKK._IdjPvDgbwD.dnkRH7qVto
Via: 1.1 9750f5ee94b45ad0faba87b3fac2aad6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 4758111
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 16224
Last-Modified: Wed, 17 May 2023 00:07:54 GMT
Server: AmazonS3
ETag: "7d1ea743b18735559e8ffaa4c205ba69"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: u3BEM5vFJXlirAUMxraqn61mGDIR31qnuMk-3Sm_e1Md6OkjUA3Fqg==
Expires: Fri, 17 May 2024 00:07:53 GMT

GET
H/1.1 200
OK 7864238_240.jpg
img5.zergnet.com/ 15 KB
15 KB 348ms
70ms Image
image/jpeg 18.164.96.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img5.zergnet.com/7864238_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-3.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d4c3d74ce6ccf3097e6fb5df1fecad49e444f5d0ff6fac190bb342007069a4ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 16 Jun 2023 17:45:30 GMT
x-amz-version-id: r1f9G0aMGOGTw6lMMKKHIFYFgtuflqUX
Via: 1.1 f8debc28b6c73eb3dc7540e2ac2f0e18.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 2102981
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 15143
Last-Modified: Fri, 16 Jun 2023 17:39:03 GMT
Server: AmazonS3
ETag: "7e6ffb4551bd3fb33235775021865bf5"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: 7vshNkgnhxwhxpm4Y9zVqDauWwe9wDUKC5HyZ3Co1LpK0jTWYBAgkA==
Expires: Sun, 16 Jun 2024 17:39:02 GMT

GET
H/1.1 200
OK 7774427_240.jpg
img4.zergnet.com/ 15 KB
16 KB 349ms
74ms Image
image/jpeg 18.164.96.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img4.zergnet.com/7774427_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-129.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ef753f248a15e8744c37e88ad5211991aac5a1de53a26f2a141cf6b523296555

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 27 Apr 2023 19:07:08 GMT
x-amz-version-id: U9ssA_tvIBHSbvv8xou0AyKZBW21lGXi
Via: 1.1 8a9cdb228e33f8d52a4b42c56ca26590.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 6418082
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 15565
Last-Modified: Thu, 27 Apr 2023 19:05:52 GMT
Server: AmazonS3
ETag: "0b04fbb26492853f741b96be1806a9a3"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: 39FjWWfV_Cc3JUkxhRMAUXAxAlYtVe_Uex2kILXrhwBHg2Qx1BhXJA==
Expires: Sat, 27 Apr 2024 19:05:51 GMT

GET
H/1.1 200
OK 7820997_240.jpg
img2.zergnet.com/ 17 KB
18 KB 348ms
72ms Image
image/jpeg 18.164.96.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img2.zergnet.com/7820997_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-129.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0439937133fa67bb1c9f2bc73c56975daff4472b5acf51e0eb634e1ef25505cd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Mon, 26 Jun 2023 11:45:51 GMT
x-amz-version-id: beSoQy7snPDZRRoaOU2bPh.UyRzmvO.2
Via: 1.1 38bc9c97daf30f968ccac44ef89e14e0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 1260560
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 17908
Last-Modified: Tue, 23 May 2023 18:22:27 GMT
Server: AmazonS3
ETag: "7f4f0efa1781da76e9845cdcf07171f6"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: BGi3w4fgQfJ6-o4-5vIgmT9YBFpEaC-IvdwREDPt0nY4C_aNGC81-g==
Expires: Thu, 23 May 2024 18:22:26 GMT

GET
H/1.1 200
OK 7422120_240.jpg
img1.zergnet.com/ 12 KB
13 KB 345ms
70ms Image
image/jpeg 18.164.96.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img1.zergnet.com/7422120_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-129.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dffd5b4e63cac13a2f0e3e10742b0e65e3cf351da34eca09bbaf2f39390b020b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 18 May 2023 05:04:52 GMT
x-amz-version-id: 918w1DWGo1QwMjMCIC4XZBcflBzV1cxO
Via: 1.1 f8debc28b6c73eb3dc7540e2ac2f0e18.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 4654219
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 12522
Last-Modified: Wed, 14 Sep 2022 17:04:29 GMT
Server: AmazonS3
ETag: "7f26484cdd2c2989ded0143e6e9fbbf7"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: oVKVw6qMhFAX-nP5dqE-dcxdUhqtdAd8dA01pdefZSkr0S9QR9gAmA==
Expires: Thu, 14 Sep 2023 17:04:28 GMT

GET
H/1.1 200
OK 7871343_240.jpg
img4.zergnet.com/ 13 KB
13 KB 346ms
75ms Image
image/jpeg 18.164.96.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img4.zergnet.com/7871343_240.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-129.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ca158da323200345a8a6c64a88d7ebc14b4fa97d4c2808c0617c197dfeb4850

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 16:04:33 GMT
x-amz-version-id: f37w5vGHU1.QmSSsPf7e6ApKhlQk_CC0
Via: 1.1 fa503ecd9278a874859948f3b586c782.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P5
Age: 1590638
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 12963
Last-Modified: Thu, 22 Jun 2023 15:54:59 GMT
Server: AmazonS3
ETag: "a205b7aec8babf4662f42017dba597fe"
Content-Type: image/jpeg
Cache-Control: max-age=290304000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: oPutTgBwfwW-_GcYUFUjtFVi1lFT8ySmn47UnQe2LqXaQqQrUDcAbQ==
Expires: Sat, 22 Jun 2024 15:54:58 GMT

GET
H2 200 main-v2_46fda4c4cd50b5cb3297856d2cfd7fd9.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 581 KB
112 KB 36ms
32ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_46fda4c4cd50b5cb3297856d2cfd7fd9.br.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 342e860e6f0525bc68e42aed83a7a891f8a769dca50d977d6d57004e1c0fbcc4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 18:14:07 GMT
content-encoding: br
age: 27663
x-guploader-uploadid: ADPycduvtTwupYMEYzlXCqSHBvvu137a0Wq9Rk6Xn-cq-MxehWs6r8NWNdCzMW_ox56qfSOW9hktxpfqF1u40l1r9vt_PUdKbxow
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 114307
last-modified: Mon, 10 Jul 2023 18:13:59 GMT
server: UploadServer
etag: "b4f501976b00c8eeee927df467e8817f"
x-goog-generation: 1689012839958178
x-goog-hash: crc32c=aLGbRg==, md5=tPUBl2sAyO7ukn30Z+iBfw==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=3600
x-goog-stored-content-length: 114307
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 cjs_min_74cb4632fbcf5cdfa301cb523939aa09.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 73 KB
26 KB 111ms
107ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_74cb4632fbcf5cdfa301cb523939aa09.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b574acf582cf85f33f08afedff36cde729cedc0d651d6a129d425b640cb72779

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 12:17:52 GMT
content-encoding: gzip
age: 49038
x-guploader-uploadid: ADPycdtbsknv9fozKOFwzuNPNkJ0DI1_dy5U0PPaubgvGKp13jMP1RCnl62RfHuIGJxW-Lr-ERz67UglOF6iKnIzyJo3gVnkYGEz
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26403
last-modified: Fri, 30 Jun 2023 14:29:49 GMT
server: UploadServer
etag: "3c55594dd4b82abae2344ff2f94edee3"
x-goog-generation: 1688135389153547
x-goog-hash: crc32c=BsUKjw==, md5=PFVZTdS4KrriNE/y+U7e4w==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=3600,no-transform
x-goog-stored-content-length: 26403
accept-ranges: bytes
content-type: text/javascript; charset=utf-8

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 47ms
46ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1555038604&t=pageview&_s=1&dl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ul=en-us&de=UTF-8&dt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAiEAjBAQCACAAI~&jid=1254965261&gjid=1625771816&cid=777521527.1689040509&tid=UA-3922003-6&_gid=1775602677.1689040510&_slc=1&cd88=777521527.1689040509&cd8=desktop&cd3=lawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo&cd2=Ariel%20Zilber&cd1=article&cd5=standard&cd6=Wells%20Fargo%20VP%20Carl%20Nelson%20%27gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&cd7=&cd12=Wells%20Fargo%20VP%20%27gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&cd9=2023-05-10&cd10=13%3A%2035&cd11=26897126&cd4=business&cd15=wells%20fargo&cd87=Outbrain%20Guarantee&cd16=704&cd17=no&cd40=no&cd44=no&cd54=true&cd76=In-line&cd21=yes&cd46=false&cg1=article&cg2=business&cg3=nypost.com&z=1059647061

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
343 B 322ms
72ms XHR
text/plain 2607:f8b0:4004:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-3922003-6&cid=777521527.1689040509&jid=1254965261&gjid=1625771816&_gid=1775602677.1689040510&_u=aCDAiEAjBAQCAGAAI~&z=1421412604

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9a Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 11 Jul 2023 01:55:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 12 KB
4 KB 127ms
44ms Script
application/javascript 104.18.35.34
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.34 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d285ae6755d52c452904f5bdfa4a6c2082186d695304b242e9db2f12461f02e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 15 Jun 2023 16:15:13 GMT
server: cloudflare
age: 21479
etag: W/"648b3911-2e4b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
cf-ray: 7e4d6c374b4cb3d1-MIA
expires: Wed, 12 Jul 2023 01:55:10 GMT

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
901 B 111ms
33ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 11 Jul 2023 01:55:10 GMT
x-content-type-options: nosniff
content-encoding: br
age: 9316
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-mia-kmia1760048-MIA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 150ms
33ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 19 Jun 2023 15:56:02 GMT
content-encoding: gzip
age: 1850348
x-guploader-uploadid: ADPycds5z7CPq5iQYRs5Y1MngTlvVgMhygjQ5kW0E0Y4nfxmhv5KjZ2bhE_l1IkRgpIIWvk0cnn5LXfYiKLXaSMLhtFYZ78iz343
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Tue, 18 Jun 2024 15:56:02 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 222ms
107ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

20e74dbf3ee183f6fe1447dd7efef616905f78e10733e618dfd67f54c8a25ca8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 29 Jun 2023 05:28:55 GMT
server: nginx
etag: W/"649d1697-a980"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 12 Jul 2023 01:55:10 GMT

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 213ms
65ms Script
text/javascript 2600:9000:2511:7200:a:e047:753:be1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:7200:a:e047:753:be1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: null
Date: Mon, 10 Jul 2023 09:17:01 GMT
Via: 1.1 05b3bdb53d1146d1176c185d2da0d530.cloudfront.net (CloudFront)
Last-Modified: Thu, 04 May 2023 00:14:06 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P6
Age: 59890
x-amz-server-side-encryption: AES256
ETag: "4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1858
X-Amz-Cf-Id: uQPsRDIynkTNQ0alnSc97zUEy7ikWgSGCM1ZdObtvxGXR0AG2rUPsg==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 102 KB
25 KB 133ms
55ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4924e12a30059184d9bd1c36294dcdf957f5f2da452209448b35a93aa785cca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Jun 2023 08:35:03 GMT
server: cloudflare
x-amz-request-id: 296HGH9AWGWDPZAQ
age: 333
etag: W/"9b8b8eb50e4814cbdc325ce477c96910"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7e4d6c373dd4336d-MIA
x-amz-id-2: 3RKFGYtr3l0Up1DMRhF38EZuGynvbaOvmskyoG2jqCU7pjpTJWnYn+p8bEqzYa3b78qVqwF1RI+8+TMi+wQI0w==

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 38 KB
12 KB 214ms
66ms Script
text/javascript 108.138.128.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-28.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0c2ec1f2d626ab278d81abe34d30681f0007e8c79a890165f27e3e1550e99b7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 05:20:10 GMT
content-encoding: gzip
via: 1.1 57eada8217c838cfdc4ec177bbe3523c.cloudfront.net (CloudFront)
last-modified: Wed, 31 May 2023 20:34:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 74101
x-amz-server-side-encryption: AES256
etag: W/"550ead3a95bd6cfcd917d45c5f8f4553"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: Q5LMVFHFBo3CHej4t3b572h3f3aqVzkEWS-cvtuvA50jmPLMAZt5dA==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
2 KB 228ms
150ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 1c54b9d1b579c59f8245fd21a021725c0dbde06ec90f44df1bbc03458f40dfe8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 google, 1.1 google
last-modified: Wed, 05 Jul 2023 19:08:57 GMT
server: Google Frontend
etag: 6c49a4094d9a446bdc7fe3d19d23b4c7
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 7ab398a69c2732df38639d78e754193d
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1311

GET
H2 200 skin-622640.json Show response
video.unrulymedia.com/native/skins/ 2 KB
1019 B 181ms
180ms XHR
application/json 2606:4700::6812:184e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://video.unrulymedia.com/native/skins/skin-622640.json
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/custom/unruly/outstream/skin.js?site_id=622640
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:184e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f11fff395615749f7d73545799ed746cab0761185e45db32432454cdbf7cfa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
x-amz-version-id: 7VS4yQ_i3zAACB7.pdhYtbIwBWds9c6o
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-request-id: M4EPNRS1EHF56K42
x-amz-server-side-encryption: AES256
x-amz-id-2: qVkzcNamZT+UOPCMOyOlb02eLOlQjcYOqL6Y3fsP/zPo9vzqem3om/3Q88zY0zNgVyycZVNL+F4=
x-amz-expiration: expiry-date="Thu, 20 Jun 2030 00:00:00 GMT", rule-id="Delete after 7 years"
last-modified: Wed, 21 Jun 2023 21:58:39 GMT
server: cloudflare
etag: W/"1dea42d96c6ebb0a28394c7bfacb01b5"
access-control-max-age: 3000
access-control-allow-methods: HEAD, GET
content-type: application/json
access-control-allow-origin: https://nypost.com
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: max-age=3600
cf-ray: 7e4d6c34fd8667bc-MIA

GET
H2 200 track
track1.aniview.com/ 0
97 B 207ms
59ms Image
text/plain 34.230.174.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?pid=603f65a2e291680ef30af9c7&cid=6265145b67ce6a604d44ebf5&cb=1689040510218&r=nypost.com&stagid=62af35d851923c62777207b4&stplid=&cd10=&e=c9&cd11=1-run
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.174.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-174-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
track1.aniview.com/ 0
98 B 93ms
57ms Image
text/plain 34.230.174.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?pid=603f65a2e291680ef30af9c7&cid=6265145b67ce6a604d44ebf5&cb=1689040510218&r=nypost.com&stagid=62af35d851923c62777207b4&stplid=&cd10=622640&e=c9&cd11=2-tag
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.174.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-174-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
88 B 58ms
56ms XHR
application/javascript 35.201.67.47
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/93051X1547088.skimlinks.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.10 aiohttp/3.8.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.10 aiohttp/3.8.4
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://nypost.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
content-length: 22
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 link Show response
t.skimresources.com/api/v2/ 22 B
362 B 56ms
55ms XHR
application/javascript 35.201.67.47
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/93051X1547088.skimlinks.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.10 aiohttp/3.8.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.10 aiohttp/3.8.4
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://nypost.com
warning: 299 - "Deprecated API"
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
content-length: 22
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H3 200 5e3d2ac36e566b946db6e358b56dc6aa1bf1a2ec9cf Show response
rebelhen.com/confirm/f67fe2245/ 198 B
225 B 115ms
64ms Fetch
application/json 2600:1901:0:7416::1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rebelhen.com/confirm/f67fe2245/5e3d2ac36e566b946db6e358b56dc6aa1bf1a2ec9cf

Requested by

Host: rebelhen.com
URL: https://rebelhen.com/v2csnUsFoH1XR1oW51-C6NQBdGmIS6hRimi-eyRebi0VRmqDrwM_hCHQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:7416::1 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

ef39c2f6cdaacd09d5137ef2169fc40be4e57c36cf33d4446eddcc8018021535

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 google
x-buildnumber: 924731853
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 198
x-datacenter: gce-us-east1
x-buildname: hoothoot
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
x-hostname: fen-hoothoot-us-east1-test-jrrc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
expires: Tue, 11 Jul 2023 01:55:09 GMT

GET
H2 200 26897126 Show response
api-2-0.spot.im/v1.0.0/config/ab_test/sp_Sx8YukwE/ 135 B
896 B 72ms
70ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/config/ab_test/sp_Sx8YukwE/26897126

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/480-bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

212.117.120.34.bc.googleusercontent.com

Software

fasthttp /

Resource Hash

63d6272a32aa24d12fd7d06f1f808d7667bba57c9afb4e38d53789f20093bb3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: application/json
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-spotim-page-view-id: 7c0165b7-2b99-4969-ad26-befdcc2f3ff1
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 f8b0654d6e6bbf12f54a635de5db7ee4.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
content-length: 135
x-request-id: f7e6e71c-1f8d-11ee-bedb-02c1699a1269
server: fasthttp
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
x-amz-cf-id: 78dC7enZE3kk3SoGyNWHk3ezYVloYTpQ4CmrrW8hHS4X2umZJoRFeQ==

POST
H3 200 api Show response
ls.skimresources.com/ 2 B
22 B 197ms
160ms XHR
application/json 34.120.117.212
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ls.skimresources.com/api

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/93051X1547088.skimlinks.js?ver=1.0.0

Protocol

Security

QUIC, , AES_128_GCM

Server

34.120.117.212 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Python/3.10 aiohttp/3.8.4 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-type: application/json

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.10 aiohttp/3.8.4
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
content-length: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 0EDB 2 KB
2 KB 64ms
63ms Image
image/png 2607:f8b0:4006:821::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/khH7Ei3klcvfRI74FvDcfuOo/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/khH7Ei3klcvfRI74FvDcfuOo/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 10:27:06 GMT
x-content-type-options: nosniff
age: 228484
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Sat, 15 Jul 2023 10:27:06 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 0EDB 15 KB
16 KB 208ms
69ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 10:06:54 GMT
x-content-type-options: nosniff
age: 229696
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 07 Jul 2024 10:06:54 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 0EDB 15 KB
15 KB 219ms
80ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 08 Jul 2023 10:07:50 GMT
x-content-type-options: nosniff
age: 229640
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 07 Jul 2024 10:07:50 GMT

OPTIONS
H2 200 flyout
api.nypdev.com/cdp/zephr/content/ Frame 0
0 473ms
62ms Preflight
application/json 34.231.203.95
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.nypdev.com/cdp/zephr/content/flyout?gaClientId=777521527.1689040509

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.231.203.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-231-203-95.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: GET
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,Authorization
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 0
content-security-policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'
content-type: application/json
date: Tue, 11 Jul 2023 01:55:10 GMT
server: nginx
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-frame-options: DENY

OPTIONS
H2 200 26897126
api-2-0.spot.im/v1.0.0/config/ab_test/sp_Sx8YukwE/ Frame 0
0 198ms
71ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/config/ab_test/sp_Sx8YukwE/26897126

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-spotim-device-uuid,x-spotim-page-view-id
Access-Control-Request-Method: GET
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:10 GMT
server: fasthttp
strict-transport-security: max-age=31536000
via: 1.1 5a7c529ef93438ca768c3432355a6e72.cloudfront.net (CloudFront)
x-amz-cf-id: 9DzeyVpEouwTqxeMe-UmKvupdUmmFrHSqk6Yb-pJ1LXn73-OtC_MzA==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

OPTIONS
H2 206 api
ls.skimresources.com/ Frame 0
0 207ms
54ms Preflight
text/plain 34.120.117.212
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ls.skimresources.com/api
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.117.212 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 212.117.120.34.bc.googleusercontent.com
Software: Python/3.10 aiohttp/3.8.4 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain charset=UTF-8
date: Tue, 11 Jul 2023 01:55:10 GMT
server: Python/3.10 aiohttp/3.8.4
via: 1.1 google

POST
H2 200 cookie_sync Show response
pg-prebid-server.rubiconproject.com/ 3 KB
825 B 398ms
116ms XHR
application/json 54.201.51.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pg-prebid-server.rubiconproject.com/cookie_sync
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.201.51.145 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-201-51-145.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e2accf5802fae5b9b5bd43d57b60ac0f2f4087a9d057f28395a0ae3ed13808d4

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 614
expires: 0

POST
H2 200 auction Show response
pg-prebid-server.rubiconproject.com/openrtb2/ 187 B
409 B 411ms
135ms XHR
application/json 54.201.51.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pg-prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.201.51.145 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-201-51-145.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: c0fd4c859e310f94359ea7e5cac7a09cd967c760b24bdac32f24a4c9bd894b97

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
x-prebid: pbs-java/1.123.0
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 178
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
820 B 72ms
71ms XHR
application/json 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:10 GMT
AN-X-Request-Uuid: ec148e4c-5b89-497d-946a-4a9d848095d5
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://nypost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
361 B 285ms
285ms XHR
application/json 35.211.194.207
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson?sp=trustx
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.194.207 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 207.194.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ad052ce0aff7ef5b06d6acf052d90d5da69c5f37fb3fe820deb9e00e84987c5f

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 11 Jul 2023 01:55:10 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 120 B
965 B 512ms
430ms XHR
application/json 104.18.43.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.43.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd8113d677711a9598e55e02e08940658c7c7935b3cdf629a4a8a6247a1216ed

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 7e4d6c368cba02ed-MIA
expires: 0

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
655 B 404ms
188ms XHR
application/json 34.231.135.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2244ab73ef-e1ea-4fb0-9297-5a6fdddbdbac%22%2C%22requestCount%22%3A0%2C%22timeout%22%3A2000%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1689040510385%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%223450f52c2ad8701%22%3A%22_fomZp7UJsG%22%2C%223539c2d59c1b47c%22%3A%22_o5pE7T6j5A%22%2C%22363e2884ae3e931%22%3A%22_o5pE7T6j5A%22%2C%22370ea01a129491b%22%3A%22_o5pE7T6j5A%22%7D%2C%22bidSizes%22%3A%7B%223450f52c2ad8701%22%3A%5B%5B970%2C250%5D%5D%2C%223539c2d59c1b47c%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22363e2884ae3e931%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22370ea01a129491b%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%7D%2C%22device%22%3A%7B%22width%22%3A1600%2C%22height%22%3A1200%2C%22sua%22%3A%7B%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%7D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_fomZp7UJsG%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22tid%22%3A%2243a3236d-ba5a-4c04-830a-36f4c7c56ef8%22%2C%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories%22%7D%2C%22pbadslot%22%3A%22%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories%22%7D%2C%22gpid%22%3A%22%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22pos%22%3A1%2C%22sizes%22%3A%5B%5B970%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22div-gpt-ad-billb_atf%22%2C%22transactionId%22%3A%2243a3236d-ba5a-4c04-830a-36f4c7c56ef8%22%2C%22sizes%22%3A%5B%5B970%2C250%5D%5D%2C%22bidId%22%3A%223450f52c2ad8701%22%2C%22bidderRequestId%22%3A%2233a73a21a65f435%22%2C%22auctionId%22%3A%22ab0a5859-a2db-47b0-be13-cd4b4f348fe4%22%2C%22src%22%3A%22client%22%2C%22metrics%22%3A%7B%22userId.init.gdpr%22%3A%5B0%5D%2C%22userId.mod.init%22%3A%5B13.700000762939453%2C0.5999984741210938%5D%2C%22userId.mods.sharedId.init%22%3A%5B13.700000762939453%5D%2C%22userId.mods.unifiedId.init%22%3A%5B0.5999984741210938%5D%2C%22userId.init.modules%22%3A%5B17%5D%2C%22requestBids.usp%22%3A0.5999984741210938%2C%22requestBids.userId%22%3A1.2999992370605469%2C%22requestBids.rtd%22%3A87.70000076293945%2C%22requestBids.validate%22%3A0.7000007629394531%2C%22requestBids.makeRequests%22%3A14.599998474121094%2C%22adapter.client.validate%22%3A0.09999847412109375%2C%22adapters.client.kargo.validate%22%3A0.09999847412109375%7D%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%2C%22ortb2%22%3A%7B%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F%22%2C%22domain%22%3A%22nypost.com%22%2C%22keywords%22%3A%22Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%22%2C%22publisher%22%3A%7B%22domain%22%3A%22nypost.com%22%7D%2C%22name%22%3A%22nypost.com%22%2C%22cat%22%3A%5B%22IAB1%22%2C%22IAB12%22%2C%22IAB17%22%5D%2C%22page_type%22%3A%22article%22%2C%22testgroup%22%3A%2276%22%2C%22ext%22%3A%7B%22data%22%3A%7B%22pagesection%22%3A%22business%22%2C%22pagetype%22%3A%22article%22%7D%7D%2C%22psg%22%3A%22300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_o5pE7T6j5A%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22tid%22%3A%2249bdd83a-ec08-48a1-8c83-f4848776ebcd%22%2C%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F5850%2Fpost.desktop%2Frec_atf%2Fbusiness%2Fstories%22%7D%2C%22pbadslot%22%3A%22%2F5850%2Fpost.desktop%2Frec_atf%2Fbusiness%2Fstories%22%7D%2C%22gpid%22%3A%22%2F5850%2Fpost.desktop%2Frec_atf%2Fbusiness%2Fstories%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22pos%22%3A1%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22div-gpt-ad-rec_atf%22%2C%22transactionId%22%3A%2249bdd83a-ec08-48a1-8c83-f4848776ebcd%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22bidId%22%3A%223539c2d59c1b47c%22%2C%22bidderRequestId%22%3A%2233a73a21a65f435%22%2C%22auctionId%22%3A%22ab0a5859-a2db-47b0-be13-cd4b4f348fe4%22%2C%22src%22%3A%22client%22%2C%22metrics%22%3A%7B%22userId.init.gdpr%22%3A%5B0%5D%2C%22userId.mod.init%22%3A%5B13.700000762939453%2C0.5999984741210938%5D%2C%22userId.mods.sharedId.init%22%3A%5B13.700000762939453%5D%2C%22userId.mods.unifiedId.init%22%3A%5B0.5999984741210938%5D%2C%22userId.init.modules%22%3A%5B17%5D%2C%22requestBids.usp%22%3A0.5999984741210938%2C%22requestBids.userId%22%3A1.2999992370605469%2C%22requestBids.rtd%22%3A87.70000076293945%2C%22requestBids.validate%22%3A0.7000007629394531%2C%22requestBids.makeRequests%22%3A14.599998474121094%2C%22adapter.client.validate%22%3A0.09999847412109375%2C%22adapters.client.kargo.validate%22%3A0.09999847412109375%7D%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%2C%22ortb2%22%3A%7B%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F%22%2C%22domain%22%3A%22nypost.com%22%2C%22keywords%22%3A%22Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%22%2C%22publisher%22%3A%7B%22domain%22%3A%22nypost.com%22%7D%2C%22name%22%3A%22nypost.com%22%2C%22cat%22%3A%5B%22IAB1%22%2C%22IAB12%22%2C%22IAB17%22%5D%2C%22page_type%22%3A%22article%22%2C%22testgroup%22%3A%2276%22%2C%22ext%22%3A%7B%22data%22%3A%7B%22pagesection%22%3A%22business%22%2C%22pagetype%22%3A%22article%22%7D%7D%2C%22psg%22%3A%22300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_o5pE7T6j5A%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22tid%22%3A%221d4d876f-711e-404b-bafa-6abc6ce7e5d3%22%2C%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F5850%2Fpost.desktop%2Frec_btf%2Fbusiness%2Fstories%22%7D%2C%22pbadslot%22%3A%22%2F5850%2Fpost.desktop%2Frec_btf%2Fbusiness%2Fstories%22%7D%2C%22gpid%22%3A%22%2F5850%2Fpost.desktop%2Frec_btf%2Fbusiness%2Fstories%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22pos%22%3A1%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22div-gpt-ad-rec_btf%22%2C%22transactionId%22%3A%221d4d876f-711e-404b-bafa-6abc6ce7e5d3%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22bidId%22%3A%22363e2884ae3e931%22%2C%22bidderRequestId%22%3A%2233a73a21a65f435%22%2C%22auctionId%22%3A%22ab0a5859-a2db-47b0-be13-cd4b4f348fe4%22%2C%22src%22%3A%22client%22%2C%22metrics%22%3A%7B%22userId.init.gdpr%22%3A%5B0%5D%2C%22userId.mod.init%22%3A%5B13.700000762939453%2C0.5999984741210938%5D%2C%22userId.mods.sharedId.init%22%3A%5B13.700000762939453%5D%2C%22userId.mods.unifiedId.init%22%3A%5B0.5999984741210938%5D%2C%22userId.init.modules%22%3A%5B17%5D%2C%22requestBids.usp%22%3A0.5999984741210938%2C%22requestBids.userId%22%3A1.2999992370605469%2C%22requestBids.rtd%22%3A87.70000076293945%2C%22requestBids.validate%22%3A0.7000007629394531%2C%22requestBids.makeRequests%22%3A14.599998474121094%2C%22adapter.client.validate%22%3A0.09999847412109375%2C%22adapters.client.kargo.validate%22%3A0.09999847412109375%7D%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%2C%22ortb2%22%3A%7B%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F%22%2C%22domain%22%3A%22nypost.com%22%2C%22keywords%22%3A%22Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%22%2C%22publisher%22%3A%7B%22domain%22%3A%22nypost.com%22%7D%2C%22name%22%3A%22nypost.com%22%2C%22cat%22%3A%5B%22IAB1%22%2C%22IAB12%22%2C%22IAB17%22%5D%2C%22page_type%22%3A%22article%22%2C%22testgroup%22%3A%2276%22%2C%22ext%22%3A%7B%22data%22%3A%7B%22pagesection%22%3A%22business%22%2C%22pagetype%22%3A%22article%22%7D%7D%2C%22psg%22%3A%22300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D%7D%2C%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_o5pE7T6j5A%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%2C%22atype%22%3A1%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22tid%22%3A%221be26050-7fcf-4445-89a6-5200a01e08c1%22%2C%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F5850%2Fpost.desktop%2Frec_widget%2Fbusiness%2Fstories%22%7D%2C%22pbadslot%22%3A%22%2F5850%2Fpost.desktop%2Frec_widget%2Fbusiness%2Fstories%22%7D%2C%22gpid%22%3A%22%2F5850%2Fpost.desktop%2Frec_widget%2Fbusiness%2Fstories%22%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22pos%22%3A1%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22div-gpt-ad-rec_widget%22%2C%22transactionId%22%3A%221be26050-7fcf-4445-89a6-5200a01e08c1%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22bidId%22%3A%22370ea01a129491b%22%2C%22bidderRequestId%22%3A%2233a73a21a65f435%22%2C%22auctionId%22%3A%22ab0a5859-a2db-47b0-be13-cd4b4f348fe4%22%2C%22src%22%3A%22client%22%2C%22metrics%22%3A%7B%22userId.init.gdpr%22%3A%5B0%5D%2C%22userId.mod.init%22%3A%5B13.700000762939453%2C0.5999984741210938%5D%2C%22userId.mods.sharedId.init%22%3A%5B13.700000762939453%5D%2C%22userId.mods.unifiedId.init%22%3A%5B0.5999984741210938%5D%2C%22userId.init.modules%22%3A%5B17%5D%2C%22requestBids.usp%22%3A0.5999984741210938%2C%22requestBids.userId%22%3A1.2999992370605469%2C%22requestBids.rtd%22%3A87.70000076293945%2C%22requestBids.validate%22%3A0.7000007629394531%2C%22requestBids.makeRequests%22%3A14.599998474121094%2C%22adapter.client.validate%22%3A0.09999847412109375%2C%22adapters.client.kargo.validate%22%3A0.09999847412109375%7D%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%2C%22ortb2%22%3A%7B%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F%22%2C%22domain%22%3A%22nypost.com%22%2C%22keywords%22%3A%22Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%22%2C%22publisher%22%3A%7B%22domain%22%3A%22nypost.com%22%7D%2C%22name%22%3A%22nypost.com%22%2C%22cat%22%3A%5B%22IAB1%22%2C%22IAB12%22%2C%22IAB17%22%5D%2C%22page_type%22%3A%22article%22%2C%22testgroup%22%3A%2276%22%2C%22ext%22%3A%7B%22data%22%3A%7B%22pagesection%22%3A%22business%22%2C%22pagetype%22%3A%22article%22%7D%7D%2C%22psg%22%3A%22300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.231.135.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-135-187.compute-1.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:10 GMT
Content-Encoding: gzip
X-Accel-Expires: 0
Nbr: 510
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://nypost.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H/1.1 200
OK nypost Show response
direct.adsrvr.org/bid/bidder/ 0
394 B 268ms
111ms XHR
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/nypost
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 651 B
994 B 555ms
339ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11076&site_id=26782&zone_id=199490&size_id=57&p_pos=atf&us_privacy=1---&eid_pubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438%5E1&rf=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&kw=Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%2C&tg_i.page=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&tg_i.domain=nypost.com&tg_i.name=nypost.com&tg_i.cat=IAB1%2CIAB12%2CIAB17&tg_i.page_type=article&tg_i.testgroup=76&tg_i.pagesection=business&tg_i.pagetype=article&tg_i.psg=300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2&tg_i.pbadslot=%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories&tk_flint=pbjs_lite_v7.39.0&x_source.tid=43a3236d-ba5a-4c04-830a-36f4c7c56ef8&l_pb_bid_id=442669e6a8403a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories&slots=1&rand=0.16933929463596709
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f0af1fbf9d2ea04a841d8638d716eb20def09b7a1503cf82ea51fc677a75dc0f

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 669 B
1012 B 567ms
352ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11076&site_id=26782&zone_id=199490&size_id=15&alt_size_ids=10&p_pos=atf&us_privacy=1---&eid_pubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438%5E1&rf=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&kw=Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%2C&tg_i.page=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&tg_i.domain=nypost.com&tg_i.name=nypost.com&tg_i.cat=IAB1%2CIAB12%2CIAB17&tg_i.page_type=article&tg_i.testgroup=76&tg_i.pagesection=business&tg_i.pagetype=article&tg_i.psg=300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2&tg_i.pbadslot=%2F5850%2Fpost.desktop%2Frec_atf%2Fbusiness%2Fstories&tk_flint=pbjs_lite_v7.39.0&x_source.tid=49bdd83a-ec08-48a1-8c83-f4848776ebcd&l_pb_bid_id=45d27b108184b46&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F5850%2Fpost.desktop%2Frec_atf%2Fbusiness%2Fstories&slots=1&rand=0.19850251973262067
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 7482c338cbff9a7412ed09981cd100d5038feb04e901183f00f1a72e91e50820

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 669 B
1 KB 537ms
323ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11076&site_id=26782&zone_id=199492&size_id=15&alt_size_ids=10&p_pos=atf&us_privacy=1---&eid_pubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438%5E1&rf=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&kw=Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%2C&tg_i.page=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&tg_i.domain=nypost.com&tg_i.name=nypost.com&tg_i.cat=IAB1%2CIAB12%2CIAB17&tg_i.page_type=article&tg_i.testgroup=76&tg_i.pagesection=business&tg_i.pagetype=article&tg_i.psg=300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2&tg_i.pbadslot=%2F5850%2Fpost.desktop%2Frec_btf%2Fbusiness%2Fstories&tk_flint=pbjs_lite_v7.39.0&x_source.tid=1d4d876f-711e-404b-bafa-6abc6ce7e5d3&l_pb_bid_id=46ecc92c31b7404&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F5850%2Fpost.desktop%2Frec_btf%2Fbusiness%2Fstories&slots=1&rand=0.9650907435443326
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: cc8a0001821f1740a0c0fa375ad0ca27ea7e3b8827a6c105d9c6e75d26436411

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 672 B
1016 B 567ms
353ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11076&site_id=26782&zone_id=199494&size_id=15&alt_size_ids=10&p_pos=atf&us_privacy=1---&eid_pubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438%5E1&rf=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&kw=Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%2C&tg_i.page=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&tg_i.domain=nypost.com&tg_i.name=nypost.com&tg_i.cat=IAB1%2CIAB12%2CIAB17&tg_i.page_type=article&tg_i.testgroup=76&tg_i.pagesection=business&tg_i.pagetype=article&tg_i.psg=300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2&tg_i.pbadslot=%2F5850%2Fpost.desktop%2Frec_widget%2Fbusiness%2Fstories&tk_flint=pbjs_lite_v7.39.0&x_source.tid=1be26050-7fcf-4445-89a6-5200a01e08c1&l_pb_bid_id=475dbd08c61e562&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F5850%2Fpost.desktop%2Frec_widget%2Fbusiness%2Fstories&slots=1&rand=0.48447414942937295
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b61ef26c53c390abf261508847f3d6029a8f0ad0adf80559b60af5ad8b8aa1b4

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 1 KB
899 B 610ms
432ms XHR
application/json 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=10433
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 53c38a93f316b08844cfd22d7e0784623666ec65023f66de2e07781b02342bbc

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
586 B 72ms
59ms XHR
application/json 34.232.232.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.232.232.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-99-99.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
accept-ch: sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform
x-auction-status: 12, 12, 12, 12
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
333 B 284ms
271ms XHR
application/json 104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=214312
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80c33d99e0c6d709c58ae841852cb682b60655bd7e8254fe41a8a928f2249a97

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iJX2xA7m4Q44d9EohJOad9w4LgXbK5yyt7oMITAieI1BN7vZIe0HlkdZuuUJW5lU7YS%2Fmv%2B0E0DX3OZh%2Fhx2RNfNQanrrvSsrPuZevd5L1%2B3fNvegj2Cl1Wr1pFvh%2FitojGrq7ps"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7e4d6c363a848dd9-MIA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
1011 B 327ms
252ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU3I8M1G
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8d85616a1ddbb4e136b53b35df8b2a67285e7fb7a3ead12e39750f68cfe982cc

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://nypost.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Tue, 11 Jul 2023 01:55:10 GMT

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
502 B 288ms
95ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969d8c0175756611146b215ea900ca&pos=8a969c7d017676f2e531f78054c300fa&cmd=bid&eidpubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438&secure=1&us_privacy=1---
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: 24ca7e8106e99b7fcf2d37cce360ed3c5dfaaec48a657d3ea7a7ccbeb748ca04

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
content-length: 80

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
280 B 364ms
172ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969d8c0175756611146b215ea900ca&pos=8a969c7001767661215262907c8700af&cmd=bid&eidpubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438&secure=1&us_privacy=1---
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: 797279379f34e871261870d88c070fb980a4bbe8b6e87f1e0034f884ad5e888a

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
content-length: 80

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
281 B 351ms
159ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969d8c0175756611146b215ea900ca&pos=8a9694bc017676612aaf6290a12500e5&cmd=bid&eidpubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438&secure=1&us_privacy=1---
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: 229b54f564ac35e207a7f01d2d9ff1c112db854bf6d2a441a0f04687dbef6a0b

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
content-length: 78

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
280 B 361ms
171ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969d8c0175756611146b215ea900ca&pos=8a969c700176766121526290b1b400bd&cmd=bid&eidpubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438&secure=1&us_privacy=1---
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.57 /
Resource Hash: b668e301f444d6f756f051d992bc3f8798992d61bf7442e8e926f06be20971b1

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
server: ATS/9.1.10.57
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
content-length: 80

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
189 B 499ms
375ms XHR
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.39.0&cb=68978336376&lsavail=1

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://nypost.com
date: Tue, 11 Jul 2023 01:55:09 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 0EDB 102 B
134 B 91ms
90ms Other
text/javascript 2607:f8b0:4006:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=khH7Ei3klcvfRI74FvDcfuOo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2004 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

48de7787b8ff87abeca3c8661dfac7d508d596a95f74df6e568d664a1f5600cf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Leg3vIiAAAAAByX7xhKbJS8ZzblWErZEWeeILD1&co=aHR0cHM6Ly9ueXBvc3QuY29tOjQ0Mw..&hl=en&v=khH7Ei3klcvfRI74FvDcfuOo&size=invisible&cb=t15d8z6ujp7a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112
x-xss-protection: 1; mode=block
expires: Tue, 11 Jul 2023 01:55:10 GMT

GET
H/1.1 200
OK a-01qt Show response
i.liadm.com/s/c/ Frame F6A4 1 KB
1 KB 274ms
86ms Document
text/html 54.204.99.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-01qt?s=&cim=&ps=true&ls=true&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&ppid=0&euns=1&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.99.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

2588ee7be48c3de04feb76e70470532f6fbe4366dae71c682e1e04d970adefb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-cache, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 679
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:10 GMT
Request-Time: 15
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H2 200 baker
sli.nypost.com/ 0
307 B 347ms
66ms Image
image/gif 2600:9000:23ca:2800:9:41bd:8d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sli.nypost.com/baker?dtstmp=1689040510533
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23ca:2800:9:41bd:8d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 d50d90bbddca57e02d6288d86c88470a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK50-P2
x-cache: FunctionGeneratedResponse from cloudfront
content-type: image/gif
content-length: 0
x-amz-cf-id: oY8lybqFD9_FyKw2k0Hdrj09SyqpDACgKH-xmPo4OOWWg-1ysYMv7g==

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 85ms
82ms Image
image/gif 2607:f8b0:4006:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-3922003-6&cid=777521527.1689040509&jid=1254965261&_u=aCDAiEAjBAQCAGAAI~&z=1623836328

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2004 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.1.1/ Frame 5B1D 85 KB
30 KB 396ms
63ms Script
text/javascript 2607:f8b0:4006:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js

Requested by

Host: player.aniview.com
URL: https://player.aniview.com/script/custom/unruly/outstream/skin.js?site_id=622640

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 05 Jul 2023 14:26:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 473342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30244
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 Jul 2024 14:26:08 GMT

GET
H2

200

cpp8Ywqt.srt Show response
assets-jpcust.jwpsrv.com/tracks/
Redirect Chain

https://cdn.jwplayer.com/tracks/cpp8Ywqt.srt
https://assets-jpcust.jwpsrv.com/tracks/cpp8Ywqt.srt

519 B
770 B

583ms
67ms

XHR
text/plain

2a04:4e42:400::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-jpcust.jwpsrv.com/tracks/cpp8Ywqt.srt
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 2a04:4e42:400::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 57dd7a97830e72270c0ace0e4131cfab91e2cffe52a3233eaa985463aa2ef47f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 567
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 301
x-served-by: cache-iad-kjyo7100155-IAD, cache-mia-kmia1760060-MIA
last-modified: Mon, 10 Jul 2023 16:20:32 GMT
server: nginx
x-timer: S1689040512.597093,VS0,VE30
etag: "5f40f5a14eed69982a93e782fa424d99"
access-control-max-age: 180
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 11, 1

Redirect headers

date: Tue, 11 Jul 2023 01:55:10 GMT
via: 1.1 6e01480ef7aa01c23bf600698a613304.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: EWR53-P1
x-cache: Miss from cloudfront
content-type: text/html
location: https://assets-jpcust.jwpsrv.com/tracks/cpp8Ywqt.srt
access-control-allow-origin: *
x-robots-tag: noindex, indexifembedded
content-length: 166
x-amz-cf-id: u82WYxkaZQO12LmVYeEKRBX7U1QCxny9tx-XO-BVtm3PO32nXQdfog==

GET
H2 200 polyfills.webvtt.js Show response
ssl.p.jwpcdn.com/player/v/8.27.1/ 11 KB
5 KB 43ms
43ms Script
application/javascript 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.27.1/polyfills.webvtt.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2c3f188460d3e015aaba1ccb040ea3122fbd632da4edab8aed3f57ee098bf87d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
via: 1.1 varnish
age: 4083734
x-cache: HIT
content-length: 4510
x-served-by: cache-mia-kmia1760077-MIA
last-modified: Mon, 22 May 2023 06:27:31 GMT
server: AmazonS3
x-timer: S1689040511.669831,VS0,VE0
etag: "f40fecb5b0f59a9cae288c3498d8f653"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 21352

GET
H2

200

ZOo6mQs1-120.vtt Show response
assets-jpcust.jwpsrv.com/strips/
Redirect Chain

https://cdn.jwplayer.com/strips/ZOo6mQs1-120.vtt
https://assets-jpcust.jwpsrv.com/strips/ZOo6mQs1-120.vtt

2 KB
464 B

342ms
67ms

XHR
text/vtt

2a04:4e42:400::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-jpcust.jwpsrv.com/strips/ZOo6mQs1-120.vtt
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 2a04:4e42:400::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 6fc8f0847ceca87bd1c630307bae92b0cc85cc467bd8b9d7ba213746d7bb449f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 567
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 286
x-served-by: cache-iad-kcgs7200035-IAD, cache-mia-kmia1760060-MIA
last-modified: Mon, 10 Jul 2023 15:46:26 GMT
server: nginx
x-timer: S1689040512.597118,VS0,VE28
etag: "23446c6aaea28d55de040e44c1c20b1f"
vary: Accept-Encoding
content-type: text/vtt
access-control-allow-origin: *
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 6, 1

Redirect headers

date: Tue, 11 Jul 2023 01:55:03 GMT
via: 1.1 6e01480ef7aa01c23bf600698a613304.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: EWR53-P1
age: 7
x-cache: Hit from cloudfront
content-type: text/html
location: https://assets-jpcust.jwpsrv.com/strips/ZOo6mQs1-120.vtt
access-control-allow-origin: *
x-robots-tag: noindex, indexifembedded
content-length: 166
x-amz-cf-id: wXIczenfwISVYXJEVVEX4u8HxAL6lkTkvceWcLE26xS6KgNvqjZ_Yg==

GET
H2 200 related.js Show response
ssl.p.jwpcdn.com/player/v/8.27.1/ 102 KB
24 KB 34ms
34ms Script
application/javascript 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.27.1/related.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0292c490af46fed8c95fb0d728a9db44f964cd7f997af76f9bc95daf7b5f7259

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:10 GMT
content-encoding: gzip
via: 1.1 varnish
age: 4084272
x-cache: HIT
content-length: 24956
x-served-by: cache-mia-kmia1760077-MIA
last-modified: Mon, 22 May 2023 06:27:33 GMT
server: AmazonS3
x-timer: S1689040511.761576,VS0,VE0
etag: "8852a3bfeb824346f0798be2a04f58d1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 160937

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 34ms
34ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1555038604&t=event&_s=2&dl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ul=en-us&de=UTF-8&dt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Player%20Load&ea=SPdDOYds&el=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&_u=aDDAiEAjBAQCAGAAI~&jid=&gjid=&cid=777521527.1689040509&tid=UA-3922003-6&_gid=1775602677.1689040510&cd88=777521527.1689040509&cd8=desktop&cd3=lawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo&cd2=Ariel%20Zilber&cd1=article&cd5=standard&cd6=Wells%20Fargo%20VP%20Carl%20Nelson%20%27gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&cd7=&cd12=Wells%20Fargo%20VP%20%27gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&cd9=2023-05-10&cd10=13%3A%2035&cd11=26897126&cd4=business&cd15=wells%20fargo&cd87=Outbrain%20Guarantee&cd16=704&cd17=no&cd40=no&cd44=no&cd54=true&cd76=In-line&cd21=yes&cd46=false&cg1=article&cg2=business&cg3=nypost.com&cd25=&cd28=SPdDOYds&cd35=no&cd36=1&cd43=featured&z=50482470

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jul 2023 22:37:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 11870
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 35ms
34ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1555038604&t=event&_s=3&dl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ul=en-us&de=UTF-8&dt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Video%20Load%20Start&ea=Today%27s%20Business%20Headlines%3A%207%2F10%2F23%20%7C%2052%20seconds%20%7C%202023-07-10&el=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&_u=aDDAiEAjBAQCAGAAI~&jid=&gjid=&cid=777521527.1689040509&tid=UA-3922003-6&_gid=1775602677.1689040510&cd88=777521527.1689040509&cd8=desktop&cd3=lawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo&cd2=Ariel%20Zilber&cd1=article&cd5=standard&cd6=Wells%20Fargo%20VP%20Carl%20Nelson%20%27gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&cd7=&cd12=Wells%20Fargo%20VP%20%27gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&cd9=2023-05-10&cd10=13%3A%2035&cd11=26897126&cd4=business&cd15=wells%20fargo&cd87=Outbrain%20Guarantee&cd16=704&cd17=no&cd40=no&cd44=no&cd54=true&cd76=In-line&cd21=yes&cd46=false&cg1=article&cg2=business&cg3=nypost.com&cd25=&cd28=SPdDOYds&cd35=no&cd36=1&cd43=featured&cd22=ZOo6mQs1&cd23=Mon%20Jul%2010%202023&cd24=rev-completed%2Cbusiness%2Celon%20musk%2Ctwitter%2Cseries%2Ccnn%2Cmark%20zuckerberg%2Cbusiness-headlines%2Cno-playist&cd26=video%20landing%20page&cd38=1&z=107751091

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jul 2023 22:37:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 11870
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bridge3.580.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 80E2 713 KB
228 KB 64ms
63ms Document
text/html 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.580.0_en.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79c277fbe5ccce5c88a681d39733fba8d6c31f1812f8952ec3a5e35b2b0beab4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 270993
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 233312
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Fri, 07 Jul 2023 22:38:37 GMT
expires: Sat, 06 Jul 2024 22:38:37 GMT
last-modified: Fri, 07 Jul 2023 22:36:10 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 231ms
84ms Script
text/javascript 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jul 2023 01:55:11 GMT

GET
H2 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame D69D 39 KB
14 KB 219ms
79ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ea555c1e979c28e1d20d729c64ff36b267b83dcabdefe96460d9ae860e4082f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13681
x-xss-protection: 0
last-modified: Wed, 05 Jul 2023 22:37:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 11 Jul 2023 02:39:33 GMT

GET
H3 200 onsite-v2_352ad239e11d59b8275f1f3594e9c977.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 23 KB
6 KB 53ms
52ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/onsite-v2_352ad239e11d59b8275f1f3594e9c977.br.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4fd24690b66da5fe06f73aacfc2109787437d08f9b7ec36e014370de9d34f391

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 18:14:17 GMT
content-encoding: br
age: 27654
x-guploader-uploadid: ADPycds12jIC8ASaWOxXWRTdCYFaevrUGpjEYBBPGvjTRyiNjyYqyFotua96HgTyjOFNXBRebvI6MmxzuugXbdCcFzYQKg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5863
last-modified: Mon, 10 Jul 2023 18:14:08 GMT
server: UploadServer
etag: "2114ad4cf6f944a6290ef2aef37e9bfa"
x-goog-generation: 1689012848936634
x-goog-hash: crc32c=UT3H1g==, md5=IRStTPb5RKYpDvKu836b+g==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=3600
x-goog-stored-content-length: 5863
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 ads-v2_7583a3b55cf682db906e10c5dfec09b5.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 250 KB
44 KB 35ms
35ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ads-v2_7583a3b55cf682db906e10c5dfec09b5.br.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 66d265e43bba8b9532146a208b60b72e570caa29a289640739f81cacfc518050

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 18:13:53 GMT
content-encoding: br
age: 27678
x-guploader-uploadid: ADPycdssu-ymud8E8x79xbWjICEa1FO3AYJfYVSX7WkI18jEVda3eDyFpTJpf94cRIVs2Leeuf0FiQr4O7lbOM04zk_sgg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45194
last-modified: Mon, 10 Jul 2023 18:13:45 GMT
server: UploadServer
etag: "06007a63bbef1f002bd15a616884305c"
x-goog-generation: 1689012825158012
x-goog-hash: crc32c=XuiNSA==, md5=BgB6Y7vvHwAr0VphaIQwXA==
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=3600
x-goog-stored-content-length: 45194
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 283ad3021846044d51361006cc6a7427.br.json Show response
assets.bounceexchange.com/assets/gam/5850/ 21 KB
6 KB 136ms
64ms Fetch
text/plain 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/gam/5850/283ad3021846044d51361006cc6a7427.br.json
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_46fda4c4cd50b5cb3297856d2cfd7fd9.br.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: fe6e44d070b60724d75bae3b7cdc3c2fcb5a6b0753d3c55e702bfe92bba9d32f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:03:35 GMT
content-encoding: br
age: 31896
x-guploader-uploadid: ADPycduZ5Z03NrXMn2YAgrtB1ZP4dZNHLC1MVD9RmUw-xW9AIqJThpeONv18AitgsQRu4EmyUyaNq_kQSI83AwPFRl0mBMhb1aTw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5817
last-modified: Mon, 10 Jul 2023 17:02:52 GMT
server: UploadServer
etag: "01ff21449f4912211341df5c320f9b56"
x-goog-generation: 1689008572552057
x-goog-hash: crc32c=mMy8ag==, md5=Af8hRJ9JEiETQd9cMg+bVg==
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace, etag
cache-control: public,max-age=3600
x-goog-stored-content-length: 5817
accept-ranges: bytes
content-type: text/plain; charset=UTF-8

GET
H/1.1

200
OK

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=rp-pbs&gdpr=&gdpr_consent=&account=11076&us_privacy=1---
https://prebid-server.rubiconproject.com/setuid?bidder=rubicon&account=11076&uid=LJXN3YYH-1F-G80F&us_privacy=1---

86 B
579 B

59ms
58ms

Image
image/png

69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=rubicon&account=11076&uid=LJXN3YYH-1F-G80F&us_privacy=1---
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/png
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-encoding: gzip
transfer-encoding: chunked
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid-server.rubiconproject.com/setuid?bidder=rubicon&account=11076&uid=LJXN3YYH-1F-G80F&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
Expires: 0

GET
H/1.1 200
OK / Show response
data.cdnbasket.net/ 14 B
338 B 629ms
76ms XHR
application/json 34.120.117.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_74cb4632fbcf5cdfa301cb523939aa09.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.117.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.117.120.34.bc.googleusercontent.com
Software: /
Resource Hash: 5fc62ace6f935bc7d12dfb78e2c1b5b29c20acd5180d3aa4dc55a852a7bf4a3e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:11 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
page.cdnbasket.net/ 14 B
338 B 629ms
78ms XHR
application/json 34.149.217.57
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://page.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_74cb4632fbcf5cdfa301cb523939aa09.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.217.57 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 57.217.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 09aa2c8e0b118d4d4590bc29d1bc84fb48d8c250a84da9b105508320273d2038

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:11 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
view.cdnbasket.net/ 14 B
338 B 631ms
80ms XHR
application/json 34.149.145.47
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://view.cdnbasket.net/
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_74cb4632fbcf5cdfa301cb523939aa09.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.145.47 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 47.145.149.34.bc.googleusercontent.com
Software: /
Resource Hash: ad210e68e4b109c04af983413ec85b9d06ddba8da275bdc38c46c7d472cdd8bf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:11 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
BLOB 206
Partial Content 02e0c8bc-68b6-45d9-9593-70afb8816cd2
https://nypost.com/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://nypost.com/02e0c8bc-68b6-45d9-9593-70afb8816cd2
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
H2

200

sync
pippio.com/api/ Frame F6A4
Redirect Chain

https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=65128e12-b9bf-4963-b6ec-f3cc29b59d09&us_privacy=1---
https://p.rfihub.com/cm?pub=39342&in=1&userid=a2de11c1-9c38-4380-9139-4c0fecf488a7%3A1689040511.6752582&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3Da2de11c1-9c38-4380...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=978477416365413599&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3Da2de11c...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=a2de11c1-9c38-4380-9139-4c0fecf488a7%3A1689040511.6752582&pid=500040&it=1&iv=a2de11c1-9c38-4380-9139-4c0fecf488a7%3A1689040511.6752582&_=168...
https://pippio.com/api/sync?it=1&pid=500040&_=1689040511.6795018&iv=a2de11c1-9c38-4380-9139-4c0fecf488a7:1689040511.6752582

42 B
202 B

75ms
74ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1689040511.6795018&iv=a2de11c1-9c38-4380-9139-4c0fecf488a7:1689040511.6752582
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01qt?s=&cim=&ps=true&ls=true&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&ppid=0&euns=1&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

Location: https://pippio.com/api/sync?it=1&pid=500040&_=1689040511.6795018&iv=a2de11c1-9c38-4380-9139-4c0fecf488a7:1689040511.6752582
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 2

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame F6A4
Redirect Chain

https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1---
https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=6971283231311444352&us_privacy=1---
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1---
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-rnYkfjFFut_JQIwF9y1B5GXCLlFwu1EL7LfRlw&us_privacy=1---
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-rnYkfjFFut_JQIwF9y1B5GXCLlFwu1EL7LfRlw&us_privacy=1---&us_privacy=1---

43 B
548 B

87ms
59ms

Image
image/gif

2600:1f18:ed:550e:47ab:4fa4:b4dd:ea4a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-rnYkfjFFut_JQIwF9y1B5GXCLlFwu1EL7LfRlw&us_privacy=1---&us_privacy=1---

Requested by

Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01qt?s=&cim=&ps=true&ls=true&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&ppid=0&euns=1&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&

Protocol

HTTP/1.1

Server

2600:1f18:ed:550e:47ab:4fa4:b4dd:ea4a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 1
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-rnYkfjFFut_JQIwF9y1B5GXCLlFwu1EL7LfRlw&us_privacy=1---&us_privacy=1---
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 2

GET

52164
i.liadm.com/s/ Frame F6A4
Redirect Chain

https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=65128e12-b9bf-4963-b6ec-f3cc29b59d09&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1---
https://x.bidswitch.net/ul_cb/syncd?dsp_id=256&user_group=2&user_id=65128e12-b9bf-4963-b6ec-f3cc29b59d09&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1---
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://x.bidswitch.net/sync?ssp=liveintent&user_id=65128e12-b9bf-4963-b6ec-f3cc29b59d09
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=6df4b310-da08-4735-b44b-7dba8fb0cf30&user_group=1&ssp=liveintent&bsw_param=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85

0
0

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame F6A4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1---
https://match.adsrvr.org/track/cmb/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1---
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

43 B
548 B

249ms
58ms

Image
image/gif

2600:1f18:ed:550e:47ab:4fa4:b4dd:ea4a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

Requested by

Protocol

HTTP/1.1

Server

2600:1f18:ed:550e:47ab:4fa4:b4dd:ea4a Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 0
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
Date: Tue, 11 Jul 2023 01:55:11 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 1

GET
H/1.1 200
OK img
sync.mathtag.com/sync/ Frame F6A4 43 B
589 B 520ms
74ms Image
image/gif 216.200.232.253
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.mathtag.com/sync/img?mt_exid=36&65128e12-b9bf-4963-b6ec-f3cc29b59d09&us_privacy=1---
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-01qt?s=&cim=&ps=true&ls=true&duid=37577191df7a--01h51ahpadb1dqgp5b4ywda7fj&ppid=0&euns=1&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 216.200.232.253 Frederick, United States, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MT3 1031 59fd23a master ord ord-pixel-x53 config_version:"1969" /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:11 GMT
Server: MT3 1031 59fd23a master ord ord-pixel-x53 config_version:"1969"
Content-Type: image/gif
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 43
Expires: Tue, 11 Jul 2023 01:55:10 GMT

GET
H2

200

live_intent_sync
x.dlx.addthis.com/e/ Frame F6A4
Redirect Chain

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=65128e12-b9bf-4963-b6ec-f3cc29b59d09&us_privacy=1---
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=65128e12-b9bf-4963-b6ec-f3cc29b59d09&us_privacy=1---&rd=Y

43 B
594 B

133ms
133ms

Image
image/gif

96.17.64.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=65128e12-b9bf-4963-b6ec-f3cc29b59d09&us_privacy=1---&rd=Y

Requested by

Protocol

Server

96.17.64.208 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-17-64-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Tue, 11 Jul 2023 01:55:11 GMT
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:11 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.dlx.addthis.com/e/live_intent_sync?na_exid=65128e12-b9bf-4963-b6ec-f3cc29b59d09&us_privacy=1---&rd=Y
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:11 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Tue, 11 Jul 2023 01:55:11 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame F6A4
Redirect Chain

https://dpm.demdex.net/ibs:dpid=127444&dpuuid=65128e12-b9bf-4963-b6ec-f3cc29b59d09?us_privacy=1---
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=127444&dpuuid=65128e12-b9bf-4963-b6ec-f3cc29b59d09

42 B
942 B

255ms
112ms

Image
image/gif

44.238.178.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=127444&dpuuid=65128e12-b9bf-4963-b6ec-f3cc29b59d09

Requested by

Protocol

HTTP/1.1

Server

44.238.178.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

DCS: dcs-prod-usw2-2-v046-091d1a1b2.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: JssjQq3qQSk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-usw2-2-v046-015c439d2.edge-usw2.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: zIfeS0YwQ5c=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=127444&dpuuid=65128e12-b9bf-4963-b6ec-f3cc29b59d09
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 200 in
us.q2s15.com/v5/ 2 B
171 B 596ms
67ms Ping
text/plain 52.45.209.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://us.q2s15.com/v5/in
Requested by: Host: cdn.watchingthat.net
URL: https://cdn.watchingthat.net/us.wtat.plugin-jw_ima.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.209.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-209-233.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryg5xGBGXveoAXfgEK

Response headers

access-control-allow-origin: https://nypost.com
date: Tue, 11 Jul 2023 01:55:11 GMT
access-control-allow-credentials: true
x-powered-by: Express
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

POST
H3 200 decision-engine Show response
zephr-v4.nypost.com/zephr/ 13 KB
14 KB 93ms
92ms Fetch
application/json 108.139.29.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://zephr-v4.nypost.com/zephr/decision-engine?brand=nypost&content_id=26897126&env=production&isExclusiveArticle=&isSportsArticle=&isSportsArticleNonBetting=&primarySection=business&primaryTag=wells-fargo&sections=business&theme=nypost-2021
Requested by: Host: nypost.com
URL: https://nypost.com/wp-content/plugins/nyp-zephr/build/app.bundle.min.js?ver=bcdb84b11dc015415df7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 108.139.29.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-111.jfk50.r.cloudfront.net
Software: /
Resource Hash: db62561bebdc379630df4433752f6f66452aff5988581ee75c2745b938bd680f

Request headers

Accept: application/json
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 50670fc09f8465be7ae4adcf6e33ab7a.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P2
x-cache: Miss from cloudfront
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=86400
content-length: 13426
x-amz-cf-id: ZHTq1oe01UNpNuRkhIpdwjMmQFYI9exQeKxcRs3nEIUdCvPYVxY94w==
access-control-allow-headers: Accept,Origin,Keep-Alive,Content-Type,User-Agent,Referer,Accept-Language,Cookie,Authorization,Cache-Control,Expires,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding
x-blaize-request: ffffffff90bf1fec

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 0492 3 KB
3 KB 68ms
68ms Document
text/html 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

3fd3c7c9c2a702333619947858d4f9e0c94a7491cd4c9fdd42a20132ae8014d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 2930
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 11 Jul 2023 01:55:11 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: XE43A2TSSPNM1M6HQJ1A

GET
H/1.1 200
OK spt Show response
tg1.unrulyvideo.com/api/adserver/ 21 KB
7 KB 482ms
73ms Script
text/javascript 2600:1400:9000::172c:ede2
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://tg1.unrulyvideo.com/api/adserver/spt?AV_TAGID=62af35d851923c62777207b4&AV_PUBLISHERID=603f65a2e291680ef30af9c7&AV_CDIM10=622640
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::172c:ede2 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 06d81519de3c9fdf9ceae6847b02a28a0aecbc330bdd64159ceb8a620fd8487a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

X-Bamboo-C-SkSt: 1
Content-Encoding: gzip
X-Bamboo-C-SkFe: 1
X-Bamboo-C-S: BYPASS
Date: Tue, 11 Jul 2023 01:55:11 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS, INDEX
Content-Type: text/javascript
Vary: Accept-Encoding
Cache-Control: max-age=300
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Bamboo-Token,Event-Id,X-Requested-With
Content-Length: 6269
Expires: Tue, 11 Jul 2023 02:00:11 GMT

GET
H2 200 track
track1.aniview.com/ 0
97 B 58ms
57ms Image
text/plain 34.230.174.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?pid=603f65a2e291680ef30af9c7&cid=6265145b67ce6a604d44ebf5&cb=1689040511195&r=nypost.com&stagid=62af35d851923c62777207b4&stplid=&cd10=622640&e=c9&cd11=3-getSiteData
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.174.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-174-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 track
track1.aniview.com/ 0
97 B 59ms
58ms Image
text/plain 34.230.174.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?pid=603f65a2e291680ef30af9c7&cid=6265145b67ce6a604d44ebf5&cb=1689040511196&r=nypost.com&stagid=62af35d851923c62777207b4&stplid=&cd10=622640&e=c9&cd11=4-loadStudio
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.174.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-174-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 ads.js Show response
static-cdn.spot.im/production/ads/tags/v22.2.1/ads/ 207 KB
63 KB 65ms
65ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/ads/tags/v22.2.1/ads/ads.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2f95be26ef3d47f9ff2b02de5a783333be887745dcf74e201768c6050e78e8ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: n0Jj7_KXvLZzyg93FKmczpM2zRxXfRse
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 07:29:27 GMT
last-modified: Wed, 21 Jun 2023 07:20:51 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 66345
x-amz-server-side-encryption: AES256
etag: W/"3c4697fcdf28ae1fba94752cdf3c4943"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
x-amz-cf-id: u2DQUj5PzF0L-834Jl-Gpx_DjduiDUXEKDgzyAjNpa2USZiO81XAjw==

GET
H2 200 ads.css Show response
static-cdn.spot.im/production/ads/tags/v22.2.1/ads/ 7 KB
2 KB 62ms
62ms Fetch
text/css 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/ads/tags/v22.2.1/ads/ads.css
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/initial-bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ca2051bae2fef16ee5be9f6e33d1f707c7a193ab27e7aa18cd661d2157e20c1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: JbHv9jOpmKFhPePage1RSk4molHavkRU
content-encoding: br
via: 1.1 779925c9c68a6d4d8c35b729b0516a76.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 07:27:20 GMT
x-amz-cf-pop: EWR53-C3
age: 66472
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 21 Jun 2023 07:20:51 GMT
server: AmazonS3
etag: W/"353f88f72be5ba7c2092d44448e93df0"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-amz-cf-id: Fgk5pmGbfFEwpZxRsvGu82JXkLEK90e2iyG-Pvdz7MI7tc-TolBY7A==

GET
H2 200 obUserSync.html Show response
widgets.outbrain.com/widgetOBUserSync/ Frame B23D 19 KB
6 KB 64ms
63ms Document
text/html 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ee8686e5b72a3d816d62a607cd65e758e9c258ae8a2f941a5413dc6d2e64df13

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-encoding: gzip
content-length: 6040
content-type: text/html
date: Tue, 11 Jul 2023 01:55:11 GMT
etag: "37202485ed061a936935162db30e773e:1683701449.34879"
expires: Tue, 18 Jul 2023 01:55:11 GMT
last-modified: Wed, 10 May 2023 06:16:26 GMT
server: AkamaiNetStorage
timing-allow-origin: * *
vary: Accept-Encoding

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 527ms
117ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=ded85c8f61d2cf1ae19abb9cab8ea4b2_770_1689040510556&tm=1858&eT=0&wRV=2010370&pVis=0&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&cheq=0&oo=false&lo=3002&obreq=2778&mvreq=3827&cet=4g&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 38fa746fb98af149ebf33778e9bdb5e5
Content-Length: 28

GET
H2 200 get Show response
mv.outbrain.com/Multivac/api/ 211 KB
30 KB 1569ms
1569ms Script
text/javascript 199.232.38.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://mv.outbrain.com/Multivac/api/get?url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&idx=1&rand=45454&widgetJSId=AR_3&va=true&et=true&format=html&t=MWNlZjIwYjc1MWM4ZTUyY2IxODQyZmU5Zjc4YzllZGE=&px=268&py=4693&vpd=3493&pubInState=0&cw=734&seid=927fb7cd-c6dc-7fd2-0000-018942a8de26%7C0%7C1&settings=true&recs=true&key=NANOWDGT01&adblck=false&abwl=false&ab=0&wl=0&umv=1&activeTab=true&version=2010370&sig=zeq6QPLM&apv=false&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&dpr=1&secured=true&cmpStat=0&ccpa=1---&ccpaStat=1&chs=1&ogn=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.38.132 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8d22abf6dd931aca8e6851c7ce4054480c27adc1094e074531166a8760a6685c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: br
via: 1.1 varnish
traffic-path: SADC1, LGA, USA_EAST1
x-timer: S1689040511.349245,VS0,VE1502
vary: Accept-Encoding, User-Agent
x-cache: MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
content-type: text/javascript; charset=UTF-8
expires: Thu, 01 Jan 1970 00:00:00 GMT
x-traceid: aeca5bcbfc11bda09aab20497c268b4c
accept-ranges: bytes
content-length: 30611
x-served-by: cache-lga21940-LGA

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&rid=esp&cc=1

85 B
202 B

94ms
89ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&rid=esp&cc=1
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 7275ee580e9fdbb656d2732dc2d6f1fc3dc5283d0bb879ca1a7798daf2233562

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-4M4PmhSArA3Ec3uZP65MC04NYB4"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://nypost.com
location: /esp?url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
319 B 438ms
142ms XHR
text/plain 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://nypost.com
date: Tue, 11 Jul 2023 01:55:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
380 B 161ms
160ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 69928b8f1755cb9dc0fd63dd06eef845eb7c9c2a5e966947a1739999f48c86f7

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: f5e794945ceb771ad9c201301dd0dd7e
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 285

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame B693 15 KB
6 KB 179ms
57ms Document
text/html 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=nypost.com&us_privacy=1---

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:11 GMT
server: Kestrel
server-processing-duration-in-ticks: 233367
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 eyJpdSI6ImYzZjRkN2ZhNDQyYTAwMWU3NTliZjVmMzZlZjJhMzc1OTM2Zjg1MjgzNGM4NGI1NGI1ZmQ1YTliNWFkODU2YTUiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/ 2 KB
2 KB 268ms
61ms Image
image/webp 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImYzZjRkN2ZhNDQyYTAwMWU3NTliZjVmMzZlZjJhMzc1OTM2Zjg1MjgzNGM4NGI1NGI1ZmQ1YTliNWFkODU2YTUiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2e909a25de53c298f6f74649fc6ddb1adc9de84e9357a970e50749d52d48c71d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
last-modified: Mon, 10 Jul 2023 16:44:09 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2429464
access-control-allow-credentials: false
x-traceid: 0077148b6dde57c5529fbe4474429f65
timing-allow-origin: *, *
content-length: 2080

GET
H2 200 eyJpdSI6IjIyY2YwOTJhNjkxYzk2NWQ1ZWZhZmJkYzc3ODI1ZDFmZDdjNzg5ZmM3MzAyNWIzNTViMGVjNTQ2Y2U5YTE2NWYiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/ 2 KB
2 KB 267ms
62ms Image
image/webp 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjIyY2YwOTJhNjkxYzk2NWQ1ZWZhZmJkYzc3ODI1ZDFmZDdjNzg5ZmM3MzAyNWIzNTViMGVjNTQ2Y2U5YTE2NWYiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: bae4e30a46868a93b3a547a6043909b81de38592caf12aa06f7636696a534ff2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
last-modified: Mon, 10 Jul 2023 18:31:58 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2435793
access-control-allow-credentials: false
x-traceid: 7b025722ec97287ca998f0c01e6867db
timing-allow-origin: *, *
content-length: 2234

GET
H2 200 eyJpdSI6Ijc1ZmQ3NGNmOTYxZmI2NjZlYjA4YTQ5MmM1YWMxZjk5MzJhNzkwMGI4YTFhMTg4MmFmMWFiODU5NDJmNTU4ZjIiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/ 2 KB
3 KB 272ms
67ms Image
image/webp 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6Ijc1ZmQ3NGNmOTYxZmI2NjZlYjA4YTQ5MmM1YWMxZjk5MzJhNzkwMGI4YTFhMTg4MmFmMWFiODU5NDJmNTU4ZjIiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ed7764334152ab961d0290a3615f9158b8670a908bd56714dabe98a0729a6e48

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
last-modified: Mon, 10 Jul 2023 18:10:48 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2434564
access-control-allow-credentials: false
x-traceid: 1a98cd711d13813117a60d14ca341712
timing-allow-origin: *, *
content-length: 2370

GET
H2 200 eyJpdSI6IjAxOTE2YTIyYjA5N2EwMzZkNjhmNmQ1ODAzNmZmOTRjYjg0Njc1ZGY5MmUzOGQzM2RlOWUzY2MxOWRmMDFlNmQiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/ 2 KB
3 KB 269ms
65ms Image
image/webp 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjAxOTE2YTIyYjA5N2EwMzZkNjhmNmQ1ODAzNmZmOTRjYjg0Njc1ZGY5MmUzOGQzM2RlOWUzY2MxOWRmMDFlNmQiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e361a66d4c9567b5e65f9e07a11d84f880ec389ecc4b78c3b6befdb3c2af3fe5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
last-modified: Mon, 10 Jul 2023 15:41:02 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2425622
access-control-allow-credentials: false
x-traceid: aac84b0ba6f80723b978357a20e41428
timing-allow-origin: *, *
content-length: 2338

GET
H2 200 eyJpdSI6ImZkZTk0YWQ0MTFiMzkzMTk3NDhiMTE5ZTJmMThhYjYxZDNjNDM2NjgxNjZjZDc0NDA4ODNkOWVjMjAxYzAzYTgiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/ 2 KB
2 KB 282ms
78ms Image
image/webp 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImZkZTk0YWQ0MTFiMzkzMTk3NDhiMTE5ZTJmMThhYjYxZDNjNDM2NjgxNjZjZDc0NDA4ODNkOWVjMjAxYzAzYTgiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 32dd7fadbeefdf14c28883a5d08b5c5cfb1a0369affbb20ea877bfb607f590b0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
last-modified: Sun, 09 Jul 2023 01:10:44 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2287175
access-control-allow-credentials: false
x-traceid: 683cf00a77cc2da70e535ca4022f2864
timing-allow-origin: *, *
content-length: 2238

GET
H2 504 eyJpdSI6IjQ0ZDFiZjg5MjQwM2MyYzI4MzllOWYxYTYxZTc4ZDAyNDc5YWU1MjUyMjAwMjE2MTBkNzM5MWNjZTVhNTRhYmYiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/ 0
0 8281ms
8077ms Image
text/html 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjQ0ZDFiZjg5MjQwM2MyYzI4MzllOWYxYTYxZTc4ZDAyNDc5YWU1MjUyMjAwMjE2MTBkNzM5MWNjZTVhNTRhYmYiLCJ3Ijo5MCwiaCI6NjAsImQiOjEuMCwiY3MiOjAsImYiOjR9.webp
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

POST
H3 200 feature-decisions Show response
zephr-v4.nypost.com/zephr/ 1 KB
2 KB 91ms
90ms Fetch
application/json 108.139.29.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://zephr-v4.nypost.com/zephr/feature-decisions
Requested by: Host: nypost.com
URL: https://nypost.com/wp-content/plugins/nyp-zephr/build/app.bundle.min.js?ver=bcdb84b11dc015415df7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 108.139.29.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-111.jfk50.r.cloudfront.net
Software: /
Resource Hash: f52e1291a1d2535458d09ce25a79f798ba7841dd25e4934f59b794bc9f01ec97

Request headers

Accept: application/json
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 50670fc09f8465be7ae4adcf6e33ab7a.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P2
x-cache: Miss from cloudfront
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=86400
content-length: 1350
x-amz-cf-id: xFoc3os3scrspp0UORrueKhOH_r0wjoyfRUFnSO_snd21HlikgSWog==
access-control-allow-headers: Accept,Origin,Keep-Alive,Content-Type,User-Agent,Referer,Accept-Language,Cookie,Authorization,Cache-Control,Expires,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding
x-blaize-request: 5c6f677c

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 266ms
90ms Script
application/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=nypost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 173 KB
45 KB 792ms
791ms XHR
text/plain 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4315394779626357&correlator=1743906743024956&hxva=1&scor=3478299714347391&eid=31074947%2C31075836%2C31068366%2C31075338%2C31075340%2C21065724&output=ldjh&gdfp_req=1&vrg=202307050101&ptt=17&impl=fifs&us_privacy=1---&iu_parts=5850%2Cpost.desktop%2Crec_atf%2Cbusiness%2Cstories%2Cbillb_atf%2Crec_btf%2Crec_widget%2Ccustom%2Cskin%2Cinline%2Coverlay_fullpage%2Cnative&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F5%2F3%2F4%2C%2F0%2F1%2F6%2F3%2F4%2C%2F0%2F1%2F7%2F3%2F4%2C%2F0%2F1%2F8%2F3%2F4%2C%2F0%2F1%2F9%2F3%2F4%2C%2F0%2F1%2F10%2F3%2F4%2C%2F0%2F1%2F11%2F3%2F4%2C%2F0%2F1%2F12%2F3%2F4&prev_iu_szs=300x250%7C300x251%7C1x1%7C300x600%2C970x90%7C970x250%7C978x250%7C1x1%7C1x11%2C300x250%7C300x252%7C300x600%7C1x1%2C300x255%7C300x250%7C300x600%7C1x1%2C1x12%2C1x2%7C1x1%2C1x7%7C1x1%2C1x4%7C1x1%2C320x50%7C1x6%7C1x1&fluid=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2Cheight&ifi=1&adks=1445506672%2C3705377758%2C4049997059%2C2992583169%2C784123883%2C3798050387%2C2122588546%2C514364412%2C2601674814&didk=3171899918~285960245~3171905950~3543286650~119205592~907871424~2265005873~2949661673~934004422&sfv=1-0-40&prev_scp=amznbid%3D1%26amznp%3D1%26mnadc%3Ddiv-gpt-ad-rec_atf%7Camznbid%3D1%26amznp%3D1%26mnadc%3Ddiv-gpt-ad-billb_atf%7Camznbid%3D1%26amznp%3D1%26mnadc%3Ddiv-gpt-ad-rec_btf%7Camznbid%3D1%26amznp%3D1%26mnadc%3Ddiv-gpt-ad-rec_widget%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=testgroup%3D76%26permutive%3D%26puid%3D0aa6d7f5-16df-4335-8e6e-dcd466939f50%26ptime%3D1689040510190%26authors%3DAriel%2520Zilber%26page_type%3Darticle%26content%3Dlawsuit%252Clawsuits%252Csexual-harassment%252Cwells-fargo%26site%3Dnypost%26dimension54%3Dtrue%26psg%3D300003%252C210002%252C230002%252C230004%252C112200%252C121100%252Cfrejb4%252C469txr%252C8byqwu%252C77i9s2%26video%3Dnone%26nckey_userGroup%3D5%26hb_test%3Dv2&ppid=64acb67d848a786868057ece64acb67d848a786868057ece&sc=1&cookie_enabled=1&abxe=1&dt=1689040511445&lmt=1689040511&dlt=1689040506632&idt=3548&adxs=1032%2C315%2C1032%2C1032%2C0%2C0%2C0%2C0%2C1032&adys=1462%2C237%2C4141%2C2628%2C6693%2C543%2C543%2C543%2C1865&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1%7C0%7C2%7C3%7C4%7C0%7C0%7C0%7C5&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&frm=20&vis=1&psz=300x600%7C970x256%7C300x600%7C300x600%7C1600x0%7C1600x0%7C1600x6692%7C1600x4%7C300x0&msz=300x250%7C970x0%7C300x250%7C300x250%7C1600x0%7C1600x0%7C0x0%7C1600x0%7C300x0&fws=516%2C516%2C516%2C516%2C4%2C4%2C132%2C4%2C4&ohw=300%2C970%2C300%2C300%2C1600%2C1600%2C1600%2C1600%2C1600&ga_vid=777521527.1689040509&ga_sid=1689040511&ga_hid=1555038604&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307050101/pubads_impl.js?cb=31075836

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25e4d7162e32ccd8303b65c1d2319f614cae894337f779319cb468be9cf388f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46514
x-xss-protection: 0
google-lineitem-id: 5167296872,5167296872,5167296872,5167296872,-2,-2,6322075580,-2,5402416556
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 651972898223,651871129821,651871113801,651871117572,-2,-2,138360848979,-2,138244049805
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nypost.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 91BA 6 KB
3 KB 234ms
84ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307050101/pubads_impl.js?cb=31075836

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:11 GMT
expires: Wed, 10 Jul 2024 01:55:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 be7c8e97d372a58af9bb2c05b9456660a95660a15f5d5e3c4ab8 Show response
rebelhen.com/ 1 KB
1 KB 57ms
57ms Fetch
application/json 2600:1901:0:7416::1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rebelhen.com/be7c8e97d372a58af9bb2c05b9456660a95660a15f5d5e3c4ab8

Requested by

Host: rebelhen.com
URL: https://rebelhen.com/v2csnUsFoH1XR1oW51-C6NQBdGmIS6hRimi-eyRebi0VRmqDrwM_hCHQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:7416::1 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

a83ea680c4df1de93aa1d2dcfcde59e2ffba421e599ea64728c290c88114d8a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 google
x-buildnumber: 924731853
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1397
x-datacenter: gce-us-east1
x-buildname: hoothoot
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
x-hostname: fen-hoothoot-us-east1-test-jrrc
access-control-allow-credentials: true
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
610 B 214ms
72ms XHR
application/json 3.228.206.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.206.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-206-213.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 01781044ec8a9f395c85ba3a113456db25732bd8f4390da863724c8d2b083ec8

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:11 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://nypost.com
cache-control: no-cache
x-server: 10.40.7.136
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 200 Toq2ZZoq Show response
cdn.jwplayer.com/v2/playlists/ 114 KB
18 KB 79ms
79ms XHR
application/json 2600:9000:2209:a400:1:a3fa:7cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jwplayer.com/v2/playlists/Toq2ZZoq?related_media_id=ZOo6mQs1&page_domain=nypost.com
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/spddoyds.js?ver=6.0.5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2209:a400:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 5cd197342cbe62775a8bc64951f101a5937ad09c9869b396cc90b60da59b842c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:03 GMT
content-encoding: gzip
via: 1.1 6e01480ef7aa01c23bf600698a613304.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: EWR53-P1
age: 7
x-cache: Hit from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=180, max-stale=180
x-robots-tag: noindex, indexifembedded
content-length: 18014
x-amz-cf-id: Pk_T6rQ0hPrL7j2uBsVuBAk-FXDcli8Kn9SadEDcDrX7WiqnuBMA6A==
expires: Tue, 11 Jul 2023 01:56:11

POST
H2 200 segment Show response
api.permutive.com/adv/v2/ 14 B
78 B 145ms
145ms XHR
application/json 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/adv/v2/segment?new-session=true&k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: e3aeeb9b76fb8242067c35d89b2a5281561e92a7c9a25239d630f818fe978a7d

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 google
server: Permutive
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14
content-type: application/json

OPTIONS
H3 200 decision-engine
zephr-v4.nypost.com/zephr/ Frame 0
0 76ms
75ms Preflight 108.139.29.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://zephr-v4.nypost.com/zephr/decision-engine?brand=nypost&content_id=26897126&env=production&isExclusiveArticle=&isSportsArticle=&isSportsArticleNonBetting=&primarySection=business&primaryTag=wells-fargo&sections=business&theme=nypost-2021
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 108.139.29.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-111.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Origin,Keep-Alive,Content-Type,User-Agent,Referer,Accept-Language,Cookie,Authorization,Cache-Control,Expires,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding
access-control-allow-methods: POST,PUT,PATCH,GET,DELETE,OPTIONS,HEAD
access-control-allow-origin: https://nypost.com
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
x-amz-cf-id: JMit7QcEH6CXtVRng0G2a-Fx8oLtYlF3Nc0g7R0hNGPxs5994VKgtQ==
x-amz-cf-pop: JFK50-P2
x-cache: Miss from cloudfront

GET
H3 200 local_storage_frame17.min.html Show response
assets.bounceexchange.com/assets/bounce/ Frame EB1D 2 KB
1 KB 36ms
35ms Document
text/html 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f4fc114373da7e63fade04d84f7f1cfb5b31632246f33b10f3b7b275b85e6dd6

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
age: 18821
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-encoding: gzip
content-length: 1073
content-type: text/html; charset=UTF-8
date: Mon, 10 Jul 2023 20:41:30 GMT
etag: "2c4b31ebd3dffab1c0b9709a912f294a"
last-modified: Mon, 10 Jul 2023 18:13:37 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1689012817682542
x-goog-hash: crc32c=mXZJmA== md5=LEsx69Pf+rHAuXCakS8pSg==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 1073
x-guploader-uploadid: ADPycdvagK-CA0lSGP-NWTw3eacCLbu4VKykSwn7iY8FSIgBV0lTGHduSgUSxavxhqvlbUBqptjOKMdZ2IBukWj1aglXbCVkVm3v

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 411ms
156ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://nypost.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Tue, 11 Jul 2023 01:55:11 GMT
server: Google Frontend
vary: Origin
via: 1.1 google, 1.1 google
x-cloud-trace-context: c68d3ed1ff9802d6d1522ede20cf3e56

OPTIONS
H3 200 feature-decisions
zephr-v4.nypost.com/zephr/ Frame 0
0 80ms
80ms Preflight 108.139.29.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://zephr-v4.nypost.com/zephr/feature-decisions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 108.139.29.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-111.jfk50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Origin,Keep-Alive,Content-Type,User-Agent,Referer,Accept-Language,Cookie,Authorization,Cache-Control,Expires,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding
access-control-allow-methods: POST,PUT,PATCH,GET,DELETE,OPTIONS,HEAD
access-control-allow-origin: https://nypost.com
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
x-amz-cf-id: -6y3nvOAWwfTyhVB4FJE1nUsCNJXCLYavNl22wTGaJA96s5wb54-AQ==
x-amz-cf-pop: JFK50-P2
x-cache: Miss from cloudfront

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 0492
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3320421111524274000V10

43 B
479 B

100ms
74ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3320421111524274000V10

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YPZW7K38Q6JFQVAH7P47
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:11 GMT
X-Check-Cacheable: YES
Server: Apache
X-Akamai-Pragma-Client-IP: 23.44.237.140, 4.7.166.102
X-Serial: 66004
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3320421111524274000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Tue, 11 Jul 2023 01:55:11 GMT

GET
H2

200

ZOo6mQs1-120.jpg
assets-jpcust.jwpsrv.com/strips/
Redirect Chain

https://cdn.jwplayer.com/strips/ZOo6mQs1-120.jpg
https://assets-jpcust.jwpsrv.com/strips/ZOo6mQs1-120.jpg

87 KB
87 KB

80ms
79ms

Image
image/jpeg

2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-jpcust.jwpsrv.com/strips/ZOo6mQs1-120.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0f0f1548413cbb194fae037c0ea1203c94858c575757a9356d691663330bef05

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 0
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 88675
x-served-by: cache-iad-kjyo7100020-IAD, cache-mia-kmia1760077-MIA
last-modified: Mon, 10 Jul 2023 15:46:25 GMT
server: nginx
x-timer: S1689040512.905153,VS0,VE46
etag: "97b69945416ad9d4224500847993b704"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=900
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 3, 1

Redirect headers

date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: EWR53-P1
x-cache: Miss from cloudfront
content-type: text/html
location: https://assets-jpcust.jwpsrv.com/strips/ZOo6mQs1-120.jpg
access-control-allow-origin: *
x-robots-tag: noindex, indexifembedded
content-length: 166
x-amz-cf-id: RpDgqPTFrpkQOidoHE_o3qn7Ud1dUuwbVe1WWkxm0VeFBVecOfIvgQ==

GET
H2 204 ping.gif
ping-meta-prd.jwpltx.com/v1/jwplayer6/ 0
68 B 66ms
60ms Image
text/plain 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping-meta-prd.jwpltx.com/v1/jwplayer6/ping.gif?h=-114130588&e=xapi&n=2469220520902191&aid=wExvYnLyEeyygEIIgluVXw&emi=j5ldbh1ywjmc&id=ZOo6mQs1&pli=1nf5cfw89rzh&pv=8.27.1&tv=3.42.2&ed=6&prs=idle&pid=SPdDOYds&ph=1&sdk=0&xam=getFullscreen&sa=1689040510325
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by: cache-mia-kmia1760077-MIA
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-cache: MISS
x-cache-hits: 0

GET
H2 204 ping.gif
prd.jwpltx.com/v1/jwplayer6/ 0
26 B 87ms
61ms Image
text/plain 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/jwplayer6/ping.gif?h=-984811915&e=e&n=1060664560846809&abc=0&abt=128_sendDomainToFeedsOn&aid=wExvYnLyEeyygEIIgluVXw&amp=0&ask=FTyzwZMf&at=1&c=1&ccp=0&cp=0&d=1&eb=0&ed=6&emi=j5ldbh1ywjmc&i=0&id=ZOo6mQs1&lid=2e1ah1ivli3c&lsa=read&mt=1&pbd=1&pbr=1&pgi=1omq2z11u15w&ph=1&pid=SPdDOYds&pii=0&pl=413&plc=1&pli=1nf5cfw89rzh&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&pv=8.27.1&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Today%27s%20Business%20Headlines%3A%207%2F10%2F23&tv=3.42.2&vb=1&vi=0.82&vl=90&wd=734&ab=1&cae=0&cb=0&cdid=jw-player-SPdDOYds-DjYI9AQQ&cme=0&dd=0&fed=DjYI9AQQ&flc=1&fv=&ga=1&lng=en-US&mk=hls&mu=https%3A%2F%2Fcdn.jwplayer.com%2Fmanifests%2FZOo6mQs1.m3u8&pbc=0&pd=2&pdr=&plng=en-US&plt=4750&pni=1&po=0&pogt=Wells%20Fargo%20VP%20Carl%20Nelson%20%E2%80%98gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%E2%80%99%3A%20lawsuit&rf=%2F%2Fcdn.jwplayer.com%2Fv2%2Fplaylists%2FToq2ZZoq%3Frelated_media_id%3DMEDIAID&sn=%7B%22name%22%3A%22nyp%22%2C%22url%22%3A%22https%3A%2F%2Fnypost.com%2Fwp-content%2Fplugins%2Fnyp-video-player%2Fbuild%2Fcss%2Fjw-player-skin.min.css%3F4b14b722bb788c325d45%22%7D&sp=0&st=2690&sa=1689040510749
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by: cache-mia-kmia1760077-MIA
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-cache: MISS
x-cache-hits: 0

GET
H2 204 ping.gif
prd.jwpltx.com/v1/jwplayer6/ 0
26 B 87ms
61ms Image
text/plain 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/jwplayer6/ping.gif?h=1378795841&e=pa&n=5841242090480856&abc=0&abt=128_sendDomainToFeedsOn&aid=wExvYnLyEeyygEIIgluVXw&amp=0&ask=FTyzwZMf&at=1&c=1&ccp=0&cp=0&d=1&eb=0&ed=6&emi=j5ldbh1ywjmc&i=0&id=ZOo6mQs1&lid=2e1ah1ivli3c&lsa=read&mt=1&pbd=1&pbr=1&pgi=1omq2z11u15w&ph=1&pid=SPdDOYds&pii=0&pl=413&plc=1&pli=1nf5cfw89rzh&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&pv=8.27.1&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Today%27s%20Business%20Headlines%3A%207%2F10%2F23&tv=3.42.2&vb=1&vi=0.82&vl=90&wd=734&ab=1&cme=0&fed=DjYI9AQQ&flc=1&lng=en-US&mu=https%3A%2F%2Fcdn.jwplayer.com%2Fmanifests%2FZOo6mQs1.m3u8&pd=2&pdr=&plng=en-US&pni=1&pogt=Wells%20Fargo%20VP%20Carl%20Nelson%20%E2%80%98gave%20female%20subordinate%20unwanted%20massages%2C%20invited%20her%20to%20exercise%20and%20shower%20with%20him%E2%80%99%3A%20lawsuit&pr=2&tb=0&vd=52&sa=1689040511728
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by: cache-mia-kmia1760077-MIA
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-cache: MISS
x-cache-hits: 0

GET
H2 204 ping.gif
prd.jwpltx.com/v1/clienta/ 0
26 B 85ms
60ms Image
text/plain 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/clienta/ping.gif?h=-932180230&e=ar&n=5860832994490086&abc=1&abt=128_sendDomainToFeedsOn&aid=wExvYnLyEeyygEIIgluVXw&amp=0&ask=FTyzwZMf&at=1&c=1&ccp=0&cp=0&d=1&eb=0&ed=6&emi=j5ldbh1ywjmc&i=0&id=ZOo6mQs1&lid=2e1ah1ivli3c&lsa=read&mt=1&pbd=1&pbr=1&pgi=1omq2z11u15w&ph=1&pid=SPdDOYds&pii=0&pl=413&plc=1&pli=1nf5cfw89rzh&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&pv=8.27.1&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Today%27s%20Business%20Headlines%3A%207%2F10%2F23&tv=3.42.2&vb=1&vi=0.82&vl=90&wd=734&ab=1&abid=1i6y1cmyi8h5&adi=1i6y1cmyi8h5&apid=1i6y1cmyi8h5&awi=1&awc=1&p=0&pc=0&pi=0&pr=2&vu=securepubads.g.doubleclick.net&apt=1&fed=DjYI9AQQ&rtp=%7B%7D&sa=1689040511744
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by: cache-mia-kmia1760077-MIA
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-cache: MISS
x-cache-hits: 0

GET
H2 204 ping.gif
prd.jwpltx.com/v1/jwplayer6/ 0
26 B 60ms
60ms Image
text/plain 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/jwplayer6/ping.gif?h=398030310&e=bs&n=4669964169226979&abc=1&abt=128_sendDomainToFeedsOn&aid=wExvYnLyEeyygEIIgluVXw&amp=0&ask=FTyzwZMf&at=1&c=1&ccp=0&cp=0&d=1&eb=0&ed=6&emi=j5ldbh1ywjmc&i=0&id=ZOo6mQs1&lid=2e1ah1ivli3c&lsa=read&mt=1&pbd=1&pbr=1&pgi=1omq2z11u15w&ph=1&pid=SPdDOYds&pii=0&pl=413&plc=1&pli=1nf5cfw89rzh&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&pv=8.27.1&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Today%27s%20Business%20Headlines%3A%207%2F10%2F23&tv=3.42.2&vb=1&vi=0.82&vl=90&wd=734&fed=Toq2ZZoq&fid=c67e60d0-8fcb-4e24-a056-5167516f14fc&ft=FEED&mu=https%3A%2F%2Fcdn.jwplayer.com%2Fmanifests%2FZOo6mQs1.m3u8&os=1&sa=1689040511804
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by: cache-mia-kmia1760077-MIA
date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-cache: MISS
x-cache-hits: 0

GET
H2

200

db_sync
px.ads.linkedin.com/ Frame B23D
Redirect Chain

https://idsync.rlcdn.com/420046.gif?partner_uid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
https://idsync.rlcdn.com/1000.gif?memo=CM7RGRJMCkgIARC-ngEaQFlqYy1RZEpUQ0NmVE1VdUNIVmR1YVRtaWlwZDJjWkctVXEzeDVuek1DR04yNVNIM1phWDBrOUVxOVdzRnZqd04QABoNCP_ssqUGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=dc624573ee51c468519787b7cdc4b87a3bc7228c24ceb1c63ec6823c870a63b3791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=dc624573ee51c468519787b7cdc4b87a3bc7228c24ceb1c63ec6823c870a63b3791426b5417dce21&rand=00922058
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=dc624573ee51c468519787b7cdc4b87a3bc7228c24ceb1c63ec6823c870a63b3791426b5417dce21&rand=00922058&expected_cookie=ee0683fe-5dfa-42be-8ec9-aebe352c89ed

0
141 B

83ms
83ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=dc624573ee51c468519787b7cdc4b87a3bc7228c24ceb1c63ec6823c870a63b3791426b5417dce21&rand=00922058&expected_cookie=ee0683fe-5dfa-42be-8ec9-aebe352c89ed
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 66AE4001CEC04927964C68A2B902A05A Ref B: MIAEDGE2921 Ref C: 2023-07-11T01:55:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYALGPQViA/RjYwiKNKnQ==

Redirect headers

date: Tue, 11 Jul 2023 01:55:12 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 27A6D20037D14B6BB8A418F70AB89579 Ref B: MIAEDGE2921 Ref C: 2023-07-11T01:55:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: /db_sync?pid=10339&puuid=dc624573ee51c468519787b7cdc4b87a3bc7228c24ceb1c63ec6823c870a63b3791426b5417dce21&rand=00922058&expected_cookie=ee0683fe-5dfa-42be-8ec9-aebe352c89ed
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYALGPKHJIFqcJP38fXVA==

GET /
b1sync.zemanta.com/usersync/outbrain/ Frame B23D 0
0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://ib.adnxs.com/getuid?https://sync.outbrain.com/cookie-sync?p=appnexus&uid=$UID&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&ini...
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dappnexus%26uid%3D%24UID%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN%26gdpr...
https://sync.outbrain.com/cookie-sync?p=appnexus&uid=6113698130532189562&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob

0
145 B

406ms
118ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=appnexus&uid=6113698130532189562&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache
X-TraceId: 8fffe118801d93737fff73c355f67294
Content-Length: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 225d2639-45d7-422e-9de3-6eda6f01f5b8
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://sync.outbrain.com/cookie-sync?p=appnexus&uid=6113698130532189562&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame B23D
Redirect Chain

https://dpm.demdex.net/ibs:dpid=133726&dpuuid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_pd=1&gdpr_consent=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_pd=1&gdpr_consent=

42 B
942 B

120ms
112ms

Image
image/gif

44.238.178.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_pd=1&gdpr_consent=

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html

Protocol

HTTP/1.1

Server

44.238.178.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

DCS: dcs-prod-usw2-1-v046-0e56d4276.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 7t8Ol8EWRb4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-usw2-2-v046-08a6254e2.edge-usw2.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: BM3VP0UJSBo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=133726&dpuuid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_pd=1&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET set
sync-jp.im-apps.net/imid/ Frame B23D 0
0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=icco6m5&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=ttd&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=

0
145 B

456ms
118ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=ttd&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache
X-TraceId: 45fcabc90e294f58e2aa9c757b735d94
Content-Length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=ttd&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 241

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame B23D 0
338 B 223ms
55ms Image
text/plain 35.169.95.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=outbrain&partner_uid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.95.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-95-213.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by: beacon-n031-ash-prod.krxd.net
date: Tue, 11 Jul 2023 01:55:12 GMT
cache-control: private, no-cache, no-store
x-request-time: D=33 t=1689040512
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame B23D 43 B
656 B 240ms
69ms Image
image/gif 13.225.214.84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212295978&puid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-84.ewr50.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
via: 1.1 c5e0ddd115d9893ade353cf085d11dba.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: EWR50-C1
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: Jga7Y6H-oK-tr5uuBLMZFjzKzOjb2lTnOAZF6VpZ_pEAhpLdsl3QNg==
expires: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=outbrain&ssp_user_id=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=outbrain&ssp_user_id=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
https://sync.outbrain.com/cookie-sync?p=mediaforce&uid=1d1ea802-532c-43e0-b670-ad442f4cee1c&gdpr=0&gdpr_consent=&us_privacy=1---

0
145 B

359ms
113ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=mediaforce&uid=1d1ea802-532c-43e0-b670-ad442f4cee1c&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache
X-TraceId: 9686601f6c9278d97b8aee7803720a95
Content-Length: 0

Redirect headers

location: //sync.outbrain.com/cookie-sync?p=mediaforce&uid=1d1ea802-532c-43e0-b670-ad442f4cee1c&gdpr=0&gdpr_consent=&us_privacy=1---
date: Tue, 11 Jul 2023 01:55:12 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://x.bidswitch.net/sync?ssp=outbrain&user_id=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&us_privacy=1---&gdpr=0&gdpr_pd=1&gdpr_consent=
https://cm.smadex.com/sync?sm_did=bds&bds_ssp_id=outbrain&bds_param=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://x.bidswitch.net/sync?dsp_id=340&user_id=1b8eb1c9-6605-4e2c-94fa-0949c482a6fd&expires=10&ssp=outbrain&bsw_param=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://sync.outbrain.com/cookie-sync?p=bidswitch&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

0
145 B

117ms
112ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=bidswitch&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache
X-TraceId: 43fa4998ebdc4e52b0ca2e6309dedc74
Content-Length: 0

Redirect headers

Location: //sync.outbrain.com/cookie-sync?p=bidswitch&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=74&p=126&cp=outbrain&cu=1&url=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcriteo%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9E...
https://sync.outbrain.com/cookie-sync?p=criteo&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&uid=04be89c4-bea7-45ac-b688-6...

0
145 B

460ms
117ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&uid=04be89c4-bea7-45ac-b688-63ea5594789c
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache
X-TraceId: 4094965b20b6d59490512d2a037c3d22
Content-Length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:11 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://sync.outbrain.com/cookie-sync?p=criteo&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&uid=04be89c4-bea7-45ac-b688-63ea5594789c
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1633504
content-length: 0
expires: Tue, 11 Jul 2023 00:00:00 GMT

GET
H/1.1

200
OK

bswsync
crb.kargo.com/api/v1/ Frame B23D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&google_dbm
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEAyOJiESJ0YaPC8B9da2e0g&google_cver=1
https://crb.kargo.com/api/v1/bswsync?bsw_uuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dsp_uuid=&dsp_id=&krg_ids=&gdpr=&gdpr_consent=&us_privacy=

43 B
504 B

252ms
62ms

Image
image/gif

54.165.22.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/bswsync?bsw_uuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dsp_uuid=&dsp_id=&krg_ids=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 54.165.22.8 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-165-22-8.compute-1.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
X-Accel-Expires: 0
Vary: Origin
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: //crb.kargo.com/api/v1/bswsync?bsw_uuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dsp_uuid=&dsp_id=&krg_ids=&gdpr=&gdpr_consent=&us_privacy=
Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=25&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=activeagent&uid=7254373760666630288&gdpr=0&gdpr_consent=

0
145 B

120ms
120ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=activeagent&uid=7254373760666630288&gdpr=0&gdpr_consent=
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: no-cache
X-TraceId: ad148176ddd85d997da8210e1a458f57
Content-Length: 0

Redirect headers

Location: https://sync.outbrain.com/cookie-sync?p=activeagent&uid=7254373760666630288&gdpr=0&gdpr_consent=
Date: Tue, 11 Jul 2023 01:55:12 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/ Frame B23D
Redirect Chain

https://ps.eyeota.net/match?bid=1mpn7m0&uid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
https://ps.eyeota.net/match/bounce/?bid=1mpn7m0&uid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN

70 B
440 B

61ms
60ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?bid=1mpn7m0&uid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /match/bounce/?bid=1mpn7m0&uid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
Date: Tue, 11 Jul 2023 01:55:12 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
id.geistm.com/m/OB/ Frame B23D 0
0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://creativecdn.com/cm-notify?pi=outbrain&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
https://creativecdn.com/cm-notify?pi=outbrain&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&tc=1
https://sync.outbrain.com/cookie-sync?p=rtbhouse&uid=KQzI03wLm8jPizONN02F&pi=outbrain&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&ini...

0
145 B

129ms
127ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rtbhouse&uid=KQzI03wLm8jPizONN02F&pi=outbrain&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&tc=1
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: 82ff2ebd482be0edff6f760614786f64
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=rtbhouse&uid=KQzI03wLm8jPizONN02F&pi=outbrain&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&tc=1
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT, Tue, 11 Jul 2023 01:55:13 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LJXN3YYH-1F-G80F&obUid=&initiator=&gdpr=0&us_privacy=1---

0
145 B

111ms
111ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LJXN3YYH-1F-G80F&obUid=&initiator=&gdpr=0&us_privacy=1---
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: e2c843382778de30e6cb274692967576
Content-Length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=LJXN3YYH-1F-G80F&obUid=&initiator=&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
Expires: 0

GET
H2 403 tpid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
sync.crwdcntrl.net/map/c=14516/tp=OBRN/ Frame B23D 49 B
268 B 59ms
58ms Image
image/gif 3.228.206.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=14516/tp=OBRN/tpid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.206.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-206-213.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.6.223
content-length: 49
expires: 0

GET
H2

204

/
loadus.exelator.com/load/ Frame B23D
Redirect Chain

https://loadus.exelator.com/load/?p=580&g=2&j=0&buid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
https://loadus.exelator.com/load/?p=580&g=2&j=0&buid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&xl8blockcheck=1
https://loadus.exelator.com/load/?p=204&g=750&j=0&buid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&test={%22attributes%22:%20{},%20%22agreedId%22:%20%22%22}

0
1 KB

59ms
59ms

Image
text/plain

34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadus.exelator.com/load/?p=204&g=750&j=0&buid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&test={%22attributes%22:%20{},%20%22agreedId%22:%20%22%22}
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://loadus.exelator.com/load/?p=204&g=750&j=0&buid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&test={"attributes": {}, "agreedId": ""}
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN2...
https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&ini...

0
145 B

114ms
114ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: 3936aee19cd58019ce386936b5b661e0
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160065&gdpr=PM_GDPR&gdpr_consent=PM_CONSENT&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160065%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%...
https://image8.pubmatic.com/AdServer/ImgSync?p=160065&gdpr=PM_GDPR&gdpr_consent=PM_CONSENT&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160065%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=-1&gdpr_consent=PM_CONSENT
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160065&pmc=1&pr=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dpubmatic%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9Ws...
https://sync.outbrain.com/cookie-sync?p=pubmatic&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&initiator=ob&gdpr_consent=&us_privacy=1---&uid=50674DE4-1331-4B8B-A08E...

0
145 B

432ms
111ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=pubmatic&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&initiator=ob&gdpr_consent=&us_privacy=1---&uid=50674DE4-1331-4B8B-A08E-394A47B0E933
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
Cache-Control: no-cache
X-TraceId: b0e5f72f79394d37d064f5beb42dcba7
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=pubmatic&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&initiator=ob&gdpr_consent=&us_privacy=1---&uid=50674DE4-1331-4B8B-A08E-394A47B0E933
date: Tue, 11 Jul 2023 01:55:14 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://u.openx.net/w/1.0/cm?id=00df9f64-6f67-4cae-aeb2-d951da52047c&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26initiator%3Dob%26...
https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&uid=2ab3f020-be94-4a2f-8d2d-f2...

0
145 B

212ms
110ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&uid=2ab3f020-be94-4a2f-8d2d-f2a44a42db08
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: d955c99d2d115097b7a003ecf09f6086
Content-Length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://sync.outbrain.com/cookie-sync?p=openx&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&uid=2ab3f020-be94-4a2f-8d2d-f2a44a42db08
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://ups.analytics.yahoo.com/ups/58523/occ?gdpr=0&gdpr_consent=&us_privacy=1---&redir=true
https://sync.outbrain.com/cookie-sync?p=oath&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A&gdpr=0

0
145 B

107ms
107ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=oath&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A&gdpr=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: d035bb61d69af3aca48fa957189db163
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=oath&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A&gdpr=0
date: Tue, 11 Jul 2023 01:55:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://ice.360yield.com/server_match?partner_id=1863&r=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dimprove_digital%26uid%3D%7BPUB_USER_ID%7D%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5...
https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_priva...

0
145 B

197ms
111ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: 1e3123937d1151b7adc385698d742a1e
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=improve_digital&uid=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:13 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=o&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmaato%26uid%3D%24UID%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN%26gd...
https://sync.outbrain.com/cookie-sync?p=smaato&uid=884ce527&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob

0
145 B

170ms
121ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=smaato&uid=884ce527&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: 06b708b4d570cb0b19475b418f05c017
Content-Length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
via: 1.1 c22d4946ef5faea12b8d3942ceb9259a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-P1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.outbrain.com/cookie-sync?p=smaato&uid=884ce527&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: NsR1dutR4H5GxEDQuVl--cRq-lLekXtwLoV2z7hgY-2XXxbFz3CzjA==

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=30&gdpr=0&gdpr_consent=&redirectUri=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmart%26uid%3D%5Bssb_sync_pid%5D%26obUid%3DYjc-QdJTCCfTMU...
https://sync.outbrain.com/cookie-sync?p=smart&uid=8004212043844932477&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob

0
145 B

216ms
115ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=smart&uid=8004212043844932477&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: 9698c8cd7d671c6a4ac2a17ea67fdc70
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=smart&uid=8004212043844932477&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
date: Tue, 11 Jul 2023 01:55:13 GMT
content-length: 0

GET
H2 200 c.gif
c.bing.com/ Frame B23D 42 B
669 B 132ms
55ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?red3=MSOB_pd&uid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Tue, 06 Jun 2023 17:31:18 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AC8348F755E442F4848903FF2F37ED49 Ref B: MIA301000106029 Ref C: 2023-07-11T01:55:13Z
etag: "7cd81bb49c98d91:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://id.rlcdn.com/711945.gif?ct=4&cv=
https://sync.outbrain.com/cookie-sync?p=liveramp&uid=&

0
145 B

119ms
118ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=liveramp&uid=&
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: 69d30e11a04236b3dd6fab9e4d02bc56
Content-Length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://sync.outbrain.com/cookie-sync?p=liveramp&uid=&
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=127&gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcentro%26uid%3D%7BuserId%7D%26obUid%3DYjc-QdJTC...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=127&gdpr=0&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dcentro%26uid%3D%7BuserId%7D%26obUid%3...
https://sync.outbrain.com/cookie-sync?p=centro&uid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_...

0
145 B

122ms
121ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=centro&uid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:14 GMT
Cache-Control: no-cache
X-TraceId: b1beda58e12d04ecbe8c239cbfa4d01e
Content-Length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://sync.outbrain.com/cookie-sync?p=centro&uid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://cms.quantserve.com/pixel/p-cxanv6hYFn1kw.gif?idmatch=0&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.outbrain.com/cookie-sync?p=quantcast&gdpr=0&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&uid=cYF0wyWDLZFqjHTDIoA4xiSFJcRq1C3DctQA4qVn

0
145 B

117ms
116ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=quantcast&gdpr=0&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&uid=cYF0wyWDLZFqjHTDIoA4xiSFJcRq1C3DctQA4qVn
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: no-cache
X-TraceId: 2985d0d9efd360ac87c9f5e1ce5ec5b4
Content-Length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://sync.outbrain.com/cookie-sync?p=quantcast&gdpr=0&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&uid=cYF0wyWDLZFqjHTDIoA4xiSFJcRq1C3DctQA4qVn
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

400
Bad Request

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=562709&ev=1&us_privacy=${us_privacy}&rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dpulsepoint%26uid%3D%25%25VGUID%25%25%26obUid%3DYjc-QdJTCCfTMUuCH...
https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid=8xRLQOLR1WBf&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&ev=1&us_...

0
84 B

117ms
117ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid=8xRLQOLR1WBf&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&ev=1&us_privacy=${us_privacy}&pid=562709
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Content-Length: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid=8xRLQOLR1WBf&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---&initiator=ob&ev=1&us_privacy=${us_privacy}&pid=562709
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

GET

3.gif
id5-sync.com/cq/164/124/7/ Frame B23D
Redirect Chain

https://id5-sync.com/s/164/9.gif?puid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---
https://id5-sync.com/c/164/164/9/1.gif?puid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN&gdpr=0&gdpr_consent=&us_privacy=1---
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F164%2F796%2F8%2F2.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/164/796/8/2.gif?puid=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-3928_8vCH2FvvhZnlGw1mv72eswtI1rj3CtwBeQCbg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F164%2F124%2F7%2F3.gif%3Fpuid%3D...
https://id5-sync.com/cq/164/124/7/3.gif?puid=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

0
0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B23D
Redirect Chain

https://cm.rtbsystem.com/usermatch/ob?redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Drtbsystem%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26uid%3D%7Buserid%7D%26initiator%3Dob%2...
https://sync.outbrain.com/cookie-sync?p=rtbsystem&gdpr=0&gdpr_consent=&us_privacy=1---&uid=4034e804-675c-53ff-8d3d-4a001e276d29&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3Za...

0
145 B

116ms
115ms

Image
text/plain

38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rtbsystem&gdpr=0&gdpr_consent=&us_privacy=1---&uid=4034e804-675c-53ff-8d3d-4a001e276d29&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Protocol: HTTP/1.1
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://widgets.outbrain.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:14 GMT
Cache-Control: no-cache
X-TraceId: b5c43db61263e6e01e2dd8d7b7f3d657
Content-Length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FiSEnT9Mgp2NmYyCiT8PdQ5iJie5GljQsvKOrp7mTu8x0gzKw4CB%2BKAks%2F6tSaDi5yQ1WyanWlJFcOOP6V%2Butz0vkF4E%2FJNwaEFzE7fFXP8adFPHTjEO3hO1F7wflomdkIHc3J5oDrWhw6%2Bbve4p"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://sync.outbrain.com/cookie-sync?p=rtbsystem&gdpr=0&gdpr_consent=&us_privacy=1---&uid=4034e804-675c-53ff-8d3d-4a001e276d29&initiator=ob&obUid=Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN
cf-ray: 7e4d6c4a6d363353-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame 772D 4 KB
2 KB 232ms
58ms Document
text/html 44.198.90.146
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.198.90.146 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-198-90-146.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ce37dc739f473ae5f3719334107afc9b4d3faad7ddd3257dd4ba1d78ae850fdf

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 11 Jul 2023 01:55:12 GMT
etag: W/"0d3b1879b8e028e4d236318f72f666f0b"
server: nginx
timing-allow-origin: *

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 68B5
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
2 KB

67ms
67ms

Document
text/html

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 1d2ceb716a0189497f1527384e2f757a32faf4b7d6a07928b953c68fc7207df9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1802
Content-Type: text/html
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

Redirect headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 0
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Keep-Alive: timeout=1, max=500
Location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame 7B9B 427 B
937 B 196ms
57ms Document
text/html 54.161.177.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.161.177.158 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-177-158.compute-1.amazonaws.com
Software: /
Resource Hash: 01e35b3b8b384367d0ec274984dbc61e23e452b25af81f1b29840f9fc409d4a7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 427
date: Tue, 11 Jul 2023 01:55:12 GMT

GET
H2 200 jquery.js Show response
nypost.com/wp-includes/js/jquery/ Frame BF25 282 KB
85 KB 34ms
33ms Script
application/javascript 192.0.66.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://nypost.com/wp-includes/js/jquery/jquery.js
Requested by: Host: nypost.com
URL: https://nypost.com/wp-content/plugins/nyp-zephr/build/app.bundle.min.js?ver=bcdb84b11dc015415df7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 8c3010509fc7480b59413a90d69e9fafcb3d5aa202faf7862466f6bb8be1a335

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
x-rq: mia8 96 184 443
last-modified: Tue, 20 Jun 2023 18:26:06 GMT
server: nginx
etag: W/"6491ef3e-46758"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 embed.bundle.min.js Show response
nypost.com/wp-content/plugins/nyp-zephr/build/ Frame BF25 184 KB
63 KB 35ms
33ms Script
application/javascript 192.0.66.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://nypost.com/wp-content/plugins/nyp-zephr/build/embed.bundle.min.js?ver=bcdb84b11dc015415df7
Requested by: Host: nypost.com
URL: https://nypost.com/wp-content/plugins/nyp-zephr/build/app.bundle.min.js?ver=bcdb84b11dc015415df7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.66.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 6e850df9db09419a7025aa562a1b9e3129b9e7dcc12f6a2befb02d826338ed55

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:11 GMT
content-encoding: gzip
x-rq: mia8 96 185 443
last-modified: Mon, 10 Jul 2023 16:24:01 GMT
server: nginx
etag: W/"64ac30a1-2e0f4"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31536000

GET
H2 200 uel0ekt.css
use.typekit.net/ Frame BF25 8 KB
1 KB 70ms
68ms Stylesheet
text/css 2600:141b:5000::17df:9c48
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/uel0ekt.css

Requested by

Host: nypost.com
URL: https://nypost.com/wp-content/plugins/nyp-zephr/build/app.bundle.min.js?ver=bcdb84b11dc015415df7

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:5000::17df:9c48 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

bd65610919da8526de9e3bb65a1ef9414a83990e0c5e7c275392627e6a43bc63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Tue, 11 Jul 2023 01:55:11 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1047

OPTIONS
H2 200 logs
broker.datazoom.io/broker/v1/ Frame 0
0 59ms
59ms Preflight 35.174.179.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://broker.datazoom.io/broker/v1/logs
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.179.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-179-161.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST,OPTIONS,HEAD,GET
access-control-allow-origin: *
access-control-max-age: 86400
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Tue, 11 Jul 2023 01:55:11 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 logs Show response
broker.datazoom.io/broker/v1/ 498 B
654 B 62ms
61ms XHR
application/json 35.174.179.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://broker.datazoom.io/broker/v1/logs
Requested by: Host: platform.datazoom.io
URL: https://platform.datazoom.io/beacon/v1/config?configuration_id=d6ee0345-1775-424f-9589-5be490675ddc&ver=b7a2ea601a888076291e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.179.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-179-161.compute-1.amazonaws.com
Software: /
Resource Hash: 3ea97f42038b24d6f227781bbe41b116a1759f9fb88ba28967beb6db67ad250f

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:11 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame ECF7 16 KB
6 KB 230ms
81ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=126798
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Tue, 11 Jul 2023 01:55:12 GMT
expires: Wed, 12 Jul 2023 13:08:30 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 60DB 281 B
554 B 197ms
60ms Document
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:12 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2

200

visitormatch Show response
bh.contextweb.com/ Frame 6FB2
Redirect Chain

https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

828 B
2 KB

71ms
68ms

Document
text/html

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

4898a823af82870a7bf501e4c395c5e3149e81016b9d0cc517d2ceb9e7a0c393

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-US
content-length: 828
content-type: text/html;charset=iso-8859-1
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: en-US
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1
location: /visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 415C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58251/sync?redir=true
https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1SSTV6a3A5RTJ1SnZKLmduWFdVX2Z5NngxaERSdlB0U35B

43 B
479 B

107ms
64ms

Document
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1SSTV6a3A5RTJ1SnZKLmduWFdVX2Z5NngxaERSdlB0U35B

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: VG4T93SGYFE9SPA4PRRG

Redirect headers

age: 0
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1SSTV6a3A5RTJ1SnZKLmduWFdVX2Z5NngxaERSdlB0U35B
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
server: ATS/9.1.10.57
strict-transport-security: max-age=31536000

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame FFEB 693 B
825 B 144ms
54ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 85b36f92674155e5984046d73c3b4626d7f00f4942ab97b694ea2d01eeed9d93

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 399
content-type: text/html
date: Tue, 11 Jul 2023 01:55:12 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 7E55
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
https://s.amazon-adsystem.com/ecm3?id=6113698130532189562&ex=appnexus.com

43 B
479 B

69ms
66ms

Document
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=6113698130532189562&ex=appnexus.com

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 78HDH2M4VD4EBGVC7RP3

Redirect headers

AN-X-Request-Uuid: 9292007c-4288-414a-a7b3-24520e81c633
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Tue, 11 Jul 2023 01:55:11 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://s.amazon-adsystem.com/ecm3?id=6113698130532189562&ex=appnexus.com
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 5B8B
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1804524819996289569111

43 B
479 B

100ms
77ms

Document
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1804524819996289569111

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 42CY3DQC5ZXS0SWTF4GD

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=1804524819996289569111
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sid Show response
mug.criteo.com/ Frame B693
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=nypost.com&sn=ChromeSyncframe&so=0&topUrl=nypost.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=scs99HxrczFEamNPYXdTYVN5RWtSKy8vZEMzcWZJcmU1cVgzL1paVDhSanZnYjhHWlU1ZWVxYjNOaUJMTTRVcnFsNlJ5K3ZFeHM3NmEwU1hJNkE3bWllVGc1YXBUcERmV0RoRS80MEVtcytId1hZZGEwTHFRSmJZTENTaE...

430 B
655 B

172ms
53ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=scs99HxrczFEamNPYXdTYVN5RWtSKy8vZEMzcWZJcmU1cVgzL1paVDhSanZnYjhHWlU1ZWVxYjNOaUJMTTRVcnFsNlJ5K3ZFeHM3NmEwU1hJNkE3bWllVGc1YXBUcERmV0RoRS80MEVtcytId1hZZGEwTHFRSmJZTENTaEdOV0FsekJkelFQc3M4TG1GWVpOS0NuN2ptODFhOXBPUmhaSkQ2ZXFUdjhic1FHMHBRMlNjdGxsTXl6TDJpa3hVaWFkL1picHo3d0UrQ1pPRVpOaDI0Ym9NVVdvVEdaaE44QXZSWk9XaU51OWVJMzhZUFBlZTdmczEvVkw3WnplWkhSTkJyZWVPWlB3aVFEdU55ekhQcEFLdUJNQlRrUT09fA&cppv=2

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8330c102d4873744104052cac040b7d5385126993ccdeb98a0891a3a171c3503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:11 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 693738
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=scs99HxrczFEamNPYXdTYVN5RWtSKy8vZEMzcWZJcmU1cVgzL1paVDhSanZnYjhHWlU1ZWVxYjNOaUJMTTRVcnFsNlJ5K3ZFeHM3NmEwU1hJNkE3bWllVGc1YXBUcERmV0RoRS80MEVtcytId1hZZGEwTHFRSmJZTENTaEdOV0FsekJkelFQc3M4TG1GWVpOS0NuN2ptODFhOXBPUmhaSkQ2ZXFUdjhic1FHMHBRMlNjdGxsTXl6TDJpa3hVaWFkL1picHo3d0UrQ1pPRVpOaDI0Ym9NVVdvVEdaaE44QXZSWk9XaU51OWVJMzhZUFBlZTdmczEvVkw3WnplWkhSTkJyZWVPWlB3aVFEdU55ekhQcEFLdUJNQlRrUT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 526242
content-length: 0
expires: 0

GET
H2 200 track
servt.unrulyvideo.com/ 0
98 B 328ms
61ms Image
text/plain 75.101.227.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servt.unrulyvideo.com/track?pid=603f65a2e291680ef30af9c7&cid=63270a3c111cb340ec60ce24&cb=1689040511917&r=nypost.com&stagid=62af35d851923c62777207b4&stplid=62b08bd1ff25cd1ac30f2fb8&d35=&cd10=622640&e=playerLoaded
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.227.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-227-9.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H/1.1

200
OK

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://sync.colossusssp.com/pbs.gif?gdpr=&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dcolossus%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3...
https://prebid-server.rubiconproject.com/setuid?bidder=colossus&gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&account=&f=i&uid=[UID]

86 B
671 B

73ms
58ms

Image
image/png

69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=colossus&gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&account=&f=i&uid=[UID]
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/png
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-encoding: gzip
transfer-encoding: chunked
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx
Transfer-Encoding: chunked
Location: https://prebid-server.rubiconproject.com/setuid?bidder=colossus&gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&account=&f=i&uid=[UID]
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

OPTIONS
H2 200 sp_Sx8YukwE
api-2-0.spot.im/v1.0.0/broadcasts/broadcasts/ Frame 0
0 71ms
68ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-2-0.spot.im/v1.0.0/broadcasts/broadcasts/sp_Sx8YukwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-6.jfk50.r.cloudfront.net
Software: fasthttp /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-spotim-device-uuid,x-spotim-page-view-id
Access-Control-Request-Method: GET
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
server: fasthttp
via: 1.1 5a7c529ef93438ca768c3432355a6e72.cloudfront.net (CloudFront)
x-amz-cf-id: yaG56rApHzgv9_UGok17xA8C6kSvSPqFu1mfocUPC2VmkZ1GY9rkzg==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

OPTIONS
H2 200 authenticate
api-2-0.spot.im/v1.0.0/ Frame 0
0 73ms
69ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/authenticate

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-post-id,x-spot-id,x-spotim-device-uuid
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
server: fasthttp
strict-transport-security: max-age=31536000
via: 1.1 5a7c529ef93438ca768c3432355a6e72.cloudfront.net (CloudFront)
x-amz-cf-id: aniQX21-LO68kVO6DquVph0JtKK63WatbQGHTem0Hol7L-l1_jr3LA==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

GET
H2 200 sp_Sx8YukwE Show response
api-2-0.spot.im/v1.0.0/broadcasts/broadcasts/ 25 B
762 B 66ms
62ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-2-0.spot.im/v1.0.0/broadcasts/broadcasts/sp_Sx8YukwE
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/480-bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-6.jfk50.r.cloudfront.net
Software: fasthttp /
Resource Hash: b15adda52043ab41ba5663be05a91676db5ff3ad95e82dfafe7c5047eedc3f26

Request headers

Accept: application/json
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-spotim-page-view-id: 7c0165b7-2b99-4969-ad26-befdcc2f3ff1
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 11 Jul 2023 01:49:04 GMT
via: 1.1 f8b0654d6e6bbf12f54a635de5db7ee4.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
age: 368
x-cache: Hit from cloudfront
content-length: 25
x-request-id: 1d79f9b2-1f8d-11ee-a114-62ee5cf4afe1
server: fasthttp
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
x-amz-cf-id: 1vyBmiZ7glK_DrxIIth__EaoZ4-9Dv3zQrjChgTeD12P2O3TxKQC_Q==

POST
H2 200 authenticate Show response
api-2-0.spot.im/v1.0.0/ 362 B
3 KB 110ms
110ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/authenticate

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/shell-bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

2f9914d15f28586196d7ee96b24ec9917475022d60fedd39d6f1b61ea36f2fdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

x-spot-id: sp_Sx8YukwE
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-post-id: 26897126
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
via: 1.1 5a7c529ef93438ca768c3432355a6e72.cloudfront.net (CloudFront)
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
x-spotim-networkid: net_nypost
content-length: 362
x-spotim-token: 01230711rdCZLh.03758f4e1df52d46debd0283bcc3f6c2512e786d5567c3523ad99e7a851afea9
x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInZlcmlmaWVkIjpmYWxzZSwidXNlcl9pZCI6InVfRkVxaEw5ck9RQWk0IiwiZGlzcGxheV9uYW1lIjoiR29sZENvY2t0YWlsIiwidXNlcl9uYW1lIjoiR29sZENvY2t0YWlsIiwicmVnaXN0ZXJlZCI6ZmFsc2UsImltYWdlX2lkIjoiI0dvbGQtQ29ja3RhaWwiLCJyb2xlcyI6W10sInNzb19kYXRhIjpudWxsLCJwcm92aWRlcnMiOm51bGwsInJlcHV0YXRpb24iOnt9LCJzcG90X2lkIjoic3BfU3g4WXVrd0UiLCJsYXN0X2NoZWNrIjoxNjg5MDQwNTEyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMjMwNzExcmRDWkxoLjAzNzU4ZjRlMWRmNTJkNDZkZWJkMDI4M2JjYzNmNmMyNTEyZTc4NmQ1NTY3YzM1MjNhZDk5ZTdhODUxYWZlYTkiLCJwZXJtaXNzaW9ucyI6bnVsbCwic3BvdGltLWRldmljZS12MiI6ImRfSnJTNlFxeE42MTJnTFplMkp1RXgiLCJuZXR3b3JrIjp7Im5ldHdvcmtfaWQiOiJuZXRfbnlwb3N0IiwibmV0d29ya19uYW1lIjoiTllQb3N0IiwibmV0d29ya19pbWFnZV9pZCI6Ik5ZUG9zdCIsIm5ldHdvcmtfY29sb3IiOiIjQ0MzMzMzIn0sInNwb3RfbmFtZSI6IiIsImRvbWFpbiI6IiIsInJvbGVzX251bWJlciI6MCwidGVtcF91c2VyIjpmYWxzZSwiZXhwIjoxNzE3NDYyNTEyLCJzdWIiOiJ1X0ZFcWhMOXJPUUFpNCJ9.bJD27s1123S3CPCYGFsfSDBjC3EISpulrrTgoZoDPxo
x-request-id: f8d7cf7a-1f8d-11ee-a88e-fe5dda542446
x-guid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
server: fasthttp
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
x-amz-cf-id: oBp95oCG6hJqdHVSEfEpU7r0CCyGJi9noTHPuSM8oOtb9Vx9geg2WA==

GET
H2 200 918-bundle.js Show response
static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/ 136 KB
35 KB 64ms
64ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/918-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: aed2024c0b547dfcf4693718aa6b73058c09bbc2ffb4608033cb1c5cffd2ac19

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:14:31 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: v4Y5OOhVpHPMX8IvFyL6KjZExhOuGZJm
x-amz-cf-pop: EWR53-C3
age: 1687242
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 34868
last-modified: Wed, 21 Jun 2023 08:25:59 GMT
server: AmazonS3
etag: "5c219744e2d287fb0baa92c1288d9cb9"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: C0IqAbYorpeL8iofx_l9IF5fhftagRRWZ3yBE5LrS01kRNF2LBeqTA==

GET
H2 200 with-all-vendors-bundle.js Show response
static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/ 393 B
692 B 70ms
69ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/with-all-vendors-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7fe77c30581bd46d966e9210fad4688336fa49fe7bf366bbbfef8eecea39cd4f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:14:31 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: beZYuvYu3WUqQbvi8KjDUng_PsZzSPvr
x-amz-cf-pop: EWR53-C3
age: 1687242
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 216
last-modified: Wed, 21 Jun 2023 08:25:59 GMT
server: AmazonS3
etag: "dfb281e5bbe2546f2fce2a228160c5d1"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: ciAa_FOuucSrLgf_EbIeox_W7SdzEV9LC8xuknFV7ZAu8B7EyLSsSA==

GET
H2 200 notifications-bundle.js Show response
static-cdn.spot.im/production/notifications/tags/v1.20.1/ 9 KB
3 KB 70ms
70ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/notifications/tags/v1.20.1/notifications-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d66946043243b97429f97affe0047416607cfb40762d0c8ebad79a360a629ce4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: zwB_54aZOWzuESOVNualgljYs6kzfPQB
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 09:04:12 GMT
last-modified: Thu, 27 Apr 2023 15:17:04 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 60661
x-amz-server-side-encryption: AES256
etag: W/"e0f0a22511195b00ae603f57d9e5adcd"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
x-amz-cf-id: OEd0z0Tz5LXF5o-kpsATDq69xkxXN3Cf_LaMnNrj4698bPG1905nSA==

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 1BBA 594 B
688 B 84ms
52ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 5a2ca9ccc2cd81205c84e79c43b6ba0d1a686668c280b4ec812060fcc5e7f838

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 385
content-type: text/html
date: Tue, 11 Jul 2023 01:55:12 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 v2 Show response
api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_Sx8YukwE/ 20 KB
4 KB 77ms
77ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_Sx8YukwE/v2

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/ads/tags/v22.2.1/ads/ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

0e83a40653866af82af2ba25d48d79f73ee860155128859c4ac86036ec264bd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

x-guid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-post-id: 26897126
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
x-spot-id: sp_Sx8YukwE
x-spotim-page-view-id: 7c0165b7-2b99-4969-ad26-befdcc2f3ff1
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
x-access-token: null

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: gzip
via: 1.1 f8b0654d6e6bbf12f54a635de5db7ee4.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
x-request-id: f8e0fef3-1f8d-11ee-b85d-968ea625752c
server: fasthttp
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-expose-headers
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: x-spot-id,x-post-id,x-guid,x-spotim-page-view-id,x-access-token
x-amz-cf-id: yVU7E-vkt6SyJ3UZpVsmh-5yaFqsyKcYnmouVDnokK-BIDc0C_gjWQ==

OPTIONS
H2 200 v2
api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_Sx8YukwE/ Frame 0
0 71ms
70ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/owa-gw/spot/sp_Sx8YukwE/v2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: x-access-token,x-guid,x-post-id,x-spot-id,x-spotim-page-view-id
Access-Control-Request-Method: GET
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: x-spot-id,x-post-id,x-guid,x-spotim-page-view-id,x-access-token
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
server: fasthttp
strict-transport-security: max-age=31536000
via: 1.1 5a7c529ef93438ca768c3432355a6e72.cloudfront.net (CloudFront)
x-amz-cf-id: 79mKgXHbVBRpI0wfy4OQv48N5cu9WEnSHIqGx9AoeqjEIGJzH7MwKw==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 80E2 47 KB
6 KB 379ms
378ms XHR
text/xml 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?env=vp&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&correlator=3872455166955779&sz=400x300&url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&iu=%2F5850%2Fpost.videoplayer%2Fjw&cust_params=hb_uuid%3Dundefined%26hb_cache_id%3Dundefined%26mnadc%3D%2F5850%2Fpost.videoplayer%2Fjw%26testgroup%3D76%26permutive%3D%26puid%3D0aa6d7f5-16df-4335-8e6e-dcd466939f50%26ptime%3D1689040510190%26authors%3DAriel%20Zilber%26page_type%3Darticle%26content%3Dlawsuit%2Clawsuits%2Csexual-harassment%2Cwells-fargo%26site%3Dnypost%26dimension54%3Dtrue%26psg%3D300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2%26video%3Dnone%26nckey_userGroup%3D5%26hb_test%3Dv2&description_url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&us_privacy=1---&vid_t=Today%27s%20Business%20Headlines%3A%207%2F10%2F23&vpa=auto&vpmute=1&sdkv=h.3.580.0&osd=2&frm=0&vis=1&sdr=1&hl=en&afvsz=200x200%2C250x250%2C300x250%2C336x280%2C450x50%2C468x60%2C480x70%2C728x90&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&mpt=jwplayer&mpv=8.27.1&sdki=445&ptt=20&adk=34281673&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.580.0&sid=E1AADD82-384B-48A0-9F5B-2CFE79DAC497&a3p=EhsKDDMzYWNyb3NzLmNvbRiCuqOVlDFIAFICCGQSGQoKdWlkYXBpLmNvbRiEuqOVlDFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGIS6o5WUMUgAUgIIZBIcCg1jcndkY250cmwubmV0GIS6o5WUMUgAUgIIZBI7CgpwdWJjaWQub3JnEiRhODc4ZDhlMC04YTgwLTQzNjYtOTIwZS05NWE1ZGVlMzI0MzgYs8KjlZQxSAASFAoFb3BlbngYhLqjlZQxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGIS6o5WUMUgAUgIIZBIXCghydGJob3VzZRiEuqOVlDFIAFICCGQ.&nel=0&eid=44740339%2C44765701%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991%2C44788275&top=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&loc=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&dlt=1689040506632&idt=4788&dt=1689040512047&cookie_enabled=1&scor=486348884432481&ged=ve4_td5_tt0_pd5_la5000_er863.268.1276.1002_vi0.0.1200.1600_vp82_eb23147

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.580.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d4d7fe2321355a9d0880deb2b6c242e3b335ce4829f5dc6fd586541452675677

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5656
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 7B9B 43 B
479 B 181ms
64ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=96dedcc8-503a-495a-a5e5-506ef122ffa1

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 4ZEEZ7AFHV914HS6AB5J
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 7B9B
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=

68 B
604 B

73ms
57ms

Image
image/png

54.161.177.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.161.177.158 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-177-158.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 7B9B
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=6113698130532189562

68 B
606 B

58ms
57ms

Image
image/png

54.161.177.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=6113698130532189562
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.161.177.158 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-177-158.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 21e99a69-6f8d-492d-ac62-2a8e5fb08c34
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=6113698130532189562
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 7B9B
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://bttrack.com/pixel/cookiesync?source=d0afdff5-c51e-4a8d-b07b-b52a29015170&secure=1
https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=390866da-c0b0-4c73-82e3-a634831edc48&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}

68 B
602 B

58ms
57ms

Image
image/png

54.161.177.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=390866da-c0b0-4c73-82e3-a634831edc48&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.161.177.158 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-177-158.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

x-servername: Track001-iad
pragma: no-cache
date: Tue, 11 Jul 2023 01:54:10 GMT
strict-transport-security: max-age=31536000;
content-type: text/html; charset=utf-8
location: https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=390866da-c0b0-4c73-82e3-a634831edc48&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}
cache-control: private,no-cache
content-length: 296
expires: -1

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 7B9B
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=

68 B
607 B

59ms
54ms

Image
image/png

54.161.177.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 54.161.177.158 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-177-158.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H2 200 p.css
p.typekit.net/ Frame BF25 5 B
172 B 69ms
63ms Stylesheet
text/css 2600:1400:b000::6872:4b20
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=uel0ekt&ht=tk&f=139.140.175.176.10879.10881.10887.10888.39498.39500&a=738589&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/uel0ekt.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:b000::6872:4b20 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://use.typekit.net/uel0ekt.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
last-modified: Thu, 09 Mar 2023 17:19:04 GMT
server: nginx
etag: "640a1508-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame FFEB 43 B
479 B 145ms
68ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=c274a55a-ddd0-cc29-2e4c-229e9acad7c3

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: W4WQGFJN6QQDDY4DKRN1
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 0e65bf63-51d6-e59a-df95-b6fc0daed16a
pr-bh.ybp.yahoo.com/sync/openx/ Frame FFEB 43 B
601 B 205ms
62ms Image
image/gif 2600:1f18:4e9:5a07:e525:84df:6700:168e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/0e65bf63-51d6-e59a-df95-b6fc0daed16a?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:e525:84df:6700:168e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame FFEB 43 B
855 B 129ms
72ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=c274a55a-ddd0-cc29-2e4c-229e9acad7c3

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YJAN9HEHWE0W2KQK3YZG
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame FFEB
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0&gdpr_consent=

43 B
314 B

53ms
52ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame FFEB 170 B
243 B 79ms
78ms Image
image/png 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjZjZDBhZWQtMDgwZC0yOTc3LWZiYTItZmFiMDM4MWJkMjQz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame FFEB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFEAvQqPBpqPRijD0MByPbM&google_cver=1

43 B
106 B

50ms
50ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFEAvQqPBpqPRijD0MByPbM&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFEAvQqPBpqPRijD0MByPbM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=6113698130532189562

35 B
250 B

87ms
61ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=6113698130532189562
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8db5fcb5-b0e7-4db4-bedd-c205d998feac
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://usersync.gumgum.com/usersync?b=apn&i=6113698130532189562
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_efe9fb35-b351-445a-a7bf-cf233302f5d3&gdpr=&gdpr_consent=&us_privacy=
https://r.bidswitch.net/sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://pixel.tapad.com/idsync/ex/receive?partner_id=3205&partner_device_id=77d2511f-217d-4cd5-ab00-40ca3f33ff85&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%26ssp%...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3205&partner_device_id=77d2511f-217d-4cd5-ab00-40ca3f33ff85&partner_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D393%26user_id%3D0%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=769cc907-bb8a-48b3-94b2-45800c692986%252Chttps%25253A%25252F%25252Fx.bidswitch.net%25252Fsync%25253Fdsp_id%25253D393%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=769cc907-bb8a-48b3-94b2-45800c692986%2Chttps%253A%252F%252Fx.bidswitch.net%...
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=gumgum2&bsw_param=77d2511f-217d-4cd5-ab00-40ca3f33ff85
https://usersync.gumgum.com/usersync?b=bsw&i=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=&gdpr_consent=&us_privacy=

35 B
250 B

60ms
59ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:15 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=&gdpr_consent=&us_privacy=
Date: Tue, 11 Jul 2023 01:55:14 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 772D
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRd...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_efe9fb35-b351-445a-a7bf-cf233302f5d3&obuid=ENC(Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN)
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51
https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN2...

43 B
632 B

196ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%0A%26initiator%3Dplatform
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Location: https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%0A%26initiator%3Dplatform
Date: Tue, 11 Jul 2023 01:55:13 GMT
X-TraceId: aced6b49240c3a82648ba85b970ca6fa
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=6d9f7d57-e96f-4f85-8939-b0e43aa91d65

35 B
250 B

62ms
61ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=6d9f7d57-e96f-4f85-8939-b0e43aa91d65
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://usersync.gumgum.com/usersync?b=opx&i=6d9f7d57-e96f-4f85-8939-b0e43aa91d65
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74

35 B
250 B

147ms
58ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74
Date: Tue, 11 Jul 2023 01:55:12 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-Ktk8niJE2pehHoS4Uvh1vIJ46CQxmK5RGxiC~A

35 B
250 B

70ms
59ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-Ktk8niJE2pehHoS4Uvh1vIJ46CQxmK5RGxiC~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:12 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-Ktk8niJE2pehHoS4Uvh1vIJ46CQxmK5RGxiC~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%...
https://usersync.gumgum.com/usersync?b=vnt&i=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a

35 B
250 B

136ms
60ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a
Date: Tue, 11 Jul 2023 01:55:12 GMT
Connection: keep-alive
X-CI-RTID: f76e9abc-4192-457f-97ce-395d38a0d988
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=964902DB58AB4FCDA0596BF7610A8B60

35 B
250 B

99ms
58ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=964902DB58AB4FCDA0596BF7610A8B60
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:12 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 834043054
location: https://usersync.gumgum.com/usersync?b=snc&i=964902DB58AB4FCDA0596BF7610A8B60
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame 772D 0
222 B 203ms
56ms Image
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:11 GMT
server: c
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET /
b1sync.zemanta.com/usersync/gumgum/ Frame 772D 0
0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9

35 B
250 B

61ms
59ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9
access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:12 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=8xRLQOLR1WBf&ev=1&pid=558355

35 B
250 B

98ms
59ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=8xRLQOLR1WBf&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://usersync.gumgum.com/usersync?b=pln&i=8xRLQOLR1WBf&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 772D
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=8004212043844932477

35 B
250 B

71ms
70ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=8004212043844932477
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=8004212043844932477
date: Tue, 11 Jul 2023 01:55:12 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 772D 43 B
479 B 66ms
65ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_efe9fb35-b351-445a-a7bf-cf233302f5d3

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 21MNA2JCR5FGYHY8H9H7
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 60DB 34 KB
10 KB 65ms
61ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: feeb98f30c6b03b47d474792b88ea05241e469d24f193cafa3927310602ce670

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9482
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

POST
H2 200 in
us.q2s15.com/v5/ 2 B
170 B 64ms
59ms Ping
text/plain 52.45.209.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://us.q2s15.com/v5/in
Requested by: Host: cdn.watchingthat.net
URL: https://cdn.watchingthat.net/us.wtat.plugin-jw_ima.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.209.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-209-233.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryE3dt9HUjEYmKzVf8

Response headers

access-control-allow-origin: https://nypost.com
date: Tue, 11 Jul 2023 01:55:12 GMT
access-control-allow-credentials: true
x-powered-by: Express
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

GET
H2 200 0e65bf63-51d6-e59a-df95-b6fc0daed16a
pr-bh.ybp.yahoo.com/sync/openx/ Frame 1BBA 43 B
601 B 141ms
64ms Image
image/gif 2600:1f18:4e9:5a07:e525:84df:6700:168e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/0e65bf63-51d6-e59a-df95-b6fc0daed16a?gdpr=0

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:e525:84df:6700:168e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 1BBA 43 B
855 B 81ms
64ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=c274a55a-ddd0-cc29-2e4c-229e9acad7c3

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: K87S5QX2NH0R30AV6HFQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 1BBA
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0&gdpr_consent=

43 B
62 B

57ms
56ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=9aa2d927-c17a-77d3-ee42-a009f2f91c23&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 1BBA 170 B
232 B 104ms
77ms Image
image/png 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjZjZDBhZWQtMDgwZC0yOTc3LWZiYTItZmFiMDM4MWJkMjQz

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 1BBA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEInpWKHdcmG5FIEP0WXfIho&google_cver=1

43 B
61 B

61ms
60ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEInpWKHdcmG5FIEP0WXfIho&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEInpWKHdcmG5FIEP0WXfIho&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 68B5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZKy2gPeKFcFmKMEQLWWTawAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1

43 B
632 B

66ms
66ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 68B5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEJCss4cTTVCwypEi5kur7vw&google_cver=1

43 B
766 B

65ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEJCss4cTTVCwypEi5kur7vw&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEJCss4cTTVCwypEi5kur7vw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 68B5
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&expiration=1691632512&gdpr=0&gdpr_consent=

43 B
632 B

65ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&expiration=1691632512&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&expiration=1691632512&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 68B5 43 B
855 B 90ms
70ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Z86S1JM7D2YF1AHCSN96
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 68B5
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://pr-bh.ybp.yahoo.com/sync/casale/ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB

43 B
601 B

65ms
64ms

Image
image/gif

2600:1f18:4e9:5a07:e525:84df:6700:168e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

Server

2600:1f18:4e9:5a07:e525:84df:6700:168e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
date: Tue, 11 Jul 2023 01:55:12 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 68B5
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8004212043844932477&gdpr=0&gdpr_consent=

43 B
632 B

87ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8004212043844932477&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=8004212043844932477&gdpr=0&gdpr_consent=
date: Tue, 11 Jul 2023 01:55:12 GMT
content-length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 68B5
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AADg507JWW0AACFXxNbRlQ&expiration=1690250112

43 B
632 B

65ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AADg507JWW0AACFXxNbRlQ&expiration=1690250112
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AADg507JWW0AACFXxNbRlQ&expiration=1690250112
Date: Tue, 11 Jul 2023 01:55:12 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame 68B5
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=4531a6b1d4a2235f&is_secure=true&networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAL9-K2XyoeVAMg4cPuAAAAAAA&expiration=1689126912&is_secure=true

43 B
632 B

199ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAL9-K2XyoeVAMg4cPuAAAAAAA&expiration=1689126912&is_secure=true
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAL9-K2XyoeVAMg4cPuAAAAAAA&expiration=1689126912&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 68B5 43 B
479 B 100ms
83ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: MA82A51J5TZZFZS9X290
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content e9d4ff858b5e32317e843f5ed11b2659.gif
cs.iqzone.com/ Frame 4AEC 0
0 5864ms
1021ms Document
text/plain 8.2.111.13
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_efe9fb35-b351-445a-a7bf-cf233302f5d3&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.2.111.13 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: nginx

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F7BD
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=&gdpr_consent=&_test=ZKy2gAAAAHvPCgAt
https://usersync.gumgum.com/usersync?b=atm&i=ZKy2gAAAAHvPCgAt&gdpr=&gdpr_consent=&_test=ZKy2gAAAAHvPCgAt

35 B
250 B

152ms
61ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=ZKy2gAAAAHvPCgAt&gdpr=&gdpr_consent=&_test=ZKy2gAAAAHvPCgAt
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=ZKy2gAAAAHvPCgAt&gdpr=&gdpr_consent=&_test=ZKy2gAAAAHvPCgAt
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mia-kmia1760066-MIA
x-timer: S1689040512.448530,VS0,VE0

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame 5146 170 B
232 B 108ms
76ms Document
image/png 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9lZmU5ZmIzNS1iMzUxLTQ0NWEtYTdiZi1jZjIzMzMwMmY1ZDM=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:12 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2E74 16 KB
6 KB 91ms
61ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=126798
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Tue, 11 Jul 2023 01:55:12 GMT
expires: Wed, 12 Jul 2023 13:08:30 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame CACB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

35 B
250 B

210ms
61ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Tue, 11 Jul 2023 01:55:12 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 935C
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZKy2gMCo8YIAAA4Zog4AAAAA

35 B
250 B

60ms
59ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZKy2gMCo8YIAAA4Zog4AAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Tue, 11 Jul 2023 01:55:12 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZKy2gMCo8YIAAA4Zog4AAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad48.dc4p.scaleout.jp
X-SO-IP: 38.132.118.74
X-SO-Key: ZKy2gMCo8YIAAA4Zog4AAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"38.132.118.74","key":"ZKy2gMCo8YIAAA4Zog4AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad48"}
X-SO-LB-Hostname: m-tgng30.dc4p.scaleout.jp
X-SO-Upstream-ID: m-ad48

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 94EA
Redirect Chain

https://cs.admanmedia.com/sync/gumgum?puid=u_efe9fb35-b351-445a-a7bf-cf233302f5d3&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=&gdpr_consent=&ccpa=
https://usersync.gumgum.com/usersync?b=aad&i=7d367312-dbdf-470d-a118-4944e664fed6

35 B
250 B

162ms
61ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=aad&i=7d367312-dbdf-470d-a118-4944e664fed6
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Location: https://usersync.gumgum.com/usersync?b=aad&i=7d367312-dbdf-470d-a118-4944e664fed6
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Transfer-Encoding: chunked
X-Frame-Options: DENY

GET
H/1.1 200
OK usermatchredir Show response
ssum-sec.casalemedia.com/ Frame 5821 43 B
766 B 85ms
65ms Document
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Keep-Alive: timeout=1, max=498
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 39F7
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=KQzI03wLm8jPizONN02F&pi=gumgum&tc=1

35 B
250 B

61ms
60ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=KQzI03wLm8jPizONN02F&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:12 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT Tue, 11 Jul 2023 01:55:12 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=KQzI03wLm8jPizONN02F&pi=gumgum&tc=1
pragma: no-cache

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame 6FB2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=V3pqeG1Rd3ZEUzR2UWxxMjZ6el8zUQ&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEEG_zmZUtqDx2E2UlFfTc1Q&google_cver=1

49 B
813 B

69ms
66ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEEG_zmZUtqDx2E2UlFfTc1Q&google_cver=1

Requested by

Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1

Protocol

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEEG_zmZUtqDx2E2UlFfTc1Q&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 335
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/ Frame 6FB2
Redirect Chain

https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=
https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=3335452500a91054&is_secure=true&networkId=14200&version=1&nuid=
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAFv48v4zH37QNYY1F8AAAAAAA&expiration=1689126912&nuid=&is_secure=true

49 B
841 B

77ms
76ms

Image
image/gif

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAFv48v4zH37QNYY1F8AAAAAAA&expiration=1689126912&nuid=&is_secure=true

Requested by

Protocol

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:12 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAFv48v4zH37QNYY1F8AAAAAAA&expiration=1689126912&nuid=&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 6FB2 43 B
479 B 66ms
65ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=8xRLQOLR1WBf&ex=Pulsepoint

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bh.contextweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:12 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 85RJHN830BWN0ZC0S0E7
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame BB87
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

73ms
73ms

Document
text/html

23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:12 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 container.html Show response
0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B752 6 KB
3 KB 66ms
64ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:11 GMT
expires: Wed, 10 Jul 2024 01:55:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 94DA 6 KB
3 KB 64ms
63ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:11 GMT
expires: Wed, 10 Jul 2024 01:55:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 991F 6 KB
3 KB 66ms
63ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:11 GMT
expires: Wed, 10 Jul 2024 01:55:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2178 6 KB
3 KB 65ms
64ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:11 GMT
expires: Wed, 10 Jul 2024 01:55:11 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 b-e09f10f-a7b8af42.js Show response
tagan.adlightning.com/nc-nypost/ Frame 5359 79 KB
30 KB 68ms
66ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e68d4edfd3b5b56d6eed01e4eb7dbf84b09cbedf45b75e469efd0037d1f18e8e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 16:32:28 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: 6k5eMeThttbKLkbqFc7t6mVojRaDpPI7
x-amz-cf-pop: EWR53-C3
age: 3057765
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 30187
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:32:15 GMT
server: AmazonS3
etag: "e38307f2b2c7da81aa3de8af486f6e21"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: XwrunB1zI8_I_1AMBWeyNIzq2MYpitNoovUwkt8SUSPFnCoXcZRc0A==

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5359 179 KB
57 KB 228ms
94ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79cbf9d3dc9d8df1616dd585c95022e1104e8b2700974ba07a9c1a26187bf3e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57331
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688990556196721"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:12 GMT

GET
H2 200 b-e09f10f-a7b8af42.js Show response
tagan.adlightning.com/nc-nypost/ Frame C604 79 KB
30 KB 66ms
65ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e68d4edfd3b5b56d6eed01e4eb7dbf84b09cbedf45b75e469efd0037d1f18e8e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 16:32:28 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: 6k5eMeThttbKLkbqFc7t6mVojRaDpPI7
x-amz-cf-pop: EWR53-C3
age: 3057765
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 30187
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:32:15 GMT
server: AmazonS3
etag: "e38307f2b2c7da81aa3de8af486f6e21"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: B7QxV_eSJAKHOAnFpqJgQRN9jT5HBb3qX5Nk0EWZsqdHnLi4kT7jpg==

GET
H2 200 ttj Show response
ib.3lift.com/ Frame C604 12 KB
4 KB 229ms
61ms Script
application/javascript 13.225.63.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ib.3lift.com/ttj?inv_code=NYPost_Sidebar_native_header
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-107.ewr53.r.cloudfront.net
Software: /
Resource Hash: 1db9fbb010bb3cc963aedaa49dae640dadc638d997c7260a1cc284cadf7ab393

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:51:29 GMT
content-encoding: gzip
via: 1.1 64269b4eda1211bca4d40d7ab2177910.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
age: 223
etag: "9793e83c8244f51c4580add27b8510436c3ff912"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900
alt-svc: h3=":443"; ma=86400
content-length: 4238
x-amz-cf-id: ntbYes_3kE5fXynaiUNMWIxH-Pp9adDyQGmuZ3wOMOJR1E8_6bJzMw==

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C604 179 KB
56 KB 284ms
195ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79cbf9d3dc9d8df1616dd585c95022e1104e8b2700974ba07a9c1a26187bf3e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57331
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688990556196721"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:12 GMT

GET
H2

200

XsRjBCdE-120.jpg
assets-jpcust.jwpsrv.com/thumbnails/
Redirect Chain

https://cdn.jwplayer.com/v2/media/7agoeR3g/poster.jpg?width=120
https://assets-jpcust.jwpsrv.com/thumbnails/XsRjBCdE-120.jpg

6 KB
6 KB

61ms
61ms

Image
image/jpeg

2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-jpcust.jwpsrv.com/thumbnails/XsRjBCdE-120.jpg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 18ada9a81817cff19db4d9b721cd6e896f79661439e34105632991fd746dc102

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 300
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 5915
x-served-by: cache-iad-kiad7000043-IAD, cache-mia-kmia1760077-MIA
last-modified: Mon, 01 May 2023 15:08:04 GMT
server: nginx
x-timer: S1689040513.089442,VS0,VE28
etag: "4455e0f3a29af60031627f8535d8e772"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=900
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 475, 1

Redirect headers

date: Tue, 11 Jul 2023 01:55:11 GMT
via: 1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: EWR53-P1
age: 1
access-control-allow-methods: GET
content-type: image/jpeg
location: https://assets-jpcust.jwpsrv.com/thumbnails/XsRjBCdE-120.jpg
access-control-allow-origin: *
cache-control: max-age=180, max-stale=180
x-cache: Hit from cloudfront
x-robots-tag: noindex, indexifembedded
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
content-length: 0
x-amz-cf-id: aDevKHSz78FVhjY1Ani2R8e-gXWEuzV2bLEy1dS8oitW-F72gvHCzQ==

POST
H2 204 csi
csi.gstatic.com/ Frame 80E2 0
234 B 579ms
202ms Ping
image/gif 2a00:1450:4017:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~ljxn3zfv&c=2636235545112&slotId=1318117772556&eee=missing-element&bi=missing-id&vast_v=4.0&wta=1&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.580.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4017:815::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame BB87 34 KB
10 KB 71ms
71ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: feeb98f30c6b03b47d474792b88ea05241e469d24f193cafa3927310602ce670

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:12 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9482
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

POST
H3 200 events Show response
api.permutive.com/v2.0/batch/ 101 B
127 B 144ms
143ms XHR
application/json 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/batch/events?enrich=false&sdkp=true&k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: 245e56cd2d2848d7c83b9eb3cf2d05a8b715304906806e2a2da0a6ef39fb1ae1

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
via: 1.1 google
server: Permutive
vary: Origin
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109

GET
H2 200 publishertag.prebid.135.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 74ms
73ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.135.js

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 12 Jul 2023 01:55:12 GMT

OPTIONS
H2 200 read
api-2-0.spot.im/v1.0.0/conversation/realtime/ Frame 0
0 70ms
70ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/realtime/read

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-access-token,x-post-id,x-spot-id,x-spotim-device-uuid,x-spotim-device-v2,x-spotim-page-view-id
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:12 GMT
server: fasthttp
strict-transport-security: max-age=31536000
via: 1.1 5a7c529ef93438ca768c3432355a6e72.cloudfront.net (CloudFront)
x-amz-cf-id: 6D_Ognr9tW5yAltMWXD_k7OMRdlG0lYLX24yy_i9ZnazzvDmAnsZvQ==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

POST
H2 200 read Show response
api-2-0.spot.im/v1.0.0/conversation/realtime/ 59 B
658 B 75ms
73ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/realtime/read

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/480-bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

e0da6973e97717818645837ff4f7a0d31d9ffafdbc4ff64930379bdc5864b2e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-post-id: 26897126
accept-language: en-US,en;q=0.9
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json
Accept: application/json
x-spot-id: sp_Sx8YukwE
x-spotim-page-view-id: 7c0165b7-2b99-4969-ad26-befdcc2f3ff1
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInZlcmlmaWVkIjpmYWxzZSwidXNlcl9pZCI6InVfRkVxaEw5ck9RQWk0IiwiZGlzcGxheV9uYW1lIjoiR29sZENvY2t0YWlsIiwidXNlcl9uYW1lIjoiR29sZENvY2t0YWlsIiwicmVnaXN0ZXJlZCI6ZmFsc2UsImltYWdlX2lkIjoiI0dvbGQtQ29ja3RhaWwiLCJyb2xlcyI6W10sInNzb19kYXRhIjpudWxsLCJwcm92aWRlcnMiOm51bGwsInJlcHV0YXRpb24iOnt9LCJzcG90X2lkIjoic3BfU3g4WXVrd0UiLCJsYXN0X2NoZWNrIjoxNjg5MDQwNTEyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMjMwNzExcmRDWkxoLjAzNzU4ZjRlMWRmNTJkNDZkZWJkMDI4M2JjYzNmNmMyNTEyZTc4NmQ1NTY3YzM1MjNhZDk5ZTdhODUxYWZlYTkiLCJwZXJtaXNzaW9ucyI6bnVsbCwic3BvdGltLWRldmljZS12MiI6ImRfSnJTNlFxeE42MTJnTFplMkp1RXgiLCJuZXR3b3JrIjp7Im5ldHdvcmtfaWQiOiJuZXRfbnlwb3N0IiwibmV0d29ya19uYW1lIjoiTllQb3N0IiwibmV0d29ya19pbWFnZV9pZCI6Ik5ZUG9zdCIsIm5ldHdvcmtfY29sb3IiOiIjQ0MzMzMzIn0sInNwb3RfbmFtZSI6IiIsImRvbWFpbiI6IiIsInJvbGVzX251bWJlciI6MCwidGVtcF91c2VyIjpmYWxzZSwiZXhwIjoxNzE3NDYyNTEyLCJzdWIiOiJ1X0ZFcWhMOXJPUUFpNCJ9.bJD27s1123S3CPCYGFsfSDBjC3EISpulrrTgoZoDPxo

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
via: 1.1 f8b0654d6e6bbf12f54a635de5db7ee4.cloudfront.net (CloudFront)
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
x-spotim-networkid: net_nypost
content-length: 59
x-spotim-token: 01230711rdCZLh.03758f4e1df52d46debd0283bcc3f6c2512e786d5567c3523ad99e7a851afea9
x-request-id: f96f18d7-1f8d-11ee-affd-8aead9d0c9ad
x-guid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
server: fasthttp
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
access-control-max-age: 86400
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
x-amz-cf-id: KJ1EkwAocufca8uOua08K7OIWIu6VBIyZADxUorJ407KH32WI5J5xA==

POST
H2 204 csi
csi.gstatic.com/ Frame 80E2 0
54 B 531ms
202ms Ping
image/gif 2a00:1450:4017:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~ljxn40pg&c=2636235545112&slotId=1318117772556&ghmsh_eids=44740339%2C44765701%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991%2C44788275
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.580.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4017:815::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 c Show response
ids.cdnwidget.com/ 470 B
810 B 158ms
78ms XHR
application/json 34.107.191.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=&SCH1=&GCS1=114093195&GCS2=NzFiMmMxZjEtZTg2Ni00NWFmLWEwMWMtM2UzNDE5NjNmZjA0LmxvY2Fs&pe=false&wsid=2045&varID=&varData=undefined&log=%7B%22config%22%3A%7B%22gmEN%22%3Afalse%2C%22pixEN%22%3Atrue%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A2045%2C%22loadID%22%3A%22Ga4BFh123Rf4kNT%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A67%2C%22IDStageStart%22%3A67%2C%22obsReqdata%22%3A785%2C%22obsReqpage%22%3A785%2C%22obsReqview%22%3A787%2C%22netComplete%22%3A1068%2C%22IDStagePrefire%22%3A1068%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Afalse%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A0%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%2C%22deviceid%22%3A9063269601338811776%2C%22visitid%22%3A1689040511933162%7D
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_74cb4632fbcf5cdfa301cb523939aa09.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.191.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.191.107.34.bc.googleusercontent.com
Software: /
Resource Hash: 91fb2c8d9d6864c3cd8abe5e0e452cb318d828e9b13c5f360da72000480a4d13

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: https://nypost.com
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: application/json

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame ECF7 2 KB
2 KB 194ms
63ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=86904650&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c2b65dca20dc39cf629a6367098c38e39e30157ddedb78c4732373bc6419ea96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 11 Jul 2023 01:55:12 GMT
content-length: 1677
content-type: text/html; charset=UTF-8

GET
H2 200 src_next_index_tsx-bundle.js Show response
static-cdn.spot.im/production/notifications/tags/v1.20.1/ 4 KB
2 KB 62ms
60ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/notifications/tags/v1.20.1/src_next_index_tsx-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 28842eace70517d00dcdefc6a40c91a6f799d798e6a95594e5d155ee7d8a6226

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: ziwewgHMPxjBLGLGn0hm2zl_FphO3Q2R
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 11:04:31 GMT
last-modified: Thu, 27 Apr 2023 15:17:04 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 53443
x-amz-server-side-encryption: AES256
etag: W/"2a9b939e107c114cf086c0370235072c"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
x-amz-cf-id: uOWUYf9iV5c_78qEdumygEdoJBava0qTYBfKhk8CdVSnRIbYrvFqow==

GET
H2 200 conversation-bundle.js Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 47 KB
15 KB 66ms
64ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/conversation-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc81b9f547409d227a18b03ab02d4b02182500fd9990ab40d64407a3d6942148

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:33 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: S6nm7p3Q0uRPH134VvxyUKOLupISsDEC
x-amz-cf-pop: EWR53-C3
age: 1158641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 14676
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "4a2c89077dfab4baad349882e3f1f815"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: CCoJ_I_H4l-a-7PbMDaF2U3ExLZErtKUeTl6OEXrpTpYP61qap7r8Q==

GET
H2 200 ec24cb303220fcfc94f8.svg
static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/ 3 KB
1019 B 62ms
61ms Image
image/svg+xml 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/ec24cb303220fcfc94f8.svg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2df75dd5414f39139ce6f757636066e98d685654dbb93bf2c0f93f37092f1abd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:14:31 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: RKLYUnHY2xv453B9p21X8R6OpRCorahw
x-amz-cf-pop: EWR53-C3
age: 1687243
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 549
last-modified: Wed, 21 Jun 2023 08:25:59 GMT
server: AmazonS3
etag: "2fb4c511e325b1064ff9babf599fbcee"
vary: Origin
content-type: image/svg+xml
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: N7_RpI6JI2Ct6CIc3AMJl3VcvwkNty-XZVJJ6HXd1l9_OsV034L0zA==

GET
H/1.1

200
OK

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://ads.yieldmo.com/pbsync?gdpr=&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dyieldmo%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D...
https://prebid-server.rubiconproject.com/setuid?bidder=yieldmo&gpp=&gpp_sid=&account=&f=i&uid=gf00fd914dad9f2d3e8f&gdpr=&gdpr_consent=&us_privacy=1---

86 B
783 B

59ms
58ms

Image
image/png

69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=yieldmo&gpp=&gpp_sid=&account=&f=i&uid=gf00fd914dad9f2d3e8f&gdpr=&gdpr_consent=&us_privacy=1---
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/png
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-encoding: gzip
transfer-encoding: chunked
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://prebid-server.rubiconproject.com/setuid?bidder=yieldmo&gpp=&gpp_sid=&account=&f=i&uid=gf00fd914dad9f2d3e8f&gdpr=&gdpr_consent=&us_privacy=1---
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5359 0
0 82ms
81ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssksdAdmP2m2xCIK48GHhcIJo237LKg-oungz8vkGV9qtWQgD2Sz00jmSkvVAe1xiNXNE0WqkGP9SMU4n6R0yV_TRp5Meul8VZjpMUmVr0ysYc4MfTuWUaYjOrIJk9zd-pIZ1RNeYCQQR0pDxkQA5cThntNW8HmDMQZKEhZzW7YjJ7Qyl0DUZuEw9eiKhviF5jHRf85DvV24xhqL8TPVeEaDdAKgGtppl-iPfoozUecx_zeBojw9dK2XildMw5cwWi6ZKqx2lCQBgV8LTB3EIRaezGcZA9To3CZHnncmAVtYsJ7iKp8D72-FMS73XafGlNno2yNKiRWpVL7W2AH0eAlMXA&sai=AMfl-YSJJzo-LyIL71EitVaRkpEIQlkK3g20MefnsOnNyMgzEBpluofI31W_A2nF5qn-2mMhkg3LmkZUglpn949aOWKHtCUwZ5iu8sAfDOKr8fFOtwDFY5yFzd5dh9gQf8njZm4vbPJ7MtF1fNf0EwhuBS4&sig=Cg0ArKJSzBcNFytkNEm8EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

connatix.player.js Show response
cds.connatix.com/p/293038/ Frame 5EC0
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/293038/connatix.player.js?tier=1

1 MB
285 KB

81ms
71ms

Script
application/javascript

172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/293038/connatix.player.js?tier=1
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bf7d0d39204818b86c2e36a1fc211d6df01cf7e1842d003ece4c01744df824f

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
x-amz-version-id: M.g2A6TR4ZQoEvsAW9yVRIFZsPiWCZzG
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 10 Jul 2023 13:34:02 GMT
server: cloudflare
etag: W/"40b57b5f6331e611daefd2a95522b30b"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 7e4d6c4a28ecd9b5-MIA
access-control-allow-headers: range
expires: Wed, 10 Jul 2024 01:55:13 GMT

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
location: https://cds.connatix.com/p/293038/connatix.player.js?tier=1
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 7e4d6c482cbdd9b5-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 si
capi.connatix.com/tr/ Frame 5359 0
311 B 235ms
114ms Image
application/json 104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/tr/si?token=8ae371c3-0e93-499d-a72c-f743029599b4
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c485fe9da23-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 bl-1e0054c-b5b414e0.js Show response
tagan.adlightning.com/nc-nypost/ Frame B752 58 KB
24 KB 66ms
66ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/bl-1e0054c-b5b414e0.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa5ba9dae4119fe6753123ebf298e675eaa9f4df4af5e8a2e459b717a927bc4f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 06 Jul 2023 20:33:10 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: g8SZz3rUCwVcvOR4SzVd3wY8jx_0gZD2
x-amz-cf-pop: EWR53-C3
age: 364924
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24583
x-amz-meta-git_commit: 1e0054c
last-modified: Thu, 06 Jul 2023 20:31:07 GMT
server: AmazonS3
etag: "f104ff5b043d55c3744a9b37ecca877e"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 4jDSU82IayJTW5DB_I6Wajk2ACMWBIqg7-nLvfkMVCU8sXyu0jlulg==

GET
H2 200 b-e09f10f-a7b8af42.js Show response
tagan.adlightning.com/nc-nypost/ Frame B752 79 KB
30 KB 74ms
74ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e68d4edfd3b5b56d6eed01e4eb7dbf84b09cbedf45b75e469efd0037d1f18e8e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 16:32:28 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: 6k5eMeThttbKLkbqFc7t6mVojRaDpPI7
x-amz-cf-pop: EWR53-C3
age: 3057766
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 30187
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:32:15 GMT
server: AmazonS3
etag: "e38307f2b2c7da81aa3de8af486f6e21"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: zVFyVe_ij7JZI6MhgcRCYPF8FCVZ_Jyf9-xemp4FCKNHIBdv2bhVAw==

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B752 42 B
63 B 89ms
88ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BjR-FABkSRaN20pfer5b5EY3-kcSdIZ9DYUMutRgi9R0jqWNs-K7tGjry3ASqjTsCvUznnGHp8sUMNT61-aqChzEMaaiYga2elDcZGJSCtNzdTAXg

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B752 0
20 B 90ms
89ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11816118676252173675&x=1&ct=76

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame B752 78 KB
27 KB 113ms
113ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame B752 3 KB
1 KB 63ms
63ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/window_focus_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 18:44:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25849
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 18:44:25 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame B752 20 KB
8 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:55:02 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B752 179 KB
56 KB 82ms
81ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79cbf9d3dc9d8df1616dd585c95022e1104e8b2700974ba07a9c1a26187bf3e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57331
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688990556196721"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H2 200 bl-1e0054c-b5b414e0.js Show response
tagan.adlightning.com/nc-nypost/ Frame 94DA 58 KB
24 KB 80ms
80ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/bl-1e0054c-b5b414e0.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa5ba9dae4119fe6753123ebf298e675eaa9f4df4af5e8a2e459b717a927bc4f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 06 Jul 2023 20:33:10 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: g8SZz3rUCwVcvOR4SzVd3wY8jx_0gZD2
x-amz-cf-pop: EWR53-C3
age: 364924
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24583
x-amz-meta-git_commit: 1e0054c
last-modified: Thu, 06 Jul 2023 20:31:07 GMT
server: AmazonS3
etag: "f104ff5b043d55c3744a9b37ecca877e"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: t9zLT-jtEKVdJUZM37GHgf97H_z1LjyqPNzY_PewXucmbscnf118bQ==

GET
H2 200 b-e09f10f-a7b8af42.js Show response
tagan.adlightning.com/nc-nypost/ Frame 94DA 79 KB
30 KB 90ms
90ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e68d4edfd3b5b56d6eed01e4eb7dbf84b09cbedf45b75e469efd0037d1f18e8e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 16:32:28 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: 6k5eMeThttbKLkbqFc7t6mVojRaDpPI7
x-amz-cf-pop: EWR53-C3
age: 3057766
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 30187
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:32:15 GMT
server: AmazonS3
etag: "e38307f2b2c7da81aa3de8af486f6e21"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: j3B9FMACuZQopy7xbmKqj_DGaNYOT1NL8-qAekvVM11j4aTYde7o2A==

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 94DA 42 B
63 B 88ms
88ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CfpPsaAPRYYqlGxUgsXmAL8U5Z-eYx1TbN9eKTcx3_7Lyk-RRFc-NOlKWiy7cB4-8A8JmZgU3M63DvdTTYCSqtV2GsMexIdE7479Y7Y15truFt6Og

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 94DA 0
20 B 89ms
89ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11022811550157522373&x=1&ct=76

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 94DA 78 KB
27 KB 182ms
182ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame 94DA 3 KB
1 KB 63ms
62ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/window_focus_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 18:44:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25849
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 18:44:25 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame 94DA 20 KB
8 KB 70ms
69ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:55:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 94DA 0
0 82ms
81ms Image
text/html 2607:f8b0:4006:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSRuKr8Ek03WJh93QhONArWm3-XPzCKwsn7RM2FkLmOLqgoexRu-2bPTLQjqamAGd6WLKwyQ6sIgZiH9bNIC48flDw7ig
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 94DA 179 KB
56 KB 112ms
111ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79cbf9d3dc9d8df1616dd585c95022e1104e8b2700974ba07a9c1a26187bf3e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57331
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688990556196721"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 60DB
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=LJXN3YYH-1F-G80F
https://s.amazon-adsystem.com/ecm3?id=LJXN3YYH-1F-G80F&ex=d-rubiconproject.com&status=ok

43 B
479 B

67ms
67ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LJXN3YYH-1F-G80F&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:13 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ZC0WFFHS447GHHNDD2EG
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LJXN3YYH-1F-G80F&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
Expires: 0

GET
H2 200 bl-1e0054c-b5b414e0.js Show response
tagan.adlightning.com/nc-nypost/ Frame 991F 58 KB
24 KB 88ms
88ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/bl-1e0054c-b5b414e0.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa5ba9dae4119fe6753123ebf298e675eaa9f4df4af5e8a2e459b717a927bc4f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 06 Jul 2023 20:33:10 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: g8SZz3rUCwVcvOR4SzVd3wY8jx_0gZD2
x-amz-cf-pop: EWR53-C3
age: 364924
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24583
x-amz-meta-git_commit: 1e0054c
last-modified: Thu, 06 Jul 2023 20:31:07 GMT
server: AmazonS3
etag: "f104ff5b043d55c3744a9b37ecca877e"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: u41Eoeo7UkPbAVU9ClNNWt0v_gIdWrqw-fOgwbA14JGQT9K_gEou4A==

GET
H2 200 b-e09f10f-a7b8af42.js Show response
tagan.adlightning.com/nc-nypost/ Frame 991F 79 KB
30 KB 96ms
81ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e68d4edfd3b5b56d6eed01e4eb7dbf84b09cbedf45b75e469efd0037d1f18e8e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 16:32:28 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: 6k5eMeThttbKLkbqFc7t6mVojRaDpPI7
x-amz-cf-pop: EWR53-C3
age: 3057766
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 30187
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:32:15 GMT
server: AmazonS3
etag: "e38307f2b2c7da81aa3de8af486f6e21"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: m45bMsl09UVNUOdqiypf9T3F-kNVNx7scXAVew1g-Pc4c_ooKSEd9A==

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 991F 42 B
63 B 89ms
88ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BEkcGolbnTCjeaJzwUj-JnAKGk6VEFAZ9RR3VuhD3OSeESxZFz5OJ4fJ_nlKv-iOZ7N9rLgYuQUbcWBBL-2VUIrY1RThhmxHlo8LhN_pdciRgFbEo

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 991F 0
20 B 89ms
88ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1514507766777490781&x=1&ct=76

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 991F 78 KB
27 KB 131ms
124ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame 991F 3 KB
1 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/window_focus_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 18:44:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25849
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 18:44:25 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame 991F 20 KB
8 KB 71ms
63ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:55:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 991F 0
0 82ms
81ms Image
text/html 2607:f8b0:4006:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRfkO8UXBj0wPzySQFOtpGZZY8NYMkH0zEJMITrK0C6OH6CGvIumMBmr-VnRmIULoxhPJFCrOiWMlYLd9e-SWswxRshdw
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 991F 179 KB
56 KB 111ms
103ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79cbf9d3dc9d8df1616dd585c95022e1104e8b2700974ba07a9c1a26187bf3e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57331
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688990556196721"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H2 200 bl-1e0054c-b5b414e0.js Show response
tagan.adlightning.com/nc-nypost/ Frame 2178 58 KB
24 KB 99ms
92ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/bl-1e0054c-b5b414e0.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa5ba9dae4119fe6753123ebf298e675eaa9f4df4af5e8a2e459b717a927bc4f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 06 Jul 2023 20:33:10 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: g8SZz3rUCwVcvOR4SzVd3wY8jx_0gZD2
x-amz-cf-pop: EWR53-C3
age: 364924
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24583
x-amz-meta-git_commit: 1e0054c
last-modified: Thu, 06 Jul 2023 20:31:07 GMT
server: AmazonS3
etag: "f104ff5b043d55c3744a9b37ecca877e"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 1031X5U-bmZ1Qc10YKcn6xFlJNqK0HTf19oDCnEYPbdgbU6CAZO2UQ==

GET
H2 200 b-e09f10f-a7b8af42.js Show response
tagan.adlightning.com/nc-nypost/ Frame 2178 79 KB
30 KB 109ms
102ms Script
application/javascript 54.230.163.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-95.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e68d4edfd3b5b56d6eed01e4eb7dbf84b09cbedf45b75e469efd0037d1f18e8e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 16:32:28 GMT
content-encoding: gzip
via: 1.1 2363b636adbc739d5f9806cb41e6d226.cloudfront.net (CloudFront)
x-amz-version-id: 6k5eMeThttbKLkbqFc7t6mVojRaDpPI7
x-amz-cf-pop: EWR53-C3
age: 3057766
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 30187
x-amz-meta-git_commit: e09f10f
last-modified: Mon, 05 Jun 2023 16:32:15 GMT
server: AmazonS3
etag: "e38307f2b2c7da81aa3de8af486f6e21"
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: KGN8llfRLYx_gNg45kVAug0Pu-ivbUl5VlZb5S2gMdN1D0FicEaBDw==

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2178 42 B
63 B 89ms
88ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BcQppEyKX4NLzJBGku0rbnQ7pFVTavCm1sg8KTi4eR4W81ZAw4ieh3YEbJ2sgDJdNZK1SjKbzJ4xRlhJlVJkr6cRX4NmTitRH9TNgmu_q52MSx9Hg

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2178 0
20 B 89ms
88ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=13864210483356740156&x=1&ct=76

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2178 78 KB
27 KB 177ms
171ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame 2178 3 KB
1 KB 64ms
64ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/window_focus_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 18:44:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25849
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 18:44:25 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/ Frame 2178 20 KB
8 KB 80ms
73ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230706/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5dff1c5185bfe98d10fd4b80ad1e2a04d57365a09e631840dce7fd3c79d19971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:55:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28811
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8314
x-xss-protection: 0
server: cafe
etag: 15120507268597061312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:55:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2178 0
0 81ms
81ms Image
text/html 2607:f8b0:4006:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTAQm-_68IwJKC1vuBah9H7dLISel5HWYo2FP4LVTrVa_F3KUDql6Yvr8fSxxSI-tpCRa_wFdtVieD0pasrH2qZmAI5Rg
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2178 179 KB
56 KB 134ms
128ms Script
text/javascript 2607:f8b0:4006:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79cbf9d3dc9d8df1616dd585c95022e1104e8b2700974ba07a9c1a26187bf3e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57331
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1688990556196721"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:13 GMT

POST
H3 200 state Show response
api.permutive.com/v1.0/ 0
33 B 194ms
194ms XHR
text/plain 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v1.0/state?fetch_unseen=true&k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
via: 1.1 google
server: Permutive
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C604 0
0 81ms
80ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv1jANLxLpcr25gWcOr6kZ38SORJEqs3WegwnfUK6NyR7GhL0oMAgrW3Zy00HiDLGbQYSQiKmjms3eUUijPN2o0CtA25jF--Bv2qfiA4GM7KuZLNfqN6BGDazsgzoq_rm4lXQOiXMLAKJsHP2MKJfq3Jfl6cJg42Yh88WQogsxZYr-fSAqRkHK2eyWeBNyJ1lLBXMq59T-Q26FJBfE9Wu17JUaKgPTRpDqkPTai9LQyQSlEjLxkWAZoem22IGlIXq_t6H0yCXFmeju5ldZ0Hq-bcFxKhLiJE7LumCoFL9uH4UlqgfIYk1OkZxlpY-64NE4-BlOyu0ZxS7mczx4fXwWGLfpbf5o&sai=AMfl-YR42pKnzZOTqRHQgLojJHAWd74vHp4OWyk7T9MpkMUc316EYro_mogjGt0EkgNGNjCJBXsprhntL1vq6_eNL7q5dAnnMsb4sdRxOvKT2lHhBQGx8g4b7LX4uCExm5JGGLhz03ICuSummc7wN2t2KPA&sig=Cg0ArKJSzKG5kIZJSaVDEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4287 16 KB
6 KB 65ms
62ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=126797
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Tue, 11 Jul 2023 01:55:13 GMT
expires: Wed, 12 Jul 2023 13:08:30 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200
OK

csync
sync.spotim.market/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D271858%26extuid%3D%24UID
https://sync.spotim.market/csync?t=a&ep=271858&extuid=6113698130532189562

43 B
452 B

291ms
70ms

Image
image/gif

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.spotim.market/csync?t=a&ep=271858&extuid=6113698130532189562
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Server: Adtelligent
Etag: c84747090500b394
Content-Length: 43
Content-Type: image/gif

Redirect headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 58295598-82a4-40f7-b307-3434c20afb4b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://sync.spotim.market/csync?t=a&ep=271858&extuid=6113698130532189562
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

partner
sync.search.spotxchange.com/
Redirect Chain

https://sync.search.spotxchange.com/partner?source=211945
https://sync.search.spotxchange.com/partner?source=211945&__user_check__=1&sync_id=f9bbb355-1f8d-11ee-b94e-135c0edb0303
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_sc&gdpr=0&gdpr_consent=%24%7BGDPR_CONSENT_229%7D&us_privacy=
https://sync.search.spotxchange.com/partner?adv_id=7025&gdpr=0&gdpr_consent=%24%7BGDPR_CONSENT_229%7D&uid=CAESEGuIDXAALVFdJrOuIrYqa3Y&google_cver=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=spotx&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.search.spotxchange.com/partner?adv_id=7028&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&img=1
https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZKy2gAAAAHvPCgAt&img=1&gdpr=0&gdpr_consent=&us_privacy=
https://match.prod.bidr.io/cookie-sync/sx?gdpr=0&gdpr_consent=&us_privacy=
https://sync.search.spotxchange.com/partner?adv_id=8304&uid=AADg507JWW0AACFXxNbRlQ&gdpr=0
https://sync.springserve.com/usersync?redirect_url=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D8876%26uid%3DSS_UUID
https://sync.search.spotxchange.com/partner?adv_id=8876&uid=e5eae945-65db-4763-99b5-64359999dc1c
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=44&gdpr=0&gdpr_consent=&us_privacy=
https://sync.search.spotxchange.com/partner?adv_id=7308&uid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&gdpr=0&gdpr_consent=
https://sync.mathtag.com/sync/img?mt_exid=30&redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6653%26uid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=&us_privacy=
https://sync.search.spotxchange.com/partner?adv_id=6653&uid=fd9f64ac-b67f-4700-a46f-ae92dc707df3&gdpr=0&gdpr_consent=

43 B
419 B

60ms
60ms

Image
image/gif

192.35.249.137
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6653&uid=fd9f64ac-b67f-4700-a46f-ae92dc707df3&gdpr=0&gdpr_consent=
Requested by: Host: blank
URL: about:blank
Protocol: H2
Server: 192.35.249.137 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:19 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 323
content-length: 43

Redirect headers

Date: Tue, 11 Jul 2023 01:55:19 GMT
Server: MT3 1031 59fd23a master ord ord-pixel-x49 config_version:"1969"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://sync.search.spotxchange.com/partner?adv_id=6653&uid=fd9f64ac-b67f-4700-a46f-ae92dc707df3&gdpr=0&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 11 Jul 2023 01:55:18 GMT

GET
H/1.1

200
OK

csync
sync.spotim.market/
Redirect Chain

https://pixel.advertising.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58196/sync?&gdpr=&gdpr_consent=&redir=true
https://sync.spotim.market/csync?t=a&ep=290146&extuid=y-UEj96dZE2uGbS04lgWAmrQ54iXu0I0J0~A

43 B
469 B

151ms
68ms

Image
image/gif

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.spotim.market/csync?t=a&ep=290146&extuid=y-UEj96dZE2uGbS04lgWAmrQ54iXu0I0J0~A
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Server: Adtelligent
Etag: c84747090500b394
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://sync.spotim.market/csync?t=a&ep=290146&extuid=y-UEj96dZE2uGbS04lgWAmrQ54iXu0I0J0~A
date: Tue, 11 Jul 2023 01:55:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

/
sync.spotim.market/csync/
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20
https://sync.search.spotxchange.com/partner?adv_id=8721&redir=https%3A%2F%2Fsync.spotim.market%2Fcsync%2F%3Ft%3Da%26ep%3D301276%26extuid%3D%24SPOTX_USER_ID%20&__user_check__=1&sync_id=f9bbc2ef-1f8d...
https://sync.spotim.market/csync/?t=a&ep=301276&extuid=f9bbc2a7-1f8d-11ee-845e-1bbc3ab70203

43 B
469 B

70ms
69ms

Image
image/gif

23.227.139.243
24SHELLS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.spotim.market/csync/?t=a&ep=301276&extuid=f9bbc2a7-1f8d-11ee-845e-1bbc3ab70203
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Server: 23.227.139.243 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Server: Adtelligent
Etag: c84747090500b394
Content-Length: 43
Content-Type: image/gif

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
location: https://sync.spotim.market/csync/?t=a&ep=301276&extuid=f9bbc2a7-1f8d-11ee-845e-1bbc3ab70203
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 554
content-length: 0

GET
H2 200 710530.gif
di.rlcdn.com/ 42 B
305 B 172ms
80ms Image
image/gif 34.107.140.17
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://di.rlcdn.com/710530.gif
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.140.17 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 17.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 42

GET
H2 200 / Show response
insight.adsrvr.org/enduser/vast/ Frame 80E2 52 KB
52 KB 69ms
63ms XHR
text/xml 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/enduser/vast/?t=1&iid=82346d30-599d-4b84-99e6-ad515f11dde6&crid=dub0ryem&wp=ZKy2gAACJAsJiBMiAA5JBoFFSKZWoaRX9q9Uvw&aid=1&wpc=USD&sfe=16e43680&puid=CAESEMhj493LrMpeQxKEi4kSX7w&tdid=&pid=gwg88r3&ag=ecc2fv2&adv=ebpumhx&sig=1EqOLfuUnWMdGlfCbn9NU1sTOkipq0hQm6kMCFcfrz40.&bp=8.5&cf=5232291&fq=0&td_s=nypost.com&rcats=&mste=nypost.com&mfld=2&mssi=&mfsi=&uhow=45&agsa=&rgz=33018&svbttd=1&dt=PC&osf=Windows&os=Windows10&br=Chrome&rlangs=en&mlang=&svpid=pub-9386487545679073&did=&rcxt=Other&lat=25.920000&lon=-80.400000&tmpc=29.650000000000034&daid=&vp=0&osi=&osv=&bx=70&bv=1&vvp=&bffi=41&vpb=PreRoll&dc=95&vcc=EKwCGB4yBAgCCAlAAUgBUAKgAZADqAHhAcgBAdABA-gBAvABAfgBAYACA4oCDAgCCAMIBQgGCAcICJoCAggCoAICqAICwAIC&sv=google&pidi=54&advi=290640&cmpi=3439780&agi=15647949&cridi=31534819&svi=1&tid=1&cmp=f798i2o&vrtd=14,15&srca=1&rurl=https%3a%2f%2fnypost.com%2f2023%2f05%2f10%2fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him&tsig=2zf25iCDu-b6D2MRbCRGxzgSX-HTPNGJtKYM3WTG_WU.&c=Cg1Vbml0ZWQgU3RhdGVzEgdGbG9yaWRhGgM1MjgiB0hpYWxlYWgwAjgBSABQC4ABAIgBApABALABALoBBAheGATJAQAAAAAAoEZA&dur=CjoKH2NoYXJnZS1hbGxRQVZpZGVvQ29tcGxldGlvblJhdGUiFwiZ__________8BEgpxLWFsbGlhbmNlCjcKHGNoYXJnZS1hbGxRQVZpZGVvVmlld2FiaWxpdHkiFwiX__________8BEgpxLWFsbGlhbmNlCkQKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIfCKX__________wESDm1vYXQtcmVwb3J0aW5nKgIIAQ..&durs=1NODKk&crrelr=&fpa=559&pcm=3&said=ksVCRjqZ%2BKpG1SPvZXIJ5Q%3D%3D&auct=1&cxlvs=0&im=1&abr=b4d4f3cb-0c7c-41f5-9f02-c850fd22c54a&tail=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.580.0_en.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: / ASP.NET
Resource Hash: 77caed6489c2f544749c0350f403954fddb124472fc180ceac865a0bc838c037

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: text/xml; charset=utf-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

GET
DATA 200
OK truncated
/ Frame 5359 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1abaf64908f1d49f60ad39122471a2736b19090c6a7a4da487fc7302e7b6754a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 60DB
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjhkZGU4YWMxYTk1NWY3NDRiMDY2OGYzYmYzM2M5Yzk2OTM4YTllMg

170 B
188 B

79ms
78ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjhkZGU4YWMxYTk1NWY3NDRiMDY2OGYzYmYzM2M5Yzk2OTM4YTllMg

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjhkZGU4YWMxYTk1NWY3NDRiMDY2OGYzYmYzM2M5Yzk2OTM4YTllMg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 60DB
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=yBZHdqDuRp6kvFrkMxobgw&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=yBZHdqDuRp6kvFrkMxobgw

43 B
479 B

66ms
66ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=yBZHdqDuRp6kvFrkMxobgw

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: B4Y8HVCMRH58RMSB04AQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=yBZHdqDuRp6kvFrkMxobgw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 60DB
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=&expires=30

42 B
799 B

65ms
64ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 60DB 43 B
855 B 673ms
216ms Image
image/gif 52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YR85HK1A0Y3J0HA8PXP4
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 60DB
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEpYTjNZWUgtMUYtRzgwRg==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK-ctaJ4495YT4fhgbmb5CA&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpYTjNZWUgtMUYtRzgwRg==&google_push=

170 B
188 B

79ms
79ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpYTjNZWUgtMUYtRzgwRg==&google_push=

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpYTjNZWUgtMUYtRzgwRg==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
Expires: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 60DB
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJXN3YYH-1F-G80F

0
142 B

78ms
77ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJXN3YYH-1F-G80F
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 9F411012DD3C4830819FD667C0C760FC Ref B: MIAEDGE2921 Ref C: 2023-07-11T01:55:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYALGPX3gmrDsjyVvL0kA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJXN3YYH-1F-G80F
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 60DB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOrWL81ucp2OWuq_F906Udk&google_cver=1

42 B
799 B

244ms
60ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOrWL81ucp2OWuq_F906Udk&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 314e432eb2d967cf733b82bdbbe35231
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOrWL81ucp2OWuq_F906Udk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 60DB
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/lxh0uCFedd68e9NUvA2lDcn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-5PlFi19E2oLkYJbQW4bPTSmjO9q8wgSNzs29fQ--~A

42 B
799 B

62ms
61ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-5PlFi19E2oLkYJbQW4bPTSmjO9q8wgSNzs29fQ--~A
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Tue, 11 Jul 2023 01:55:13 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-5PlFi19E2oLkYJbQW4bPTSmjO9q8wgSNzs29fQ--~A
content-length: 0

GET
H2 200 bundle.js Show response
ib.3lift.com/rev/16f6bb0d294b35a9ad0981586ee93501ee13bf61/dist/ Frame C604 189 KB
60 KB 72ms
70ms Script
text/javascript 13.225.63.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ib.3lift.com/rev/16f6bb0d294b35a9ad0981586ee93501ee13bf61/dist/bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-107.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 095f4f1f23905ad5f019bca623730319a1fe267f7af082ee3a37b2fa13ad34fc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 05 Jul 2023 18:40:12 GMT
content-encoding: gzip
via: 1.1 64269b4eda1211bca4d40d7ab2177910.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
age: 458102
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 61160
last-modified: Wed, 05 Jul 2023 17:58:01 GMT
server: AmazonS3
etag: "2395ca4a38e3094364d9fc103a26792e"
content-type: text/javascript
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-amz-cf-id: H7c2H891Bd5fvnmCB1r9cM-6U4O-BJFmMB60s_4GEKq20JlLEIW86Q==

GET
H2 200 test.html Show response
widgets.outbrain.com/nanoWidget/externals/obUserFrame/ Frame 4CAC 2 KB
1 KB 64ms
62ms Document
text/html 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/obUserFrame/test.html?lsd=88e5793e-8fe2-496f-913d-a5fa43da29db
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 45f0f27fb78191006375051ee3046fae3105b652d11680432511cba61b32c330

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-encoding: gzip
content-length: 686
content-type: text/html
date: Tue, 11 Jul 2023 01:55:13 GMT
etag: "1e015194a0e596827cb8971f884eb43c:1688905399.646603"
expires: Tue, 18 Jul 2023 01:55:13 GMT
last-modified: Sun, 09 Jul 2023 10:15:34 GMT
server: AkamaiNetStorage
timing-allow-origin: * *
vary: Accept-Encoding

GET
H2 200 put.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame FB4B 416 B
744 B 63ms
62ms Document
text/html 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4f3b933077b738b503f7543ffc82fa0a061f0fe7d0ff1470865fde561a324bcc

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-length: 416
content-type: text/html
date: Tue, 11 Jul 2023 01:55:13 GMT
etag: "c0311cf15c21ddda054005e92fad3f9e:1688905396.839523"
expires: Tue, 18 Jul 2023 01:55:13 GMT
last-modified: Sun, 09 Jul 2023 10:15:34 GMT
server: AkamaiNetStorage
timing-allow-origin: * *

GET
H2 200 ob_logo_67x12.png
widgets.outbrain.com/images/widgetIcons/ 2 KB
3 KB 63ms
63ms Image
image/png 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/ob_logo_67x12.png
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 10 Aug 2023 01:55:13 GMT
date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "c52b07e749f7a09fa7b97b7e195e06ce:1673369415.187551"
access-control-allow-methods: GET,POST
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2326
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ 990 B
1 KB 63ms
62ms Image
image/svg+xml 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 10 Aug 2023 01:55:13 GMT
date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "5ab8e16b5f46213840bcd403e349419c:1673369393.880194"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 990
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 114ms
114ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=dbbbdb62aaefa976cbe8ed6bfec3e022_770_1689040511450&tm=4061&eT=0&widgetWidth=734&widgetHeight=33&widgetX=268&widgetY=4722&wRV=2010370&pVis=0&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&rtt=2187&oo=false&lo=3002&obreq=2778&mvreq=5326&mvres=7512&cet=4g&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 2626908caeb13ad300f8ba334fc681be
Content-Length: 28

GET
H2 200 obPvTracker.js Show response
widgets.outbrain.com/external/publishers/common/ 2 KB
1 KB 69ms
69ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/external/publishers/common/obPvTracker.js?advId=00c0feecc40196b47a738de28ad44794ac
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 09bba9c244cbc0f1c1f93f3c4033b7e71d34a8dbeee3c754a36ddcba0e329ab8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
content-length: 836
last-modified: Mon, 10 Jul 2023 12:49:48 GMT
server: AkamaiNetStorage
etag: "07a0f9eaad525afd418f644b5cf0e3be:1688993509.285317"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Tue, 11 Jul 2023 05:55:13 GMT

GET
H2 200 obConversionTracker.js Show response
widgets.outbrain.com/external/publishers/common/ 3 KB
1 KB 69ms
69ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/external/publishers/common/obConversionTracker.js?selector=.buy-button,.article-list__stream-link&name=Buy%20now%20click
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 44529f30aa6017da84c45718df1a0a4b0fb44cbb187c1fd80e33bbd6077067cc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
content-length: 999
last-modified: Mon, 10 Jul 2023 12:49:48 GMT
server: AkamaiNetStorage
etag: "ae89148ab5231afecd4a9f41414daad5:1688993507.823539"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Tue, 11 Jul 2023 05:55:13 GMT

GET
H2 200 reel.js Show response
widgets.outbrain.com/nanoWidget/2010370/module/ 26 KB
9 KB 63ms
62ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/2010370/module/reel.js?e=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0968ce4f656461cf40827051615c6129d98989b296a8ebebf9af01eebe0357ca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
content-length: 8623
last-modified: Sun, 09 Jul 2023 10:15:34 GMT
server: AkamaiNetStorage
etag: "a5c31ec996f80100e4d9cdd121bdc0da:1688994481.907687"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Tue, 18 Jul 2023 01:55:13 GMT

GET
H2 200 userZapping.js Show response
widgets.outbrain.com/nanoWidget/2010370/module/ 26 KB
7 KB 69ms
68ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/2010370/module/userZapping.js?e=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b11a1c0e51116334cab4107d8aaae16a30e7a265ea0a31becd6a144e19b41847

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
content-length: 7139
last-modified: Sun, 09 Jul 2023 10:15:34 GMT
server: AkamaiNetStorage
etag: "26545adf9951e520f6773ff84b1622a0:1688905393.362426"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Tue, 18 Jul 2023 01:55:13 GMT

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 199ms
114ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=20b26a3732e8d072374bcd3468d0171c_770_1689040512025&tm=4080&eT=0&widgetWidth=728&widgetHeight=487&widgetX=271&widgetY=4767&wRV=2010370&pVis=1&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&oo=false&lo=3002&obreq=2778&mvreq=5326&mvres=7532&re=7542&cet=4g&cs=5&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 97522ba28ebec2cce134445b04d32464
Content-Length: 28

GET
H2 200 clip.js Show response
widgets.outbrain.com/nanoWidget/2010370/module/ 1 KB
1 KB 64ms
63ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/2010370/module/clip.js?e=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a3d4d4f13b570d57471da118a6a388f0248da6d3263d582dd62c06d10bc916fd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
content-length: 709
last-modified: Sun, 09 Jul 2023 10:15:34 GMT
server: AkamaiNetStorage
etag: "60a96c8ce4bf10fd37dda1f370ff8e56:1688994468.864377"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Tue, 18 Jul 2023 01:55:13 GMT

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 323ms
128ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=bee7fd5c96d00af630d4732d4c511d1d_770_1689040512221&tm=4096&eT=0&widgetWidth=728&widgetHeight=542&widgetX=271&widgetY=5290&wRV=2010370&pVis=1&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&oo=false&lo=3002&obreq=2778&mvreq=5326&mvres=7532&re=7559&cet=4g&cs=5&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 4cc613a9326a320fda8ad00506cad5f0
Content-Length: 28

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 426ms
110ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=87985c05d8db75885a43417b71a6d921_770_1689040512371&tm=4101&eT=0&widgetWidth=728&widgetHeight=542&widgetX=271&widgetY=5856&wRV=2010370&pVis=1&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&oo=false&lo=3002&obreq=2778&mvreq=5326&mvres=7532&re=7565&cet=4g&cs=5&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 92e8c26e58d31e88fc3d149103928897
Content-Length: 28

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 428ms
114ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=aa2cfbe62f5bbd790a1b6fd78a77ff96_770_1689040512489&tm=4106&eT=0&widgetWidth=728&widgetHeight=231&widgetX=271&widgetY=6421&wRV=2010370&pVis=0&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&oo=false&lo=3002&obreq=2778&mvreq=5326&mvres=7532&re=7570&cet=4g&cs=5&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 8f6088cd4e37b732a32bac8ef7448b7d
Content-Length: 28

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 431ms
113ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=1fb377a42ce5686559b6ae6e89510563_770_1689040512706&tm=4111&eT=0&widgetWidth=728&widgetHeight=576&widgetX=271&widgetY=6676&wRV=2010370&pVis=1&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&oo=false&lo=3002&obreq=2778&mvreq=5326&mvres=7532&re=7575&cet=4g&cs=5&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 1c01eafbe98de45711ab0a86a81b72ea
Content-Length: 28

POST
H/1.0 504
Gateway Time-out /
eventlog.outbrain.com/logger/v1/widget/ 0
0 6448ms
6106ms Ping
text/html 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://eventlog.outbrain.com/logger/v1/widget/
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryI1IxddBto1xFOK1C

Response headers

GET
H2 200 get Show response
mv.outbrain.com/Multivac/api/ 27 KB
8 KB 235ms
234ms Script
text/javascript 199.232.38.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://mv.outbrain.com/Multivac/api/get?url=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&idx=2&rand=94895&widgetJSId=AR_12&va=true&et=true&format=html&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&lsdt=1689040513506&t=MWNlZjIwYjc1MWM4ZTUyY2IxODQyZmU5Zjc4YzllZGE=&px=629&py=8800&vpd=7600&pubInState=0&cw=341&seid=927fb7cd-c6dc-7fd2-0000-018942a8de26%7C920%7C1&settings=true&recs=true&key=NANOWDGT01&adblck=false&abwl=false&ab=0&wl=0&umv=1&wdr-cosc=1&activeTab=true&version=2010370&sig=zeq6QPLM&apv=false&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&dpr=1&secured=true&cmpStat=0&ccpa=1---&ccpaStat=1&chs=1&ogn=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.38.132 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ccb38e036952dc57faf7b7ed5d5064a80864d92b95f038e5131b525edb5c9b49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits: 0
date: Tue, 11 Jul 2023 01:55:13 GMT
content-encoding: br
via: 1.1 varnish
traffic-path: SADC1, LGA, USA_EAST1
x-cache: MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
x-traceid: 65d2bf783a007f99604c4e007d6174cd
content-length: 7604
x-served-by: cache-lga21940-LGA
pragma: no-cache
x-timer: S1689040514.612580,VS0,VE162
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 Close.svg
widgets.outbrain.com/images/widgetIcons/ 765 B
1 KB 63ms
63ms Image
image/svg+xml 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/Close.svg
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2c92cde33538b1187bedea3d0b6d5141e4222eba8092476339aa080cee759ac

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 10 Aug 2023 01:55:13 GMT
date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "f740f788e2e26736856f7a3a12457a63:1673369390.457553"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 765
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H2 200 eyJpdSI6IjkyNTUwOTVhYzI0MWEyZjJhZTU1MTk4YTViNmVjOWYwNjg3NzI2ODA0ZDA0NDNkZjA3NWQyODA1ZWU2ZWNhODAiLCJ3IjozNSwiaCI6MzUsImQiOjIuMCwiY3MiOjAsImYiOjR9.webp
images.outbrainimg.com/transform/v3/ 1 KB
2 KB 70ms
70ms Image
image/webp 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjkyNTUwOTVhYzI0MWEyZjJhZTU1MTk4YTViNmVjOWYwNjg3NzI2ODA0ZDA0NDNkZjA3NWQyODA1ZWU2ZWNhODAiLCJ3IjozNSwiaCI6MzUsImQiOjIuMCwiY3MiOjAsImYiOjR9.webp
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2ed0664d2bf8eaf59fbc7d7975664fa9b3739bb2ba769d4f6dfbf6ff942cb78b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Thu, 18 May 2023 02:54:24 GMT
access-control-allow-methods: GET,POST
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=776702
access-control-allow-credentials: false
x-traceid: 4abfb33234f0dd2f5620c5a3abe37086
timing-allow-origin: *, *
content-length: 1440

GET
H2 200 eyJpdSI6ImVmMWNiOTk3MmFhMmNlNTUxMjUxNDQ5ZTVhNjYxM2MwZDU5Yzg4YjY4MGIxZjAyZmE2Mjg2MWU4NzBiYmQ2ZjMiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
images.outbrainimg.com/transform/v3/ 169 KB
169 KB 70ms
70ms Image
video/mp4 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImVmMWNiOTk3MmFhMmNlNTUxMjUxNDQ5ZTVhNjYxM2MwZDU5Yzg4YjY4MGIxZjAyZmE2Mjg2MWU4NzBiYmQ2ZjMiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Fri, 07 Jul 2023 10:01:54 GMT
access-control-allow-methods: GET,POST
content-type: video/mp4
access-control-allow-origin: *
cache-control: max-age=2147270
access-control-allow-credentials: false
x-traceid: 38a4f3f23a0270965999efda6cd094ac
timing-allow-origin: *, *
content-length: 173000

GET
H2 200 eyJpdSI6IjVmNGU1Y2EzNTYzZDQ0M2YzYjUyNDM5NGNmODEzZTAwNmE1NmNlOGFlNjM1YjFiN2MyZDJlMDU0MDAzZWIzOWEiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
images.outbrainimg.com/transform/v3/ 443 KB
443 KB 143ms
143ms Image
video/mp4 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjVmNGU1Y2EzNTYzZDQ0M2YzYjUyNDM5NGNmODEzZTAwNmE1NmNlOGFlNjM1YjFiN2MyZDJlMDU0MDAzZWIzOWEiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Thu, 25 May 2023 13:11:12 GMT
access-control-allow-methods: GET,POST
content-type: video/mp4
access-control-allow-origin: *
cache-control: max-age=1289586
access-control-allow-credentials: false
x-traceid: 104e85e52f0eb20b95b0b1d3018e2e47
timing-allow-origin: *, *
content-length: 453946

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame C604 8 KB
4 KB 254ms
74ms Script
application/javascript 2600:1400:9000::6875:b641
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 39399d443a3ab24886d829aae4ac8b33492ab78b193aeadda64586f0467b5ef5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:13 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jul 2023 12:19:54 GMT
Server: UploadServer
ETag: "8f00be3da9a0f0d7a1a8c47b91364b82"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3377
Expires: Thu, 06 Jul 2023 12:35:20 GMT

GET
DATA 200
OK truncated
/ Frame C604 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 055ef3080d1f72c7bd676a862569019b66509eb9ab8556f19faaf30feed08861

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 csi
csi.gstatic.com/ Frame 80E2 0
54 B 212ms
211ms Ping
image/gif 2a00:1450:4017:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=3~ljxn40qs&c=2636235545112&slotId=1318117772556&vast_v=3.0&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=AdChoices&icdi=15x77&vmfc=14&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.580.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4017:815::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 206 eyJpdSI6IjVmNGU1Y2EzNTYzZDQ0M2YzYjUyNDM5NGNmODEzZTAwNmE1NmNlOGFlNjM1YjFiN2MyZDJlMDU0MDAzZWIzOWEiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
images.outbrainimg.com/transform/v3/ 443 KB
444 KB 138ms
136ms Media
video/mp4 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjVmNGU1Y2EzNTYzZDQ0M2YzYjUyNDM5NGNmODEzZTAwNmE1NmNlOGFlNjM1YjFiN2MyZDJlMDU0MDAzZWIzOWEiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a483b797e75da7d01427ea72f587bb6629a53c163a74e5776e88838fc5b45b8f

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Thu, 25 May 2023 13:11:12 GMT
access-control-allow-methods: GET,POST
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-453945/453946
cache-control: max-age=1289586
access-control-allow-credentials: false
x-traceid: 104e85e52f0eb20b95b0b1d3018e2e47
timing-allow-origin: *, *
Content-Length: 453946

GET
H2 206 eyJpdSI6ImVmMWNiOTk3MmFhMmNlNTUxMjUxNDQ5ZTVhNjYxM2MwZDU5Yzg4YjY4MGIxZjAyZmE2Mjg2MWU4NzBiYmQ2ZjMiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
images.outbrainimg.com/transform/v3/ 169 KB
169 KB 138ms
136ms Media
video/mp4 184.24.37.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImVmMWNiOTk3MmFhMmNlNTUxMjUxNDQ5ZTVhNjYxM2MwZDU5Yzg4YjY4MGIxZjAyZmE2Mjg2MWU4NzBiYmQ2ZjMiLCJ3Ijo2MDAsImgiOjQwMCwiZCI6MS4wLCJjcyI6MiwiZiI6NX0.mp4
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.37.207 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-37-207.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7758ce8ac579f9c7668ec5e59b79ca9264e85e36641eb47989fd10248d04aaca

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
last-modified: Fri, 07 Jul 2023 10:01:54 GMT
access-control-allow-methods: GET,POST
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-172999/173000
cache-control: max-age=2147270
access-control-allow-credentials: false
x-traceid: 38a4f3f23a0270965999efda6cd094ac
timing-allow-origin: *, *
Content-Length: 173000

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BB87
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=LJXN3YYH-1F-G80F
https://usersync.gumgum.com/usersync?b=mag&i=LJXN3YYH-1F-G80F

35 B
250 B

59ms
59ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=LJXN3YYH-1F-G80F
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:14 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://usersync.gumgum.com/usersync?b=mag&i=LJXN3YYH-1F-G80F
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
Expires: 0

GET
H2 200 styles-bundle.js Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 39 KB
6 KB 62ms
61ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/styles-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 79ac9ee1fffd070e56a95349b9ec19d3bfebc87b0da56a4c2813818ad1f194c8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:33 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: GBK.wYswxurjt8s.Vj8Xxnqx7RUBblCg
x-amz-cf-pop: EWR53-C3
age: 1158641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 5833
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "359b6331d4b61976ee84abe13de3381c"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: gsGh_NXobqpX-H9Md8i0vET6k_9G6JWi5c4ra2Vmv7rQ3UzCKkpghQ==

GET
H2 200 vendors-node_modules_reduxjs_toolkit_dist_redux-toolkit_esm_js-node_modules_spotim_message_di-d5f4c0-bundle.js Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 372 KB
95 KB 65ms
65ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/vendors-node_modules_reduxjs_toolkit_dist_redux-toolkit_esm_js-node_modules_spotim_message_di-d5f4c0-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a9a8ab2ff5779fbd5c59c5a9b9328fb51868c316a111719f9e616f91f0c1806

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:33 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: Qa3ghP7iSTjYISB1CGbOCE732kGitRrU
x-amz-cf-pop: EWR53-C3
age: 1158641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 97111
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "dbb7a3185e2a95be11c7c0410f976575"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: OHfiLnVC6NK3YAreRRl2-vd5EbSF4855Hh7a1mUJHazW3JBKzbb1uA==

GET
H2 200 app_conversation_components_Main_tsx-app_conversation_services_legacy_helpers_browser-detect_ts-bundle.js Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 139 KB
37 KB 92ms
92ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/app_conversation_components_Main_tsx-app_conversation_services_legacy_helpers_browser-detect_ts-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f4d2a5c298097ebefc636aac759ad5844dfbf5d021650371ed0e9803ea95ddd6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:33 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: 7pNpWAX9el6bEhXhUmOSfjJOzYzpxy8Y
x-amz-cf-pop: EWR53-C3
age: 1158641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 37616
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "ec50d3f75dd53d35d5cfb960996f3bf6"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: cUSb6FaxocwGuqxSAGWOtp852er-dS5HyBXr35DUO0I4LB-CBZJzcQ==

GET
H2 200 app_conversation_i18n_ts-app_conversation_initialize-store_ts-app_conversation_services_legac-f5b848-bundle.js Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 38 KB
12 KB 100ms
100ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/app_conversation_i18n_ts-app_conversation_initialize-store_ts-app_conversation_services_legac-f5b848-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f4df4d17f28a137bf8ebb62a93d6e57a45d91ff84281ec60bc143485ccd5824a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:33 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: bhkJr1hWkPnOwzjTTd._R1RvX954PeKc
x-amz-cf-pop: EWR53-C3
age: 1158641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 11641
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "72a526ba0276a225b687e5911945b597"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: gqc2JYRcnZJhtbRljJrLhEafY7WLekER1-O7TgmMx36Y3ehvzgqXTg==

GET
H2 200 conversation-boot-next-bundle.js Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 9 KB
4 KB 102ms
102ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/conversation-boot-next-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 77b38116dec521d620216fb69e11fa1085f3a22e95215f7573399f0765ab4dd8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:33 GMT
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
x-amz-version-id: SNqyZzmLXAkEwtiBUpE9o3A5OVjS.yDN
x-amz-cf-pop: EWR53-C3
age: 1158641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 3162
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "fc18e3f9c9c7bd7be48ff3e0eebccf6e"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: rrezbNgC7H4RMV8Tm4DCqIzc_yrzxbrfsHH1UxkzOzi0Hfmj0EV3UQ==

GET
H2 200 styles.css Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 673 KB
39 KB 76ms
76ms Fetch
text/css 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/styles.css
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/initial-bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8fe21f6a928b1f510323767c6041ad0f2786f7457d94a0ea41b61bba4e288211

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:33 GMT
content-encoding: br
via: 1.1 779925c9c68a6d4d8c35b729b0516a76.cloudfront.net (CloudFront)
x-amz-version-id: 4PUg_CAfS0XFbdj9LMFWckTlU5dnpwF6
x-amz-cf-pop: EWR53-C3
age: 1158641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 39427
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "989b0a22de6e7a50ad75ec1146ee8e8b"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: LoCjK77v_7aYq4GC7rUDM8D42tzFlY2MBTT0FbYT4j-kcBFqXgaDJA==

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
771 B 72ms
72ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=c2ldiee&fmt=json
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 193f86b4db3ed0259caeda006f90f606d5d35c078c5186aa449376317ab91845

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://nypost.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Thu, 10 Aug 2023 01:55:13 GMT

GET
H2 200 b9pj45k4 Show response
sync-tm.everesttech.net/upi/pid/ Frame 0A48 85 B
259 B 70ms
69ms Document
image/png 151.101.2.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Tue, 11 Jul 2023 01:55:13 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760066-MIA
x-timer: S1689040514.758448,VS0,VE27

GET
H2

200

50674DE4-1331-4B8B-A08E-394A47B0E933
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 63B0
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978477416365413599
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pr-bh.ybp.yahoo.com/sync/pubmatic/50674DE4-1331-4B8B-A08E-394A47B0E933?gdpr=0&gdpr_consent=

0
0

63ms
63ms

Document
image/gif

2600:1f18:4e9:5a07:e525:84df:6700:168e
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/50674DE4-1331-4B8B-A08E-394A47B0E933?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:e525:84df:6700:168e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 0
content-length: 43
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
content-type: image/gif
date: Tue, 11 Jul 2023 01:55:14 GMT
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
referrer-policy: strict-origin-when-cross-origin
server: ATS
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

content-length: 126
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:13 GMT
location: https://pr-bh.ybp.yahoo.com/sync/pubmatic/50674DE4-1331-4B8B-A08E-394A47B0E933?gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame F278 43 B
479 B 83ms
80ms Document
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID50674DE4-1331-4B8B-A08E-394A47B0E933

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: 7W4VH1MX3TER92WVZHA0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame ECF7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=UGdN5BMxS4ugjjlKR7DpMw%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

63ms
63ms

Image
text/html

72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=126796
accept-ranges: bytes
content-length: 5554
expires: Wed, 12 Jul 2023 13:08:30 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame ECF7
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=50674DE4-1331-4B8B-A08E-394A47B0E933
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=769cc907-bb8a-48b3-94b2-45800c692986%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=769cc907-bb8a-48b3-94b2-45800c692986%2C%2C

95 B
123 B

51ms
50ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=769cc907-bb8a-48b3-94b2-45800c692986%2C%2C

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttd_puid=769cc907-bb8a-48b3-94b2-45800c692986%2C%2C
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 359

GET
H2 200 xuid
eb2.3lift.com/ Frame ECF7 37 B
354 B 95ms
90ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=50674DE4-1331-4B8B-A08E-394A47B0E933&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

insync
thrtle.com/ Frame ECF7
Redirect Chain

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=50674DE4-1331-4B8B-A08E-394A47B0E933&gdpr=0&gdpr_consent=
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=50674DE4-1331-4B8B-A08E-394A47B0E933&vxii_pid=12&vxii_pid1=10067&vxii_rcid=fc6d3766-9622-4eab-813a-c4dcb784bd51

43 B
294 B

58ms
58ms

Image
image/gif

3.234.167.181
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=50674DE4-1331-4B8B-A08E-394A47B0E933&vxii_pid=12&vxii_pid1=10067&vxii_rcid=fc6d3766-9622-4eab-813a-c4dcb784bd51
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 3.234.167.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-167-181.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
date: Tue, 11 Jul 2023 01:55:14 GMT
content-length: 43
content-type: image/gif

Redirect headers

location: https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=50674DE4-1331-4B8B-A08E-394A47B0E933&vxii_pid=12&vxii_pid1=10067&vxii_rcid=fc6d3766-9622-4eab-813a-c4dcb784bd51
date: Tue, 11 Jul 2023 01:55:13 GMT
content-type: text/html; charset=utf-8
content-length: 211
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame ECF7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NTA2NzRERTQtMTMzMS00QjhCLUEwOEUtMzk0QTQ3QjBFOTMz&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=50674DE4-1331-4B8B-A08E-394A47B0E933&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5jM42sRE2uVizPnEkIPnpXq.4JVGIIk-~A&gdpr=0

0
128 B

66ms
65ms

Image
text/plain

162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5jM42sRE2uVizPnEkIPnpXq.4JVGIIk-~A&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5jM42sRE2uVizPnEkIPnpXq.4JVGIIk-~A&gdpr=0
date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame ECF7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESELj8eq8GlkhS2UmXMk9s0t4&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=50674DE4-1331-4B8B-A08E-394A47B0E933&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5jM42sRE2uVizPnEkIPnpXq.4JVGIIk-~A&gdpr=0

0
128 B

66ms
66ms

Image
text/plain

162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5jM42sRE2uVizPnEkIPnpXq.4JVGIIk-~A&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5jM42sRE2uVizPnEkIPnpXq.4JVGIIk-~A&gdpr=0
date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET

Pug
simage2.pubmatic.com/AdServer/ Frame ECF7
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C113B5631389476F8D2D4C72B5F3963A
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=50674DE4-1331-4B8B-A08E-394A47B0E933&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=1ba726976b271854&is_secure=true&networkId=17100&version=1&nuid=50674DE4-1331-4B8B-A08E-394A47B0E933&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAL2sDbFy27VgNAHLFbAAAAAAA&expiration=1689126916&nuid=50674DE4-1331-4B8B-A08E-394A47B0E933&...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33646_1059F6696_11A692D3C&r=https://pmp.mxptint.net/sn.ashx?ak=1

0
0

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame ECF7
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=6971283231311444352&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=50674DE4-1331-4B8B-A08E-394A47B0E933&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=1111c15b507f102e&is_secure=true&networkId=17100&version=1&nuid=50674DE4-1331-4B8B-A08E-394A47B0E933&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAL2sDbFy27UgM1AtI5AAAAAAA&expiration=1689126916&nuid=50674DE4-1331-4B8B-A08E-394A47B0E933&...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
146 B

73ms
65ms

Image
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-sharethrough_pm-db5_rbd_ppt_n-vmg_n-MediaNet_ox-db5_an-db5_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 676F 3 KB
2 KB 142ms
41ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 563
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7e4d6c4bbc85da53-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 11 Jul 2023 01:55:13 GMT
expires: Tue, 11 Jul 2023 05:55:13 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 9CC4 36 KB
12 KB 313ms
146ms Document
text/html 23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

a5dc73a6d615433e3e84ac8e2788881788a01326a65a2d63e7a49fdea0546e8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11962
content-type: text/html; charset=UTF-8
date: Tue, 11 Jul 2023 01:55:14 GMT
expires: Thu, 13 Jul 2023 01:55:14 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame 05CD 12 KB
5 KB 78ms
78ms Document
text/html 104.18.43.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1---&pubcid=a878d8e0-8a80-4366-920e-95a5dee32438&publisherId=OZONENYP0001&siteId=1500000033&cb=1689040511067&bidder=ozone
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.43.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08b921a41744ea58b0f3c40e8f53729e15ca9437be74edcd07581458aeff8445

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7e4d6c4b1b8502ed-MIA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:13 GMT
expires: 0
last-modified: Mon, 10 Jul 2023 14:29:41 GMT
pragma: no-cache
server: cloudflare
vary: Origin, Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 80F3 3 KB
1 KB 138ms
42ms Document
text/html 104.18.11.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 563
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 7e4d6c4bbc86da53-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 11 Jul 2023 01:55:13 GMT
expires: Tue, 11 Jul 2023 05:55:13 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame A03A 52 KB
17 KB 292ms
72ms Document
text/html 69.192.17.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.17.104 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-17-104.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 11 Jul 2023 01:55:14 GMT
ETag: "623de86a-cf34"
Expires: Wed, 12 Jul 2023 01:55:16 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 1533 281 B
554 B 185ms
61ms Document
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:13 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame D8DA 9 KB
4 KB 213ms
61ms Document
text/html 18.164.116.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html?usp_consent=1---
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.116.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-116-8.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4d5a6e08bb0e8edc55e4e204d4b98729de4e1ae37db44e357b1d28a9463dc215

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 39865
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Mon, 10 Jul 2023 14:50:49 GMT
etag: W/"481f0eb11193eeaea6a690e5c66c57a4"
last-modified: Wed, 07 Jun 2023 17:56:33 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 ffc407ec9784e618feb8fc53384b80aa.cloudfront.net (CloudFront)
x-amz-cf-id: uZAij6P0GSTh86HIrrnksp9DK2czoNzf_I_P_5ubCNAA2e3U15dGrA==
x-amz-cf-pop: JFK50-P6
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:0c92ffba-51e2-4731-859f-5f9f5816d5c0
x-amz-meta-codebuild-content-md5: 0784681e688ba45904ac0a64aa0b0a6b
x-amz-meta-codebuild-content-sha256: 956b79d89029f14eaea1f363768b0942a0576bc42557ef6c8f6cc53fdc4d8515
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 5BE7 1 KB
2 KB 71ms
69ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1---&
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: be1eb93a1775a41be91e91e75c5cceb5d0ee51b0ea096fa4d7c40947817bcbbd

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1114
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:13 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 334C 1 KB
2 KB 70ms
68ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1---&
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: be1eb93a1775a41be91e91e75c5cceb5d0ee51b0ea096fa4d7c40947817bcbbd

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1114
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:13 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame DC5A 52 KB
17 KB 279ms
74ms Document
text/html 69.192.17.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.17.104 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-17-104.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 11 Jul 2023 01:55:14 GMT
ETag: "623de86a-cf34"
Expires: Wed, 12 Jul 2023 01:55:16 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1

200
OK

ibs:dpid=903&dpuuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1---&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

42 B
942 B

341ms
118ms

Image
image/gif

44.238.178.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

HTTP/1.1

Server

44.238.178.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

DCS: dcs-prod-usw2-1-v046-0f98e575d.edge-usw2.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: qXRnhvlcQgo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 189

GET
H/1.1

200
OK

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1---
https://p.rfihub.com/cm?in=1&pub=20513&ssp=themediagrid&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=978477416365413599&expires=30&ssp=themediagrid

43 B
235 B

175ms
58ms

Image
image/gif

35.211.178.172
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=119&user_id=978477416365413599&expires=30&ssp=themediagrid
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Server: 35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=119&user_id=978477416365413599&expires=30&ssp=themediagrid
Date: Tue, 11 Jul 2023 01:55:14 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5359 0
0 222ms
82ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscSUejb3O7cmRH5EquRp9z8Nlj157FgSPInNSWwdXxC7Xc9TJnRDO0P9qqfN1gYvrxB0BrouHzf9v9UlxqVQ0YOj7fatoCC9l-vaFwocQsdA7sK825PQMdWs9bHtqIqL8DPTYd51EMUOOgWBvxYlZInJF7UE2w_eTKnCPQNOZ3TtIfgXV5ivACs7Di8alcl6oRoYaZlNpG3vwxjuV8ObHnNrEPr9bO0jw7PkUZMhqumEJ_GxCvD1J-iclRjfmeYFoGe3OSGw4MipxawUaCDMoOJK4wSQwtiWT9Zg_i2791xDZ2f8etSUyowT8JMrPXgFe_lK7aYRDbMSaUP4mwq4zCuFuq2A&sai=AMfl-YS4dCjkqu1ZzUFtCqy0EUMvz11AbvZ8SC0vab5rWmr5wS_KsTyIRrEFdtfXV85vi3J0iAa15_tuRikg7-dJb63hckg_WyRIH7cr2V4mwprDe6OGHN7MOGtmFq6FhJP_R5M0PtMUi2XJbh6GTVKrN5o&sig=Cg0ArKJSzNqAWoePSL4EEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 11 Jul 2023 01:55:13 GMT

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 3E5B 1 KB
2 KB 64ms
64ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 2364a319d0143a2defcd1175e2b595dacbca04145d1725e5068293ac674fabd0

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1245
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:13 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 test.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame FB4B 610 B
938 B 64ms
64ms Document
text/html 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/test.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6139e1fc0d3709eebbe2b18510cf24361b9f8a538c3529a73c282bafe6c78474

Request headers

Referer: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-request-headers: X-OB-STG,X-OB-PRD
cache-control: max-age=604800
content-length: 610
content-type: text/html
date: Tue, 11 Jul 2023 01:55:13 GMT
etag: "48053d50141031b1511dbd30f9a31288:1688905397.398884"
expires: Tue, 18 Jul 2023 01:55:13 GMT
last-modified: Sun, 09 Jul 2023 10:15:34 GMT
server: AkamaiNetStorage
timing-allow-origin: * *

GET
H2 200 vendors-node_modules_spotim_common-components_dist_index_js-node_modules_spotim_topics_dist_t-5d9d60-bundle.js Show response
static-cdn.spot.im/production/notifications/tags/v1.20.1/ 268 KB
74 KB 63ms
63ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/notifications/tags/v1.20.1/vendors-node_modules_spotim_common-components_dist_index_js-node_modules_spotim_topics_dist_t-5d9d60-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9cd17af00b58e83bcf70fa97448e21bc6def92af0c00dfa7349aeb3200c40b8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: 2cK61d1FrHqv7mpcdZw6CJCy9kXp2fP3
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 12:48:30 GMT
last-modified: Thu, 27 Apr 2023 15:17:04 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 47204
x-amz-server-side-encryption: AES256
etag: W/"65b6fded5f4ad8a82780bdb8f6a581a9"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
x-amz-cf-id: b6uv4ERPMup0hiUnLN2qJiW_jemd-GZxp6114yLkrVkAoRK6ziV_gQ==

GET
H2 200 src_components_NotificationItem_NotificationDescription_NotificationDescription_tsx-src_compo-c938d2-bundle.js Show response
static-cdn.spot.im/production/notifications/tags/v1.20.1/ 66 KB
16 KB 80ms
77ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/notifications/tags/v1.20.1/src_components_NotificationItem_NotificationDescription_NotificationDescription_tsx-src_compo-c938d2-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fc1f30b6c5115427c889f757444ca875e65c608322960e35ec45f220f34833ea

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: 9tF.OqrfvEWBV4ZPiCgWJN9OyYnVfDbw
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 09:30:55 GMT
last-modified: Thu, 27 Apr 2023 15:17:04 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 59059
x-amz-server-side-encryption: AES256
etag: W/"41698fcf9969e3dd0412e173f5ea868b"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
x-amz-cf-id: i9NdlA2Hjz_ytyNIcleIoqyIOCA66ruIu1Yqx39p2E2jgk_NQr5D1A==

GET
H2 200 src_next_features_BootStickyNotifications_index_tsx-bundle.js Show response
static-cdn.spot.im/production/notifications/tags/v1.20.1/ 15 KB
5 KB 81ms
79ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/notifications/tags/v1.20.1/src_next_features_BootStickyNotifications_index_tsx-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: da015b4ca11cc96591ac0a5e959ec2037f733b78fbee5ea5e271ae8aaffa6b77

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: 4IeMHGIFVGuL1fj229LFth_OsXG7XRvb
content-encoding: br
via: 1.1 dfbeb92e774306364b3bad2c0151cd7e.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 06:24:51 GMT
last-modified: Thu, 27 Apr 2023 15:17:04 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C3
age: 70223
x-amz-server-side-encryption: AES256
etag: W/"ce91dbbf438eff654a8dbc99df9be225"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
x-amz-cf-id: HyFahgktCGvuyqYn0LcL4aFv_n-O76nFz5ritbWHFYI6g36FVTaU1A==

GET
H2 200 styles.css Show response
static-cdn.spot.im/production/notifications/tags/v1.20.1/ 236 KB
16 KB 71ms
69ms Fetch
text/css 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/notifications/tags/v1.20.1/styles.css
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/initial-bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ec9fe156c691d18fbf58b7118f1af9763736f089f5a556157e5ff6fe9566808a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: iBOjvYDR5Fgg8M0R.G6WST.GPdXicA5k
content-encoding: br
via: 1.1 779925c9c68a6d4d8c35b729b0516a76.cloudfront.net (CloudFront)
date: Mon, 10 Jul 2023 09:04:25 GMT
x-amz-cf-pop: EWR53-C3
age: 60648
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 27 Apr 2023 15:17:04 GMT
server: AmazonS3
etag: W/"447d9971f6bc1ba530d27ecc07180adc"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-amz-cf-id: 6zNuXm_FaH5bNcvBAqZUcy-ZzK20N5H99ELZnqZh9I1clMBj4Ffh4w==

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 94 KB
30 KB 227ms
114ms XHR
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.135.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

eb3e17c0f1b1c67c004211e61c5b1a416d53b308b9ac69b87a59c6ccbc751950

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 29 Jun 2023 05:28:55 GMT
server: nginx
etag: W/"649d1697-17798"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 12 Jul 2023 01:55:14 GMT

GET
H2 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 80E2 42 B
121 B 83ms
82ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CJCAdgLasZIvICKKmoPwPhpK56AHFxcajXrjvq8ljwI23ARABIABg5QKCAR1jYS12aWRlby1wdWItOTM4NjQ4NzU0NTY3OTA3M8gBBeACAKgDAZgEAKoEyQJP0H1IC4kptgyKOCEkK6MTAoOIsl_474lPZauqfMBvSv5WgTBn5wKP3rVoM8T6iDlnqLNk2A61KZC_tidb9mqAANuMYPaYvm48HjpzWcfYEjuTWadQrhgs19Yvwz8OEobNo-02nek6Hxko1E-c_i7XXUa3_YTrmss7w6Tmj85NS_bJsil37UAyJmuLEUsScI2RqYxYSHxHXPsK8cqsO-hLzGuOga7IA16IftQrcLeuUHAP-ELYnUxQ9H6BAdQXf7iUhnD_uT7RJe2a8tm0BfBOhjDmLOyWypaW1oCd10a0ZPRmIVM0IBSVNYVX5J39K_rbabdkMBIZyCboiAgkrQkHPCjQwrTvYOOVq7tkHjMMD-EIDEvvjM3w1_GFCLIXk1Cw-gxMkgknEfN14ppa2favuQKcQcVMcZVXrrJ2uCOJ2TSMeJGYGCYl5eAEAYAG59e-t4DvgOa5AaAGKqgHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ&sigh=oROqWyT8tLg&label=video_ad_loaded&sdkv=h.3.580.0&vci=[CREATIVE_PLAYBACK]

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 80E2 42 B
108 B 82ms
81ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CJCAdgLasZIvICKKmoPwPhpK56AHFxcajXrjvq8ljwI23ARABIABg5QKCAR1jYS12aWRlby1wdWItOTM4NjQ4NzU0NTY3OTA3M8gBBeACAKgDAZgEAKoEyQJP0H1IC4kptgyKOCEkK6MTAoOIsl_474lPZauqfMBvSv5WgTBn5wKP3rVoM8T6iDlnqLNk2A61KZC_tidb9mqAANuMYPaYvm48HjpzWcfYEjuTWadQrhgs19Yvwz8OEobNo-02nek6Hxko1E-c_i7XXUa3_YTrmss7w6Tmj85NS_bJsil37UAyJmuLEUsScI2RqYxYSHxHXPsK8cqsO-hLzGuOga7IA16IftQrcLeuUHAP-ELYnUxQ9H6BAdQXf7iUhnD_uT7RJe2a8tm0BfBOhjDmLOyWypaW1oCd10a0ZPRmIVM0IBSVNYVX5J39K_rbabdkMBIZyCboiAgkrQkHPCjQwrTvYOOVq7tkHjMMD-EIDEvvjM3w1_GFCLIXk1Cw-gxMkgknEfN14ppa2favuQKcQcVMcZVXrrJ2uCOJ2TSMeJGYGCYl5eAEAYAG59e-t4DvgOa5AaAGKqgHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ&sigh=oROqWyT8tLg&label=show_ad&sdkv=h.3.580.0&vci=CkoIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKhQtNTA1ODY2NDQ2NzM5NjU4MDM3N0DbBgpeCAESEmluc2lnaHQuYWRzcnZyLm9yZxoOVGhlIFRyYWRlIERlc2sgAyoIZHViMHJ5ZW0yCGR1YjByeWVtQO0BUh0lAABwQSgBOgd1bmtub3duQgd1bmtub3duUABgARgB

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 80E2 0
0 84ms
82ms Image
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CJ6_4gLasZIvICKKmoPwPhpK56AHFxcajXrjvq8ljwI23ARABIABg5QKCAR1jYS12aWRlby1wdWItOTM4NjQ4NzU0NTY3OTA3M8gBBeACAKgDAZgEAKoExgJP0H1IC4kptgyKOCEkK6MTAoOIsl_474lPZauqfMBvSv5WgTBn5wKP3rVoM8T6iDlnqLNk2A61KZC_tidb9mqAANuMYPaYvm48HjpzWcfYEjuTWadQrhgs19Yvwz8OEobNo-02nek6Hxko1E-c_i7XXUa3_YTrmss7w6Tmj85NS_bJsil37UAyJmuLEUsScI2RqYxYSHxHXPsK8cqsO-hLzGuOga7IA16IftQrcLeuUHAP-ELYnUxQ9H6BAdQXf7iUhnD_uT7RJe2a8tm0BfBOhjDmLOyWypaW1oCd10a0ZPRmIVM0IBSVNYVX5J39K_rbabdkMBIZyCboiAgkrQkHPCjQwrTvYOOVq7tkHjMMD-EIDEvvjM3w1_GFCLIXk1CwuA5sAIWXvOf0T_2iCcFTQcGhacxiaWi4ZoWKSumW9SwC7CSMmeAEAYAG59e-t4DvgOa5AaAGKqgHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTqACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItOTM4NjQ4NzU0NTY3OTA3MxiX0hM&sigh=pif8LV__6Q8&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&cid=CAQSPABpAlJW6zwODtDuGCo04AZchOW6GVnpqgXUunr8QpZv6GsWU2NeM_WeKQkRx4Ac8JoZX2qSnUOsweaRMBgB&vt=10&sdkv=h.3.580.0&vci=CkoIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKhQtNTA1ODY2NDQ2NzM5NjU4MDM3N0DbBgpeCAESEmluc2lnaHQuYWRzcnZyLm9yZxoOVGhlIFRyYWRlIERlc2sgAyoIZHViMHJ5ZW0yCGR1YjByeWVtQO0BUh0lAABwQSgBOgd1bmtub3duQgd1bmtub3duUABgARgB
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 200 get
choices.trustarc.com/ Frame 80E2 739 B
1 KB 201ms
62ms Image
image/png 108.139.29.51
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-full-tl.png
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-51.jfk50.r.cloudfront.net
Software: nginx /
Resource Hash: 3e736be7e34c844a2d363f75a932ad7f305fc65507c697f698fc4f080f47730b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: public
date: Tue, 13 Jun 2023 07:31:15 GMT
via: 1.1 ed016821a44f073856f1ffba399e1728.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: JFK50-P2
age: 2399039
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 739
x-amz-cf-id: LJsqQn0zp0Kv6A9d1xnf5k3TQt_afPRrFG4wHXEa6okz6Ja1on-Srg==
expires: Thu, 13 Jul 2023 07:31:15 GMT

GET
H2 200 v52afc6f149f6479b8c77fa569edb01181681764108816 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 05CD 19 KB
7 KB 188ms
116ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1---&pubcid=a878d8e0-8a80-4366-920e-95a5dee32438&publisherId=OZONENYP0001&siteId=1500000033&cb=1689040511067&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13a548e040a1ec08f77911fed1d559b95e5daae0ee227e632140e003c7268e7b

Request headers

Referer: https://elb.the-ozone-project.com/
Origin: https://elb.the-ozone-project.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
content-encoding: gzip
last-modified: Mon, 10 Jul 2023 23:05:42 GMT
server: cloudflare
etag: W/2023.4.2
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7e4d6c4fda0631d8-MIA

GET
H2

200

xuid
eb2.3lift.com/ Frame 5BE7
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
354 B

60ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&dongle=0cfd&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 251

GET
H2

200

ebda
eb2.3lift.com/ Frame 5BE7
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

59ms
58ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 5BE7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEERToPiRpXMdNF7MpxgcXgY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
354 B

67ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEERToPiRpXMdNF7MpxgcXgY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEERToPiRpXMdNF7MpxgcXgY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE7
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D

170 B
188 B

81ms
78ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 5BE7 0
142 B 119ms
109ms Image
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1804524819996289569111&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 09AE921F188B4059BCB4D68ACD2D8294 Ref B: MIAEDGE2921 Ref C: 2023-07-11T01:55:15Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYALGPsm0USAvRh6kuyZw==

GET
H2

200

xuid
eb2.3lift.com/ Frame 5BE7
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=1804524819996289569111&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=triplelift
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=triplelift
https://x.bidswitch.net/sync?dsp_id=70&user_id=4023335361986851824&ssp=triplelift
https://eb2.3lift.com/xuid?mid=2409&xuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
355 B

154ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: //eb2.3lift.com/xuid?mid=2409&xuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date: Tue, 11 Jul 2023 01:55:16 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 c.gif
c.bing.com/ Frame 5BE7 42 B
176 B 67ms
57ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1804524819996289569111&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
last-modified: Tue, 06 Jun 2023 17:31:18 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A1C721DDC63044E6A8CF4D0D434022B3 Ref B: MIA301000106029 Ref C: 2023-07-11T01:55:15Z
etag: "7cd81bb49c98d91:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame 5BE7
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1804524819996289569111?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-Gt8HA1NE2oQYHxdrePqDTzMm4e5oSsZQhgdtUd8h0w--~A&dongle=0883

37 B
354 B

66ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-Gt8HA1NE2oQYHxdrePqDTzMm4e5oSsZQhgdtUd8h0w--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-Gt8HA1NE2oQYHxdrePqDTzMm4e5oSsZQhgdtUd8h0w--~A&dongle=0883
content-length: 0

GET triplelift
b1sync.zemanta.com/usersync/ Frame 5BE7 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame 5BE7
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=6113698130532189562&dongle=4d58&gdpr=0&gdpr_consent=

37 B
354 B

89ms
83ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=6113698130532189562&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: ae8764ec-3c81-4000-9360-3ede9e3e1c26
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=6113698130532189562&dongle=4d58&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 334C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
354 B

60ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&dongle=0cfd&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 251

GET
H2

200

ebda
eb2.3lift.com/ Frame 334C
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

58ms
58ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 334C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEERToPiRpXMdNF7MpxgcXgY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
354 B

67ms
61ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEERToPiRpXMdNF7MpxgcXgY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEERToPiRpXMdNF7MpxgcXgY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 334C
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D

170 B
188 B

86ms
81ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 334C 0
142 B 85ms
77ms Image
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1804524819996289569111&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 48D4787C4CE04DB78980751BD4116A71 Ref B: MIAEDGE2921 Ref C: 2023-07-11T01:55:15Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYALGPsie7zUs+WLF3nZg==

GET
H2

200

xuid
eb2.3lift.com/ Frame 334C
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=1804524819996289569111&gdpr=0&gdpr_consent=
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=068e6941-089d-4d76-933f-775a5726f817&ssp=triplelift
https://eb2.3lift.com/xuid?mid=2409&xuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
354 B

80ms
61ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: //eb2.3lift.com/xuid?mid=2409&xuid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 c.gif
c.bing.com/ Frame 334C 42 B
176 B 64ms
56ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1804524819996289569111&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
last-modified: Tue, 06 Jun 2023 17:31:18 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4DFAF7FB1F3A426EA1E7C9E188AB3BA1 Ref B: MIA301000106029 Ref C: 2023-07-11T01:55:15Z
etag: "7cd81bb49c98d91:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame 334C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1804524819996289569111?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-Gt8HA1NE2oQYHxdrePqDTzMm4e5oSsZQhgdtUd8h0w--~A&dongle=0883

37 B
354 B

70ms
63ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-Gt8HA1NE2oQYHxdrePqDTzMm4e5oSsZQhgdtUd8h0w--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-Gt8HA1NE2oQYHxdrePqDTzMm4e5oSsZQhgdtUd8h0w--~A&dongle=0883
content-length: 0

GET triplelift
b1sync.zemanta.com/usersync/ Frame 334C 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame 334C
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=6113698130532189562&dongle=4d58&gdpr=0&gdpr_consent=

37 B
354 B

60ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=6113698130532189562&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: d08a0760-a097-4a2a-b1fb-e20cb12755c0
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=6113698130532189562&dongle=4d58&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ad-choises.png
publisher-assets.spot.im/yad/ 4 KB
5 KB 185ms
61ms Image
image/png 13.33.60.118
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://publisher-assets.spot.im/yad/ad-choises.png
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.60.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-60-118.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f27b4cdbd821100765224a52c7c8d544fa9fdd6d0aba21015eb66c11735e0989

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:11:31 GMT
via: 1.1 ffa37482155641d3f809e2a4a5572070.cloudfront.net (CloudFront)
last-modified: Mon, 02 Jul 2018 15:08:43 GMT
server: AmazonS3
x-amz-cf-pop: EWR52-C1
age: 31424
etag: "643378ef8a85df26380de21f9beb58ba"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 4550
x-amz-cf-id: 9Bf6QLigbyncOAhETMaifkgOZsOadSqnyNgACKa9rlbOOiA2pQRW3Q==

GET
H2 200 auction Show response
tlx.3lift.com/web/ Frame 4017 50 B
709 B 63ms
62ms Script
application/javascript 34.232.232.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/web/auction?inv_code=NYPost_Sidebar_native_header&referrer=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&rev=16f6bb0&fe=0&ft=1&cb=6533656502

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.232.232.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

d91047453bae5fa64041f6ace8fd51792d209b990681c480b2b4dd209830eeee

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
accept-ch: sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width
content-type: application/javascript; charset=utf-8
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate
content-length: 50
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 obVideo.js Show response
libs.outbrain.com/video/obVideo/current/ 120 KB
33 KB 64ms
63ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/obVideo.js?e=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0daa3af119e5e0ae8a5b1bae76794400cba230f970fdfd6fe3387b8b4f30ebd6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
content-encoding: gzip
last-modified: Mon, 10 Jul 2023 13:22:40 GMT
server: AkamaiNetStorage
etag: "3d3e06ff404967b63f32109f6b71aaf3:1688995760.83657"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 33223
expires: Tue, 11 Jul 2023 05:55:14 GMT

GET
H2 200 icon-vi.svg
widgets.outbrain.com/images/widgetIcons/ 229 B
534 B 73ms
72ms Image
image/svg+xml 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/icon-vi.svg
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3c1179965bbbc155a93a33852b756160ec48f09d26d41f96273d14f732fa74c8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-request-headers: X-OB-STG,X-OB-PRD
date: Tue, 11 Jul 2023 01:55:14 GMT
content-encoding: gzip
content-length: 182
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "91990280dce13a095a0da3a6b2fc6816:1673369403.63584"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
expires: Thu, 10 Aug 2023 01:55:14 GMT

GET
H2 200 ChevronRight.svg
widgets.outbrain.com/images/widgetIcons/ 524 B
857 B 75ms
74ms Image
image/svg+xml 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/ChevronRight.svg
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f8d6148b07b2251c53a2605a003b1d29babb8154c5abd0bde0f7e8a800f2dfd9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 10 Aug 2023 01:55:14 GMT
date: Tue, 11 Jul 2023 01:55:14 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "c1dc41410784b37a37e29a21baf9aa1f:1673369389.756676"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 524
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H2 200 icon-x-white.svg
widgets.outbrain.com/images/widgetIcons/ 559 B
892 B 75ms
75ms Image
image/svg+xml 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/icon-x-white.svg
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 06ffd9e17bd41822b9a7b982a8ff486fafa54f7781baacb6ef3507ae7f9b36b5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 10 Aug 2023 01:55:14 GMT
date: Tue, 11 Jul 2023 01:55:14 GMT
last-modified: Tue, 10 Jan 2023 16:40:08 GMT
server: AkamaiNetStorage
etag: "854eb39a3d94a8ec9977261db0c8acc8:1673369404.25082"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 559
access-control-request-headers: X-OB-STG,X-OB-PRD

GET
H/1.1 200
OK setuid
ib.adnxs.com/prebid/ Frame 3E5B 43 B
1 KB 238ms
101ms Image
image/gif 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=0&gdpr_consent=&uid=1804524819996289569111

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:14 GMT
AN-X-Request-Uuid: f2deabe1-0d3b-4a1a-8182-be1989d2d145
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK setuid
ib.adnxs.com/prebid/ Frame 3E5B 43 B
1 KB 227ms
91ms Image
image/gif 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=triplelift&gdpr=0&gdpr_consent=&uid=1804524819996289569111

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a184-24-36-23.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:14 GMT
AN-X-Request-Uuid: c7591ea3-3f86-4732-a2f2-2b95760ce8cf
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 3E5B
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://eb2.3lift.com/xuid?mid=3702&xuid=${ADELPHIC_CUID}&dongle=d54f&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3702&xuid=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a&dongle=d54f&gdpr=0&gdpr_consent=

37 B
354 B

61ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3702&xuid=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a&dongle=d54f&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=3702&xuid=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a&dongle=d54f&gdpr=0&gdpr_consent=
Date: Tue, 11 Jul 2023 01:55:15 GMT
Connection: keep-alive
X-CI-RTID: 895b7926-f883-494a-af6d-806edb24a063
Content-Length: 149
Content-Type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 3E5B
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=83&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&partner_url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3646%26xuid%3De804...
https://eb2.3lift.com/xuid?mid=3646&xuid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&dongle=1fa5&gdpr=0&gdpr_consent=

37 B
354 B

70ms
70ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3646&xuid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&dongle=1fa5&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://eb2.3lift.com/xuid?mid=3646&xuid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&dongle=1fa5&gdpr=0&gdpr_consent=
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

xuid
eb2.3lift.com/ Frame 3E5B
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74&dongle=4430

37 B
354 B

61ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74&dongle=4430
Date: Tue, 11 Jul 2023 01:55:15 GMT
Connection: keep-alive
Content-Length: 139
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 3E5B 43 B
168 B 118ms
58ms Image
image/gif 54.205.93.130
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=20&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.93.130 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-93-130.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame 3E5B 43 B
168 B 175ms
58ms Image
image/gif 54.205.93.130
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=114&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.93.130 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-93-130.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

xuid
eb2.3lift.com/ Frame 3E5B
Redirect Chain

https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=4771&xuid=6971283231311444352&dongle=d407&gdpr=0&gdpr_consent=

37 B
354 B

61ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=4771&xuid=6971283231311444352&dongle=d407&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://eb2.3lift.com/xuid?mid=4771&xuid=6971283231311444352&dongle=d407&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1 200
OK 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame 3E5B 0
0 72ms
70ms Image
text/html 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=1804524819996289569111
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame 3E5B
Redirect Chain

https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=7255&xuid=AADg507JWW0AACFXxNbRlQ&dongle=bzwx&gdpr=0

37 B
354 B

61ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7255&xuid=AADg507JWW0AACFXxNbRlQ&dongle=bzwx&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://eb2.3lift.com/xuid?mid=7255&xuid=AADg507JWW0AACFXxNbRlQ&dongle=bzwx&gdpr=0
Date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK setuid
prebid-server.rubiconproject.com/ Frame 3E5B 0
756 B 62ms
60ms Image
text/html 69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&account=&f=b&uid=1804524819996289569111
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1---%26gpp%3D%26gpp_sid%3D%26account%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 1533 34 KB
10 KB 194ms
74ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: feeb98f30c6b03b47d474792b88ea05241e469d24f193cafa3927310602ce670

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:14 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9480
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

GET
H2

200

hash.gif
pix.cdnwidget.com/
Redirect Chain

https://pix.cdnwidget.com/redirect?CID=2SPFsFGMIvuTMGESX2WH4rkTrDM&DID=2SPFsIJ3w66yRNmAql0OJy24447&v=&iv=&deviceid=9063269601338811776&visitid=1689040511933162&wsid=2045&apikey=2^HIykD
https://pippio.com/api/sync?pid=5749
https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none

68 B
635 B

74ms
74ms

Image
image/png

34.149.254.212
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 34.149.254.212 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 212.254.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

date: Tue, 11 Jul 2023 01:55:15 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pix.cdnwidget.com/hash.gif?md5=none&sha1=none&sha256=none
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 202 graph
idr.cdnwidget.com/ 0
100 B 156ms
69ms Image
text/plain 34.149.130.207
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idr.cdnwidget.com/graph?cookieID=2SPFsFGMIvuTMGESX2WH4rkTrDM&deviceID=2SPFsIJ3w66yRNmAql0OJy24447&bxdid=9063269601338811776&bxvid=1689040511933162&bxwid=2045&gm=false&apikey=2^HIykD&loadID=Ga4BFh123Rf4kNT
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.130.207 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 207.130.149.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:14 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 id_sync
events.bouncex.net/track.gif/ 42 B
279 B 166ms
60ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/id_sync?id_sync:id_type=sid&id_sync:id_source=graph&soft_id=2SPFsIJ3w66yRNmAql0OJy24447&source=web&agent=cjs&deviceid=9063269601338811776&visitid=1689040511933162&websiteid=2045&pageviewid=undefined&sequenceid=undefined
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

POST
H2 200 pixels
pix.spot.im/api/v1/ 0
229 B 277ms
132ms Ping
application/json 108.138.128.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.spot.im/api/v1/pixels
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/386-bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-41.jfk50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
via: 1.1 e23983892b1c8fb4d47f943c0ee29028.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
content-length: 0
x-amz-cf-id: r7WVk_21iXNDHybGvajQn5T5Xd0KbCSas7CP2d6pUrt8_pG7yNcj5g==

GET
H2 200 log
hblg.media.net/ 35 B
191 B 61ms
52ms Image
image/gif 184.24.36.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfk&evtid=sre_events&itype=RTD&abte=CONTROL&adt=desktop&cid=8CU3I8M1G&ct=MIAMI&cc=US&ugd=4&pht=6742&pid=&dn=nypost.com&servname=ssp-serving-d65dffd54-4qxd2&svr=0607_323&sc=FL&version=4&vh=1200&vw=1600&vsid=&vid=00001689040508074006462152424804&requrl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&kwrf=&winner=None&isEmpty=true&size=&dfpAdPath=%2F5850%2Fpost.desktop%2Fcustom%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-custom&slotType=DFP&supcrid=&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=0&winner=None&isEmpty=true&size=&dfpAdPath=%2F5850%2Fpost.desktop%2Fskin%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-skin&slotType=DFP&supcrid=&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=0&winner=None&isEmpty=true&size=&dfpAdPath=%2F5850%2Fpost.desktop%2Foverlay_fullpage%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-overlay_fullpage&slotType=DFP&supcrid=&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=0&winner=DFP&isEmpty=false&size=300x250&dfpAdPath=%2F5850%2Fpost.desktop%2Frec_atf%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-rec_atf&slotType=Prebid&supcrid=div-gpt-ad-rec_atf&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=2597401903&winner=DFP&isEmpty=false&size=970x250&dfpAdPath=%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-billb_atf&slotType=Prebid&supcrid=div-gpt-ad-billb_atf&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=2597401903&winner=DFP&isEmpty=false&size=300x250&dfpAdPath=%2F5850%2Fpost.desktop%2Frec_btf%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-rec_btf&slotType=Prebid&supcrid=div-gpt-ad-rec_btf&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=2597401903&winner=DFP&isEmpty=false&size=300x250&dfpAdPath=%2F5850%2Fpost.desktop%2Frec_widget%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-rec_widget&slotType=Prebid&supcrid=div-gpt-ad-rec_widget&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=2597401903&winner=DFP&isEmpty=false&size=1x7&dfpAdPath=%2F5850%2Fpost.desktop%2Finline%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-inline&slotType=DFP&supcrid=&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=3124739515&winner=DFP&isEmpty=false&size=1x6&dfpAdPath=%2F5850%2Fpost.desktop%2Fnative%2Fbusiness%2Fstories&dfpDiv=div-gpt-ad-native&slotType=DFP&supcrid=&adid=&acid=&pvnm=&dfpbd=&ogbdp=&curr=&bidId=&mnrf=0&mnrfc=0&bdp=&icurr=&dfpcmpId=2709739563

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.24.36.23 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Tue, 11 Jul 2023 01:55:14 GMT

GET
H3 200 loader.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 8B48 54 KB
19 KB 66ms
66ms Script
text/javascript 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/loader.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

301be161c64c9ad9f2cf1f1fab77f831fcabefb00fd3cc9a0b1e68a0c77ab625

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 472
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19742
x-xss-protection: 0
last-modified: Mon, 10 Jul 2023 15:44:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=900
accept-ranges: bytes
expires: Tue, 11 Jul 2023 02:02:22 GMT

GET
H2 204 ping.gif
prd.jwpltx.com/v1/clienta/ 0
83 B 60ms
59ms Image
text/plain 2a04:4e42:600::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/clienta/ping.gif?h=690432868&e=al&n=4633486702058032&abc=1&abt=128_sendDomainToFeedsOn&aid=wExvYnLyEeyygEIIgluVXw&amp=0&ask=FTyzwZMf&at=1&c=1&ccp=0&cp=0&d=1&eb=0&ed=6&emi=j5ldbh1ywjmc&i=0&id=ZOo6mQs1&lid=2e1ah1ivli3c&lsa=read&mt=1&pbd=1&pbr=1&pgi=1omq2z11u15w&ph=1&pid=SPdDOYds&pii=0&pl=413&plc=1&pli=1nf5cfw89rzh&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&pu=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&pv=8.27.1&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Today%27s%20Business%20Headlines%3A%207%2F10%2F23&tv=3.42.2&vb=1&vi=0.77&vl=90&wd=734&ab=1&abid=1i6y1cmyi8h5&adi=1i6y1cmyi8h5&apid=1i6y1cmyi8h5&awi=1&awc=1&p=0&pc=0&pi=0&pr=2&vu=securepubads.g.doubleclick.net&sa=1689040514770
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by: cache-mia-kmia1760077-MIA
date: Tue, 11 Jul 2023 01:55:14 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-cache: MISS
x-cache-hits: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8F9D 624 B
242 B 89ms
88ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMOQi-QBMAE&v=APEucNVLbmeihUK8EUhurFJtqoAcgwqA-mMTidb4zy2nj9FMlZKWc1HFZJZDeKWKY5R7zXH77R6DIgMttv8FoajI60hCf7jMYg

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B752 0
20 B 89ms
89ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9145283988236&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B752 0
20 B 89ms
89ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9145283988236&version=m202301230201&ct=76&x=1&cor=11816118676252174000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B752 98 KB
40 KB 137ms
136ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B9dFcAm21ths-Ttx7cqDwj4DFxcZPH9KKKNSreUcQjOaSype8o1MG35QIup5V4swd4bWCdQeApRoMjIlasOzFtuXeF8x6xfzW3W-WelWbCUwXf548&cry=1&dbm_d=AKAmf-AKacKJmUP_v3xdeB98vEdsM8DGmpa6zGTFmHGr29oCF70lartjSh3c0GU4z36nkkI7Q5vIub2iAlJ0i1ScuOedRdCBjreTyzXxBv8M8BAmj7nSJXkPuLnCy0PSNODod8aENZLePJZN10LpqbrdNNEACe1zxreSXDiwWqyr21FBU1t-R2FaXZyZB1u4dY9fvAkRNqMXN_dQjBSJduBLkwSJVVJ5mbrHfaHH-YKtDW4Jj8jMp4KAQCLyGztPZnJmLvMBSaWyPoaa3qDNR15BksrlczUet21xvLJvZ5dw9R00JAd3ZLVvpHGZsxQIpS36IMQXPlSOjw1aaRkyUvXBzajl9B27uJ842GW4FIgZBJBbonp-pAV89GX3CM_BCP0eiqq47pJDACbAklFqjMOMjcSCA9uKR2BAuuwGLWwUZOuvuJcJsVUgMPDps_s1xx_KLi2Bfu7miDGZeQk3tR7PVyYjpHAT0cjStLpqWBtVXUvrbUcNz9AIbJbd0VXoLFIigTw40_1lK-sl-4TM8OtQmP5WnqYRLKhkMVZVycym5MGCjgMTGBtmSkeviVZKv3equQkiNR6KbD5k-aDKkO3yHBZRg2rd0Qok79ccQkp4tZHS6FjUySOmExLAMHO35dSwu6N8-zG9NF6zrK0-4FvIP2CLoAIaVr2ODbB0FCIePBr_HwKAfMHwIdRauMISi_APzqrpnLOX_XiSXgIKF4t1UcQshtmzD_LBFrY8eHNY68JDb9oL6y2wqAHEgL7Hez4NT3VCwvUvYo6j0dxKs0czAOlMttmHIFovlJ_BiyMDTL-cPn--uPe1xRLpMPLYhZfmtgq3sUDz4V5t1cU1mPOWTyGEI65wlFBOhkddIIZ0I4amb20a-oE9ebdgIuLTtsE6Pn0RrwZc1D1GO0s30Vc-WFQFqc9hmpGfLuhxRFzRPZ5tBqNxiy9Y4Inkxc7-SXikesAAid1448Qao9axq74ky-wqYw1rI4x6sz_jHf72pmJLYtBiLr-EtpQ8H7EzG9g52y58PAIt4P7Md3AMAGXdINi2tzM1xYPfpN3zbsB6WzcA_HtEpRKCeJqIinDgUZ8aKP0CZj1np21lGdbho2O00Z_9h_Ym-FHhwFiidlavRaSVjwmVNEYRWZA-BS-mYcJVIL6NkH2PDGzh_8KaGKeC_4pA6yjBm1pVq9DRCxFHXWT7vBTY7OFRuwpvdAp8pfTFqJNzmSrKJla-pxc9BFLv6Lzw7owUkBtKKVj6Hc6QMYmf440iAuUd5j_3IWZBudagLMvNffdz0YhgyMnlOvMIf_lIyp77iRhqUPBOG-KPMtswa9RooS5N5Ua3UZeqgC1OS-8WY7PR6XFXWTC01HlRGxWRiXmbIjN1lUI64moXPzFBOwrdOyyehSDvhIXWcm2fKbt1fP5LnOMmpgaryAkmbtLttVD8alDuwa6aEiilkwPxba39sv48oZ8G5F7vsNgyaBQnSCDkOhdJxfjXY4pqKZsw8iglQeNIvKHvsQjN6PTHFvtQOzaoTS5l1y5bL_9DYdBi1q0gmHc6pwOpiMzTIu8MxhznKMpCLBJ3FzEmfUgsJ5bbLKjFVvNvjkDbHRMlsu9EkVxC0rMd2iVQfeO-dTxeg7s9cL_k8g0ssVPVan4izAmnbP6ZYyG0UY57HhkqKXSCgbQlwUe4V7e1_IeKKHdXX8GW39YNjPpmvewk4weX-KrkRvYfABBqxnD2n5cq4000b3SYTBE1vB9t4RrM_dh-hXzdPZL7fSEVis6T8hNhyDMFHL84Vf4okQ3a0bpUeCYIUpHChZjC-DgGjjOgFhKJspheFZH9ZcfbOVRceu7PMhPPc-TvqVykOKxmsoKkeWqI488FmGh_uSeobVKlDWSOh098DENi42ff8wKOPOkTMYZgpjirGHIqwluS3WCG5_I9gETnK-p6B0d3w5XUvU6224fI1dnjamsIeYSDb0_9xC7SCOjdifpV_nFI8lH7s2dzhiRb7ctyiiHXlse5T2oaf5-EyaTrWDffBWbHCw9NCLMYpkbOlnIS-TmV7zzHmZLHD6Y7aamUSwRcnp1V24l6qnGdkZsYcsS9YZncfnbePl1zErgdHQgDuKZt06BWRhEESMIeW4KepEPJauqvS_hSnPJBQsTe_6gXRaAVPdAty18IoY4ALgmu0Aa8VHAu39wDTdUMweyTrMh34Mn2WeEwFaZuyYodx6OK1rFQdmzIh3lp7ZlgzeTGEAmMWMFj91nlpXJZiY9lRYbw_btnLMCkSv0riRspTVqOcTUTFORi4yHHcDEjLzJZnGefFthNIo1BeNVfA9jWDtioNsOt3N2g6bY1sECEhuoUytFL1i9i54IPUsgdFpGdHS7YLrwdU9PW-Rve0Aq6ZWmRsz86tN4KdpDmXJJtHmXndR6GgSWnvXBBAOWLZXCMfcYeA6VX99knaBMLzYUl1kudylaiG3uaIOmF9L3YoX8pVVR1zgzFI5aSAORv46phzTPZ4XgNhiGN_7CBz6bZ7-KrZHL3niY9RBQgk2oGGSolI5Euxx3bWHaqau7yzkuP6jDVAvjiv68MFAvC_FVs9KTCR9RkVhO3OgUfINVDgHUgGjLesWLGkm22WGY9lzCkkkDKG7YiPhoYj49elChRBH-pN12ng1xxBS0w9FKsGvsWQwyZbGHhpeIFk_E5JUS8s_-Y7zuIePijoPg2TpSE4Xy-X4F3CzHyxXVlX3gKCKeuhhyPtNeLfn9O-mGyEoVlTJ-UL02cClRVYELdyZPuTd_9azns4lRm4kvdEZSIQCCksyriFtWYj4dDejXPOe1EKJ_lE6tsYeeNLqh2RocKJ1AIS5vOR3DQVgr5ZP7NY_AE99Un3ZtVAo69Y8XWeXi-hMFW2mW_W5yGrSUvBoqeTIOIJ33vu557ulyzIxOfuurclEMyxIY5xiaOmSAI82cMKgrFafjtVWto0Xbrlw0ij2AUkgVkc2Oxd-x9M2GNVJ4Y3eNTgAPmMHLj8RITd-7YXOuJcu3w8WPLur_JjmhJ5_ktdfxSTl0ltwetH78uVZL22bYUCWt9MT_5GvVUTGk5qu_XvbO8WYjG6tOpN5BU3YOb-Ex1R0tBUipD7oKebl5bMvfMc7lk9cXPvPs6YLjlk9KRLYMzQtnlwaS20EKzQbes65Yb74tqUrPFEC0MZ89UUT3-RaPhjWf9QpIlQYHNKfIS6A_2_P4rdJzniONb8HBrIU8y979novTuFSq-a_1t0GSzwz6RniqtkCIj4UiL1KyCi7wzHLmOWYCZ_ITzvnRb4onXYWP9DU0V9kBSeA1SN23ygYtOV6sWdGkpXePg5_QxoVLeZf_uW5d9RsGhvIpA-OFx5fRZAluuEfz4VtiQAAGNGcSrXvaOqrv1Q6SHhb3eL9EC5EbDGsOXJaoHFm_pMXq_9NUCG4KgmPGJbSpkXZ1P2L3lYJ0AV1DusV8Nrh5WjCqNJAbPLov7BqUHSirOwyK1zjpDWWo3uc3TqDP0fZx0Q2n5LNdyiolHJInzjhhak-wdK-kjAbqWwiO1m3NZx8iiFOHtjW5gXh8sVyrBJTuv6kOiVjHA2PfmimVErFs5yQmT0cUR5WB2psw_XdwAc27ktjPxX-G5c0E6ajH9n0aBTrc2EoHtvUnF85nbjBqBtN38RMFUmVgxsBr5chXyoQvPGaB77R9Orw1LbyR3xZbr9ThJ4TPAmIdq2bcgIUDefkiGv5qg86aGFRl2ypclP8vJd_7JGdXgIrhZ27yMagI9_InBNlRosx79-q6zZBv3op-izjpjqWhjSkBWDp0a_IyyAKFOjJLcJh26PzxROlNKnq_lFsmz_wgToTAccltTGUl8ZkXoY6vVMDxT1cNmacADwPlEmdmqCGmjcqVIBipdHgoJGFPvL-dxmDHpAcCtkt2e2xPy51AmAJiUH9vmT9a9M6faX6eKRIU7A8WuFdxYdiIkAfDLq2ra7BQWsRKXCcvwtqJkxu6evE_O0H5NTnBQsaY0wblsEkNE_qscaDcBSMGXKjDDvQHOffzPqpRGRnB1-GXSqJ7tn0zGLpwmcJkCdfCCYds_1Gk_0MlCekcgMO2NFuU2pvXKQUYop5CZlQJFW5wRUZIlubDfVM0NrkFPnoOarPDqYFkHfAA1T_PAdKN-F9JW6pHkwrQNbO0fJvLUFOm6_DgpTHE8WpO6DhyjhIM8_qMB2aE-lV2W448CHmYuWF8BnS7DbmlUcBHt_I-f7KrqGGznF5fS0pejZJDUGowwbslxxvsXjLfHak-_z1TDx7T7jRcFwPlA4t78Z5fygYgQoOyqKXQHooiSv8XULw5obfd6_cEQCP8UDnt2f-mrr1lCxFDQ709JVMOOwDC3cada_hRRt95SDssTayuWrpYG3I2ZyKqXFwFdUIgu8-mAA84ZG1rnVs3UeLgzgT-U5ybIwydp8a0JHeEWKCmOj3L0c7jZ5kneq_G9qiQXnC7vyR-itdInpGHQzr7jX9FOZEWe3fPKfa3shZ22PDrF2o5a1JKMhbYhypDJuDvneUpDb4KAAjbvY2IZB-p0w8owI8gAc7HHCtldFQtRh8rROT79qP-Xvjq3oAFeRNYCmC01oscEx_IoJuETjPJCYCMjQCBMCqtnQnwAK-DIap0g8LwWCmwgp4uvXIsK4KD_Mwhnd9j2MRYaCkcBxAKsPhI2BRM1frI0Qxe2jF4vYawjWp7nAorcKgfVba6E9NaChHyraToB3qpFAUO3bhKxH7wVnhvf1ORS0cAWowX85lm_oVZK1Rvf6k0AnNeWAwUZO5gtskaHH2Allo-W-OA4xy9Cmpp8bzHbxryLdJc7TFcn3R0NKeEA-lB8pyGIwXdUGZaqXqVyTTcq1QOQbjOLQlxGfc7KfvyYOHgc0DOI0glZrKhBMQ1FQo54oyoPuGJCx8xdGEHlG1boaMjDkctML3fBG20f1u_BbjWlUoeWRkirxSkhy4XeL0z9ftB0ZqpPERQ92YCDhRI&cid=CAQSTgBpAlJWctwOGy4ydZ_lLKmSAlvnnRVat0eYnt4dNRmMYMGNLUiqjbEmr1kC_gqY8v_LesBW3oXzhkWrM9LBgEDE1oggqJNhQRm0efUv3xgB&xfc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvjqoS4HiVq2Xdd7nPtYJMudJoduZ8W4UfAW_o24Cir_Ub2z2HJNjI3LX9wRkDKwB3gZNqbvJiEzmgQDNCx5vTbQjMXgZnXzRfvYyP43N8q7cXDZNAwMIaWdBh12spWXR0dKLZqq5kzHGeZPxCe5drOCDWA9ghDGamAa66-eDE5uWmB0jKRQZvda7E5TcOm-NU3B1lygAiWANRCDxO3sh47QxIrIRMz2dWmAhzAXd5cr9Ks-9L7aJIkrpoSXqPGd9VLT_vUMEaVVCbooDqkBpOBlRDy_0sVibjkfgviucggXt5GDq1IqD_UkzdxXaxHH1QeVWos0V3zLQtLkDxukDavfh8JiCsxujxV%26sai%3DAMfl-YQhLOtTTcIhYgKjLWSYFU2ke2HCQCbQhnVEr2ck7uV_Voe_Q6_haVwWeF2R3Jvm29M0U8scf11J3yrzErnWC2V8LXwyy8vClCcdhDPDJNOd32Mek6byv7xZcLPrEB3HETEKJg0EGLrd5kUd4p3CQvs%26sig%3DCg0ArKJSzJJzpCKH0hoyEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&dv3_ver=m202301230201&rfl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ds=l&xdt=1&iif=1&cor=11816118676252174000&adk=238596429&idt=141&cac=0&dtd=213

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a38797bb993c4b2b6ef65d841bd011f50e4c662f1ee3a813d0cfc2ff46b53b95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40592
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BDDA 640 B
262 B 92ms
91ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMSVi-QBMAE&v=APEucNWamYOVobN0LcIXrJM8dJwoEF9Nhs9wgf-MAl2UqMLP4wc1xXru4QyjBZHBOv9xTWsjTM5MOiXVmOsi8C10R366J-tIGw

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 94DA 0
20 B 90ms
89ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3145518954767&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 94DA 0
20 B 89ms
89ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3145518954767&version=m202301230201&ct=76&x=1&cor=11022811550157523000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 94DA 98 KB
40 KB 147ms
147ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DiNRGAUcUFMEL41mkYthfezpdqIGntMiyMuiVZ_u-nIi4M3pJ27xDT2N2I5K0uIwCJNHFwN8w33k1PrtC2ly67JVqmtgTWte7Hy-hX5p04Bsky908&cry=1&dbm_d=AKAmf-AAPUYK1BVE9G8fGKVfMmklSxGgtAlt1Ho7R15NeeS13Xrzge8Or0ehvmT9_p9Dccu_NuslEnXsQWBJSycQ6une8TJDy7kPLWLo6ldJ8nJ1G4ZPtpmk8dSAY14ziYw1geu5io5DLqzZhmQcnC3PhYhTwndZSZmZoxmok6O4wrsbzNMS4Ddijg5SngcSKqGxb7y6WVjc73gLJmjRlSIhxK5MJxQiJoaEombPBd8EXjtR838tOQrm2SGMW354xD-ZRR3F4n8j23mgFNOlQekw4Ku5tLMJiGVaAV6QxUy1sCzRNlwEObRc7R6X5YkGFZfM5eZUkum0AxMF7Fg7uWIrXgHNiW_XwWtzTEcZjercjNyxeWLeOPCTSRTApCO1zasJEsYQtcqMGTZW120OkRy_BR0pmvRviwh3BWVQgajb9ishFB64cMj8d4eWn7_5VYPvBTS-TBlGaSbYz_L8Mav5uWG0mTCO76ZSV0-RA16VE9tSmE8KbymR4x037StBsrtwisOK86L_4yqsn30GxGv1mvtcpDndBu87q4wleNNOrqiPrtemGQHeBzjW33n2rkEnGC4C-IVG5em81PbstClrW0QwWK09VBpDO4Bejq6NYJl0N0HD72oWdn7nF7I5Tc80sCIBlTse_4Abl5fza6oyW93-qpaWwTW_IH132QdoTuuRQwRP5EGpEdHbT0RVa-Fke52igMlCM-h6dQ7lVkas1m4IhREF7qGq8zI-yQblcYulS6ER9R7SsPVJQy3uuLgjyMnwkxHeKj_AbmlaMDqUKRdxhYOMGBqDo_HM-FdLAUXrcN2sdu0-3fRKB35tLSu5ZjlaAX9pKp1xw3fvO6cEoHSRMNsE9OrYX6nRlCPT4rpToPw5HVRTVVoeoY8BSHfsqBt0eIxo9WaqJiV-Qag7lfI2UcoXH-1FLqPmt-iS9CY3lnIivJwE5tDjXD0JubzvxUYapz2Rb9yykZVa3RAnsksjEme2PR7tzLI0Ak0ruBzfeEnGeFHu2Wp-g9STvdqpjoYhNR9iLNNee0hNK8vgvMuvx34xb4-yZV4oA3flA0-DNvTiQSi4l5XOFXX6dU7TMI5-QR-68_PIDX_H9QPW_twsHCjEf6I5lxlbskCTmfHxCOtqZkq0ZsHGapeWPbw7SVuGRQOAhw4CH1u8gqh-QiPptzvlOqUVsd8l6nyA9Z4Gz_GpqZo7CM-BDn9uiBGACByvhIz4ZVa_1_0wS-s-E_x7yG2ATkjTFu5sL7Nb411INTCX_un7FSZQijjLLLzSAzfoPSE2kd8LY8oyAc5gk7NxVGX5mc0HerRf8HIRBD0TGgGU5EbJ3qEmoLUZXrQYjfQfdhll5_m83pOpjnACn0ZX6jNerEsXdAbikEC3NBrFkFIRyktAvmEaN7umDIerXGkDoip4rtoofZZpHHbPY0-4J_AGQwGk3MPqr5ZCB1t6VD0uT9Q0M5owgV-_1yQabyqFxhr2N7h4Dd2EeDiGr5ZGEW5I714YyXYROIBY1guB9aCm4Spex-p9_Dk65HvzdjiPsLQorqxviGFu-J9YuU_eEAoCBQlEHu4tfZOWqNLwIZZkoTpd2iAfekda9Ovq8I88h5iQrzbD4Pj6_tgdtAzqszac2-Zxc8VUgfn4fDEiKiy4F7zx7t2hl37IbGt-QmOoN1NldZWPctFZUxxdl_QdYWyBkcqzttHHGOU2El8dEZtCE23vFCXAThDoG3pyxTQ39DWv-Ag3HZx9THiTwv7sskcW-6wQwWMK30lK1TFaSg5gAeXFqrCdyCW8_m9bGL5TJUKfofZUH9iOOSU-MRlMTIw6JsExMa5SZZRAIpSKQQQTUkB5-EzY1yFnajYpJPYQpV6RJmOgDscfSt9s6Tl2gnIpfiDULJhLyBXIGrtv4TEqjyx6Ge2fQbJLXkywvmOiQI3O1yEcaxLEYZLVXNYZGz51JwhEtyjPPsYWwpzTd7tAkCng4gxg4eLvdVLcEY5TtyirfJruh3MqAwmF03gcuMwncAoSdRto1ADSUs_t68Q3pZZ8MipnOdHpKg_2IukdO55zoveiLc9lvOIGXZNRr7EJL8GlHo2MJP_UAtgBOnxnifowaBabVbPnBzQQuza1U8BZ-XUqBG4MKtpeISqCPvakRtx-LA_LN1Wck9CoWltsGW2iMYSfXLFoGU0hiR3czX1m7sQrvAXCpEPLlr9RCh7XKIO4q-NpgW-IvVqxCvU6dZgskZ8CNYdDkI9-R1DmOu3bRdbcE6ftHgBmHqk2dSFjWE-7uu0cG7ypC0NH6Wdg5xdJJz2Hbcj4tSIFnl7TiYhbWmpTX5NWBPrv6ZvM3aERuTeFx-krdD76DDYCAGBePMLguU9MnXsqWgG-Y7yN0TKmRAlhjFGRwmC6HAnuUcrAaouTC8cX3skD-PbHAMa_QRrMdVzBBFHlhu5JCNDEzmYHtp17UW7uLgYZUL0Qn91YRaN51hswBUBaTYboWbevrr7-QmxVYoWTZek3Id0tCLjvCMWHEwhzUQLEPO6rSAH6zwT1pe8JKVwizYtlQYoHScLV9cy4v3AXq_-fjLeu3IdDYpxnaCVENVsvo_6SttpkwtUEnGvH_i8gfTPa7P2OkkBv1Cjial3z2ZwADl2NYAd4Yl9PcZpM0Eq95iYCjEiLO2z_lMMQ1UC9wo43KOICWthfYYqc8UBeT15a7vzGLn0mXogOJ1vY-cZskKd2eqYFJB1hwgTQouJeBcheZ157k_LMGmh_lHzydcrnIp_Fwu4Fdwu2CvVH49PPwAcBCKQBJ9Rg00aeuvfFU6Buz9YU4yyzd6QW1Nc8JedFHRbUwT_ebGrFcMaueEZZGkeF_glbH-__JIGKbvxPJKBO_XG95yEJmCvx9XLjTEYJNu_O4ON-w-ZodYN016byQU3j4sdz5yeZZtiY48vb_4LAhgSF0G-p5aWl3jJe-vBtO__QCVNiKfMAau5mOk5LImlPaJG2X1CkSUFIPcK8DLsVt5fPa8FdwIlZgK4xGvBSRkgsdVmVO_8vr8UZuPK9T1qSMcc-nFs750GiugU0n97-FG1r46MZF_faab_4GN2fIgk6jjnO_F26bsAPaHHpD_VkwkVkY9nVGOyPwgP-tYHGqunTDKPHOvGQPpllzsOGmfMq8BQnnIFVHwac40sLVW8P5AFBg83Zml8NCshwTqup8lMYYX5pzfbj8-UvtQRn8OV8ZKMoX-50exa6EVxuaNah6ZKAglEDBMhpxnnpbdTDg2xY1xVUG34ffXl_c2xiwv_OSj-RXrr5XlWowIv1sf4XVR6C-H9_UW1liGZAgpzT5Xfx33Plt6Js2V5amKAWs5PrY7tBsY55IqkBrAdBCl5owOZFATnjCgmtV6gQj-LteSi9At2wyWzjC69gKUbF0PwbgeA-A65r6WcmUCdn6Zr6e7mZAI0aDCIzvVZHRxmvFDIArq9PcVMKRpf8l8EBEZ3mpMnXi-vcd9loPeBmYsnwvxd86aECbJFr0ghPURRa9nbPWMK9bX79DW7Q3pLr6FLbUo8uRw5IX0OPnYs0YUP-Q_rM7KkzogREt7kHTAOKzhQavgrrss0FBZY9VZ2_e1KjiK-hb4L9LTKihJBQDNohj4h0UqNpYur1AT1_vGybwDwX8kmKVebonQbdkOJwOvBmh58e9RHpuywYrLn16LNAXXxO3aZ3NfRjSljXlRI_4kO4DILIg83H_r2R8PtDMuhdS3odpLIzkPzOqugK9eQt98oM56B5YrhBqEM058CptC3sPJ8HDW3Qr_B_0jo21XEDYyqELqksWeFmMjLTn6AJRhnAYh7eYV_72f2YzYy0IYa3EPMI_tp6IzzoeZCLDjfNCHDIUhModKS2NUThzmYUAdQVda21PGbeKaJ2xKySkGoSa6v3Vq51h0biF9-1EIletyLbVrrs5T0neSlcIJPLh2-1UtznavPmq6FpXopi1CWkAvIzKRpHyUlaDmqwyLklH_wNsWAU5Hrq7ye_n1taJjOIo0ZvAiEmu_FEVBJSJu7dW1vftYZzU3ZqcAlUBsoTNh-DpkzGC-ny1cEIf3ON3__KsoMkF4IXP_7DqpPcvmjdjAzZUObtfK48LTVr0tNsjzxxruVp3ZfShS4ivr4NjjtYpGJGvWn1DRFhyRlYlsopwDBay52-AJHtlgjMzNIk_CTriew0UZRSxgaTctCY2K3rXMbmRR420WmAi49HqLbb7XQ9gv_8TrSu4b9w2IxvwL38UMJ_2up73_6KZk8iK88StvVGcbjAcAvJVxJ4I8AOLPhYw-KbgT22Xhk1ThBKZ0IKMIHLhmj8asVvC05WpGjANC77pfUZygGJwE_RE_CL9nJsTuQ0M5tRVaHip-n64Qf1l6pxtFQDK1WT5vDcvfiXU03iz3daNcIuDmTxHfS8OxcDhUUQ5cdXTqcm7YaJ1AHajojC9Xi4qG4SXVet02SLd-tjfMd78ON9bEx1bZSdwEkwWmJvQ_XtrPegH7ao37j5VHhexuNsm8oURQ8KXULdSKip9hoWqtZ3jQ1vW7NdqRNh1OrvXzGZVtJJCC0AnwrdoD7m9AzQh0bmM8MG5mPDPmSPS6fg7qa6QYebinVKJ8GoZgcrS8Hx_xgx-lxzuaVx102BZkq-3ERHbMAjWu9kB6WVtrxrfUzhlQLelazsvWTG557VtZZP1ekxPhkKr2aZevnsL332itNkpVCKb6hL3LCWO9BJSgDOEW_SDLg_tA61S4g6TQVKIff5PF0oBdmMi60yYZOsMlcr0ZYRLSEyiwXdnwsftNf6Wsvlko_2as0kad8srC8Asbjc_sR7Z4RHfgnuBb5vppV9PQtLO-9yV1nO7LT5G46MckWoulvJLyvkFZMS666KxWNdRKG4Bc1yJTPzALSMccG3oWRUvEOE7JAxGR3p1aPeSZaBhbHHvdgeDL8TUS05v8EJBDB0nQuv9DLJpyF9jJQNb06FA4ZvRpzrb5q6Tp50co3-XYbg4AiMCRQDopKny1ZhJN5lOSozJEc-2wbLcRfPSrIP1B0zu6PMcoPU1D0v1RJlU1aR0UwebM3rttoWojSznDtV9BhXr5R1uUUGEt5tNG1-GUDmridxmQaRuGisZyQrdO89gBI&cid=CAQSTgBpAlJWctwOGy4ydZ_lLKmSAlvnnRVat0eYnt4dNRmMYMGNLUiqjbEmr1kC_gqY8v_LesBW3oXzhkWrM9LBgEDE1oggqJNhQRm0efUv3xgB&xfc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstCIcOHWyFqu2EE5clwWkgTiqwtu8ofx_SAey2gR55XNVIx9QtkN8VmtQndsUWSJllwajxVzNKgDmIfJWyWEhYBIm-WrXf9dqSpmhcYEVx4hTedNybMRMICRkOfj3hGEBP0kJi8MJC0g3_hCcBj672ABptpe-T51eIc-HoY3riGqzTYeKJeXsLxhXFuhfy8xYwmNt2SjCW0LGp95PJ3Iw9LxmJDAU-4_NTkaOSn3AlaZooe1X-G2HYnjq8ULMu4zLXbDn9B9mOz9bZq9tH8wlYSjIrq6zfzpDy_eeFSgaHsZhdkQGOkCMV6aSqQs7oxdkBKH6sBBD7wCWIi5S_5ZWY2oz5_5-Hm_Dbj9d8%26sai%3DAMfl-YSGuJqwc6uwK-CPvAAUjsNrndRE2r7gmhEFXLeWn9pg2CRjViu-1l5p4Z6fZZf0K01k69JXm_HDqP4vR0UX3zJwiN_6GaCtKU5kW3vgB9b9eTw1VKalyByzy-nMRml-b75W7ECU_XVA0nn42GjOIUQ%26sig%3DCg0ArKJSzDmPJl-ak4SnEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&dv3_ver=m202301230201&rfl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ds=l&xdt=1&iif=1&cor=11022811550157523000&adk=3564403988&idt=225&cac=0&dtd=38

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3bd858f21f1aead3a4eca9608f4eb68306a82ba4d88a6e1f1c8aaec88bf0517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40638
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4B65 482 B
213 B 92ms
91ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGJySi-QBMAE&v=APEucNVNceyrSPE9NDCCydok_BL-lMKu6iLiqLKDW8_4573EjVAFQnJsriWkFHNoNiTYs_2W9LMI8uSCzASb2SzBdxKe-EYokQ

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7599e0a5ce1ba2a12f036e998e19e60b6e982178e4363d4630ab3a91ca73bf62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 193
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 991F 0
20 B 88ms
88ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3610093694554&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 991F 0
20 B 88ms
88ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3610093694554&version=m202301230201&ct=76&x=1&cor=1514507766777490700

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 991F 98 KB
40 KB 149ms
148ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Av2Sz-gT_IMvyYb6DckDoxFiZ9yxcteX1SFNQhEMbZev5pa7tYwbFjytkl5GdLBbSYKsibtn_kOPJMu3NWVbx-WBB3qI0HDR3IAFpHYwJP3GBK1Yk&cry=1&dbm_d=AKAmf-B214q9tFMjZB7gfeYDI2TcOvnpkykE7zQ7e0m-T_b05V1ZjcUpeHO21ApX4Kqx5uKeyX_VomYkvpkmjo2V6bBfhXm3RCWcMrv0lPQheupyBvs_ogREgozx0DDmkRw4B4oIQCMxn8GO9ClFjgGz0JffzCLGbXVNVkXX9fDJz-_hn-sgXhttklo2AdMgYhAyAEcjCfFN_JrsGvL4KlUIKS5tM0zt_Vmzuam2opCRYsfZ5ocefM2Iq3nBVadxNtrxz3KKwpFAO1Udbx_vqUP5BgE7kJ95BZfsb5u1dFNflflMJNDbnOzIyaunYBh0QxdkqmzvpYiCcNU1r54tQ1JcQV1B6jGod1RflTUNFrXwfQj7shdZdmMi8VvJYlGw9ExOOWurbjCx0Bm0mwa48DidTCIbkuJQ34MpM5PAVRrFwt36IUAdz2ntm1ssC_xgVXCH6ntoRhwM5SMrEna8Pbmb9fP3ktJeNc7NkSgaqyMmn625qYyojKDHbISZMcKeqNFickFZtXuPkTFWlFsKoKBMTemc_fP8RRvPVcEAIsoxmOLDpiIUYifGehVow1mG_V3dxxxi-uOS-FLbr91sAQqQlTDHbmA9zOf7uZqgpMLOxgnXrOePSuiQgZ6MX_FS0hBSuQKbAxm4SSZgKSnBm7dM5wj1Jgivh89om9vOCOPs3ut3MjqYmTX_jH7q4uc9J39_i3sDAhhwQVfHwaAQIeyMTH5_zlHwUz8y0HRWSQpNYA_Cc9JIrxLFNaTwGtRfgy4PfPgFnxdXi66qvbCnJ1DYJbyD5ruwYCbENfYW8p0p3_WYPT_rW0nDCfhZnU5xGlooBq50PljGVEGiOV0c2awADJVZZMPXBZslI-8lgWshoFfgsHw4edLRIu9tYUIjV1QbHmN07_3IMfycKOsl0iBAcrJV6GyBwprLe2_ZMKWS6Awk8_3MljvQz4gsbXM5tNomFRTIXOj3reJswo-r5gUGgkt5zC0fs9zIq0HMhQYOyvupFUCM43mho8bQSaSGlj7l-7RwAeDKg6AGotAvkaobew2mltmfCn87whlmrdnbxCXhH2pz4L4QoSXBU4nsvvM_DrIdqT6HigxzIGw4FLm7hobwBEZWCPSJ_906nHp5MloDaWLhArZOayiELZei1zku6obn2VRT-OzQOPbuOxS6dh2CyHVgp_yjMCKlTmTGjGCE6TXq0h_kEtTRU61x1owKuHWPtJDu32oUMfcqEZfzZ9sB1uCXrS3LeSRl0eg78JI-0DBG2mA09SElYiVFa_LgFiANT9ZFvTy7wTZbL0uVjDkoqDUmYWAzjXJQCNXfxNqWJ9sImLCSQLUvl_Oea2POgw4BkuCKKAGSwEvpxIJkAQpVedFM1jFyJXBmISOicH0el2l7Xpj777vKbONTjRBFag7n2ZmGjqplKEZJcMG_RjGFu6xrdbHt7drDqtEdFjnfEdP5-NLEDPPOKCPPGU3KAXCDAJcPcxtINoUMp94PT9OAuPCRP8P4aK2DebAU9zg_n_Y0rFS_o4ebs2srw39ZrLYrKeft3M1-mnAuIvNtWM1jhh8MWSslqoICLQd7SeL_G25ZAU46kfMiIS69SsVboSf6JRFZiS4gk6M4gFEd2z8lxE-H1gZ44UH0td26EvaEWF6SXElGVqiEX00kU3u53hWI2U-aE664DfBdJ7gXADrBVVIyGlEMw9nPiazvfZtOt3VT5VXGVopLrv2ARpc320Wa-hzry5gWaaG1u14NXyz7ie9Fh5PiWfH1BzOgqNvLWwIUJlR065Ks58HtN5g6WnnIRQ-4_IhYojAx6FDz1Gbf9URDsnVrFbrygRiF_I2ShIV2AJcFLgj80F7i9bqALQxVwz7jW7MDWiMmkJvDZBiR96Etjx4mJyfkeRFMtDuwvyCUz20Z1c9youxKKyVJqy00qR_CPPo66ZRldf45xkX3oA0l4j6AY3xTs7vG_scuH0RZ3tfV95FPpIeJZuoHnjLRRA7inS8niAbJnAQC2vjVfVkKKFdISDLClW5w0oFylzaXCg2UWA7gTiW5doFwaeDuvW6ttUYzzZcTKVMLEWa1K-vrjqLpqMpHKbtiP2h-gdyFICzrwdolhdUZVxiOU3Pw2LGsrojeU9oSVYaSrfeRt0i10V_rFcQY5t2rGwBfpAgWCOKdcYyPH5g9HfD71YpZgMsJN8rPTib2EEpZsVqoFJQwC5EoCSMb1EqChb5ORcDiK0R0NMzL5EBs9sZR73Y9mFooxpi--QS6M77GWKOXu4hs9czoiitNkgQ51xQ-AGq3wK_LnO75fNCkQA-md27szHJRVT7m_BeYtNeg1dGTWDumwqvIuwOy95Wt2Ifds-UTzD1dAIBGASZCtteCY_wqnNDpaxckGkRu6qb4-8lZ_9bxXgseMTJE4NmQjNALNdBNapYUHhzzXmzj4jyJS63XqdZjP2EFKW6gSEajhTDSSt-x7BSUARbgXc8I3OflWNIQ-eLpLjJJCHWcL3iJLjNCfkTznQlBC_4eoYeKjcOUJuuXON-LotMiNTBiKo-DQ4fqUYmKE5KzuYobLMlag690aVxvDSIV_L1SBsNezxPEK0ud5QJ-r1iG70li3ajbidQXS5jhMUVJKHOIKZuZ0U_Yj9PsHGlEmd77r9L-XImI2IymmrC5WefaeSK4azgzNtTL0F9aGtmeEqPVF5Q8XEGCP1g-ust6wMCsHuZ8JbyK5qH5BvKEaMXU3b9-6YLdWybStBgrNGBBJwgFx0GzIFu93Gth1CCaPT3_7n5hWW3dvjw-8_mGstHsx5JrhLsC-k8SuK_qy_br4-_0CtQU1PEPkf2asokcr9mj7ZYHj81kJVqgU9mS1QFX7Q09HLVQJ94u3s9rtvz25hjIaPgDPwXuGY_FWyMBS4Oxt2oViayPSmanH3YqCsKPhLMu515nYAY0eCfsjQt1a2C3sPPbL6N6L7PoBPaGxO8RhQZL5Ilu9DOO2YLvbpzZLUbOnC2p1ugE6FNXYgKVI8uowHa_M4lvLNcgwb2weXyJ4dnHdMIlwHHziwlUtPKLetqeA16BhJsRx0DjQifYOXs0Kg_SwLBbMjY1lRlT8yp8n_SgmDgC162CFD9W7rDF1QHzeegx9L4dGquNjK5vlodFfm_JEzKGkJoAUZKmhFOCrDVvbgrQdR6Fi9-jTeJY7jE1x3uSre_ORghSj1eaRV_3q83cYomERvV1ir3O_RkytrfHjuNYfQdIXOGC8b-DNhLBQjXzsxe48X7-g38YDmLYnvTaoKL4tcQai3eWeZ4RC0_ZVoo0lA9NtNZO48-2imvzV29K9usHrZFnHsk9jIBO_1l7rFuBhgk7s0bSezFaHg_admhMVDBKoQPFOSuHRRljXyPJzuB7shYMSX0X8lhg3sW_v4z2KbMvLUPc_M7XrRmWCaMDarJkW2Xa_3RKfHgvY5-PiJY7aotHEF41u1IF49KbEph2Zwp1c-xtAa4V5bj5wC0Go8RwbLMGlb-7zFbpNSaU-9dV4UT3ExyxIpSQJhPYczlKF4TsfMROXvQ-QRp56Op5ufdEgBkplLUIbtHkF94mBGAraMxf0qkKLg7AuEGPsM-TWJV0alR3lR4Fu5ZKR2HgFRKmGaFf7b4BVWe-k3o8WPKvOuprv3wNbCOyDOHYr9Z1w1vSB93pU_xG1_kUt1l9R1KQXigA1_BjJdvKPpdDvOKKO-wMfQcACTXXAQeVA7opYqCJhE33z50mw5KGUedypsKaLsEtFL1Z07AYy5mb-ZC0ocSWsTr3ZWL1hSMDVsDSyyZ_mk8cx5l-1JldN7oM5dYs7BIH8s01NNYM-TTJGKec0OCoauUkixx0Jl1boqPt_Kafy5p7G_AcQ3qUr9Boy9eOZtLlCXJ1cIBKbRMPGFU2hvFt7n17ddSJAqDxFfiFISQ5pzWJzU5RNd6Hb43TcerQrxiR94rVIXwWY5Dqspe5H4F2pekdIIen6324giWOk1tuK6VbE9ttt-6J3ABB35gduT2nwpFPhIwYSpp5S04OIc-rPyf5N99cz7W-iWyMZlnSNMR1RWKJD_sWlA7MxBloO-Be11RAvo198MDL_Ld3RJFs8CvOw3aTQPc9NufbD22oKYHcX-mev4ilwqlNOdSpqpJwPqu0RICtU-AaZqnWbTDMlH0fRkb1qbrhtQxAtv8tTYcAiYzdwvIjZ3xjIwcALupEadNl1ePWiYHNf5_FX07hYDgixav4N6Cksy6xWYUZi91LZZ0DIcT-8S6HEmWPUD8nhJDj_8YfuffJXa8RWWG42jsDbTZV1qfHaV-iu02vlRvS05K53ChiPNc-Js2vDa6lpmlOCUVUlo2xUsbF20ibmjELM1mllfeK-zYRrXjJ87qf-JvSVgYgHMzi4rv5G1dyaVJxDV2-_GiDD_ZY7ScLFoP_uM1GKySS3ZXW3EQmmIvUfAOAxea1gNg2QrWRjIpWZ9tWD6KCdanXRw5SfSAvqHpI9kdnMGovnu66i1fa7qWgJCqsye2rX_h1PjAw4EqQ40QQ9Wz5MQlWUCb65Asi98qgo58n_C2XGfiaM8WsVIsvTCz40xy2mxo5EmehhNeqX9-CC9GW-KeKQUkSMsuG41Tu_FXakN8pvfl1BoGY0Lxc60J3W0oBDlHe5ikMbwM3C9f3wvnJ60gN7GWmnN0z0xf1H5RymNBqTGGKuVSXYn8XKuYMkyxpQLmnG1okaEbcK5WXW13DxYGhinloRVHfY_6gYJdINSZS19fGAnr_MBidtoxJFA-V61klKQN7HErs98T-EYYQnfKwN2anuhctkjwo11TE0f-UMBADGDIkVeq5NulpnW_i7tJdwYHFVLUo1HdgMy-sfougaSvw_N3coM8S9Rq9F5ZO8WWn4NxfSKVpaYZ_eWSa5ZLOS3asHfRP_RELA5OfOg6ZKC_nfAB3LK0SMgrrpxIv-U4D2ftkQP4oTq9oR2O5CH5FdlWnUlHJZwj4nXK8K5o8AwLC3NwOuoGUdeU6e1GXsE8Ep4xr&cid=CAQSTgBpAlJWctwOGy4ydZ_lLKmSAlvnnRVat0eYnt4dNRmMYMGNLUiqjbEmr1kC_gqY8v_LesBW3oXzhkWrM9LBgEDE1oggqJNhQRm0efUv3xgB&xfc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssNXk33X-qSPIVJfPQwc4aGhuopL5pQloP7GGF_jw5VMYScKg5dqUmyHl6kKdvdABFIM3K9HSZTvQI6kj7hu_YIVsDm62cvHj4OANz2kr-v78Rds6pWiiRW-g_sFRC0iJks2YmuMfpBxH5VTcZ4aWYFSCpfxhZ0owMAd4zchBtmRhqreD6FLCrOX0Ql5R3dPDZLpS5T0P40GbsjkoPXtjtHOhNS0TF6ljs7frk5GtihbjaL-vbPAZGsPE19AyIq_H6_bWAq1cvdg1i3aLDylUOI_Lzqun6g3jT9bjPoEfZTPPvIcjfUHZJMIg4U3NvOyMP2RsnHIGtEy4WB_Z4-BroMevRuWu0YEjfz%26sai%3DAMfl-YQdGy98AyX-Vb6G7CzIgo_5giwTeMQ6nahDX3UQ9kq049NhTk7odolzrBGBCQRV2uNZfNs6nWSR1aEaYOFN7BVCpYscmo1Y65zpmntAaiFTimVnID395MZ8VQpaOCs9gC24EfVIKgmogCO98hwXM4E%26sig%3DCg0ArKJSzNW2UGQPYyqeEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&dv3_ver=m202301230201&rfl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ds=l&xdt=1&iif=1&cor=1514507766777490700&adk=2595408865&idt=208&cac=0&dtd=44

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c77eb8922b03f89e8632cbc484194c724b42b88ec5e61d80e902d3f2d6c8fdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40741
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D0E7 342 B
178 B 94ms
93ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGLuUi-QBMAE&v=APEucNVGJJt0DittW8EekV0wS9SiTbO_ULMHyahIHrRACZ457-1O6Ebx6EPbi3oQxsHzLt81VUcX4QrV03KyETSpWDynXfLcSw

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d6b864869c19ea1f500174a8dc3f327fd5fdc7e8f92f569788a6744341e4f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 158
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2178 0
20 B 90ms
90ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1539693612792&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2178 0
20 B 90ms
90ms Ping
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1539693612792&version=m202301230201&ct=76&x=1&cor=13864210483356740000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2178 82 KB
38 KB 145ms
144ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dc5EJKM_cUspXAHAc0FMsA4dxsy5f-BnhV9ZrDx-d44fYPTsvzwwCKmhfdL_5WEDN8CzfKxWUAA5XnErS3IJWYS6gNmSUSDMpa1rFzFL73P6EnvdE&cry=1&dbm_d=AKAmf-DFQtAxc_ku1QodCAe5HnOQm74dwZ87Eto-MduYUMR3NPLk3O6R_DnvkykfeegjoxhrfukKvWT_WpOhK7STtyU-juhyzpBf6GqxO7jg1YP3Cuy4hFv7HTliGhcrRfIZZnQY-GZKmWj85FFFXJb4uPPOT8QmtOL5Fz0X5AVGEMyy-U3vlfpYqVB-urevQIdzCwI9mtke8DYxULDSESvK6Cn9VHYLZ0VNerKzQfFqX36uV3xa8gwoczDCaF487k8hMk4GpRQE2qug657UE4L4qU6FLoy197wRaxewLQZs6pLLdtLJYy38Np8KPrpjCe-h0Tbpa2mrTTU-hU_otyxil9vImTAk_zdQfIrPfBpg4hzRzoL5YvZ1HJwGcIjxid-PIVw2c7rbjumx0gdaYMOwXsFvl9T47fVZcS3feUlswRnoStobU-z6aJjpjgG-yxUyWgaE67ikGF1dSGaoeNQjQ0q3IkoHsoxs3N0C927bJAfgvWywS72AWBl5laOVB0R8ogjamp83x6wi7il9BNEmY0_uhhnQ8ZvDFjw9Khl13wt6tbiiD_KdLhLBlgZ7K8MUBVUoMiyormvzhC-UCx2DoliztqCVLX64OAsYqKwqyXFEjNwyMVaC1Q9hfDcUzgYQdHnTNXmxeyOrLzS-2y03H2qToSjgkAQnn9n6TdRc3lz-RwIfjuKnR3Udtv3BwmGxVxz198doy-89NAlC74jNU8ic5Yjh4oXyhnVBpdu60B2OgGL6d-dxK6DCNESvB1l0A6_Ck31jhZLBB8fGqxpWJPA8T2tQngdkR2hdRE7jGWzsMvfs-wtTjW8ncex6OPjQmVTyzF4qHkEH5vGNHUyhU1-35JFXh3QLdgZgoY1JuP_tlGuHJ3OuGwqWk0wMwuwEqvIlojXFnhcJNNtLPlqcRGPbCnZdc9xWRmJxHeBWOt9K2daW-xE4NmeqTVUsaMPTnx5Y3ll-1mLc9C4Q4BHbW2X_kPcq3jIHga14Hq6oEjVE3t2S4nLab65E_F-VvrHmwJeSCNxrxryKb_P8q6mwA0tBTNtcsMR5Is3vJXZslK7rLxp1etiv1ygcgyCW67u7OkWVXtZfwTUvi3aL1Vgl5x6uWeGZY10dix6ulgJJB8OL4jANRCLLXMJdALMmRrndaX62rl-R5I-I4fN_QBqYkzjthf_oLm1JMhAxK88YMLdbZcRGMOyfPkyckbxguboSD6BA-4rwtLzGRG7palCkdImHbCygcWBoqJ3xzEeu_lTIGp8nJMZ6l1stccFZ1o59ayZzq57c5oS67V9-ozgoXOQ1Fy9t5rpICQUbc9Us2z_FfoabBSW_jg6HTsKQ9KMi81RDTareSXf0DFcw6K0qOjW6C6_9sbzg2NQhee9O7XoddyacZ5c01WpInuvAcnKCZjgvWvt2e1WFokG2cczjKkA5UYo0B6r-7UyhmxDmbhMgKkA02cW4DZUgyhwa9YFYy9-oJzki7gBVYhXnHcm6o73q5SjMGkN_WvIgmE5lmt1ZB5dxZWRZ3pQJ6Znb_gKM0WEmwAXFT7tSUyqXex7zGlm3pdCz4wQw5yr-sjM4HXDVucVPfzYWV5w8UHtTLdVj6eVHJ07iDQM5VghZNLs35AUa9i41hUGnHHlZb7XsuDgIc1qoneqT4Kfy0vKBYQU_YvsO-CWLVTN2R7uB1715eQ6fEBBiD2hDFJq9uasbRr58lEqJULWsZgyys_ydwfa8lrQ-jit-Q8skg2YjXuv-GnfVqY7DZIKQRLAObzESL8i3KcDqiD9w6n-LSJ8YxG78ls7WtYT2nq76DD7py_qHgXFCKVqaapnp9iDu7BUqkuvYlpYiE3KdcMlWn_pJrKopC6WgFR5ivpiZmnGEnlbAl_5ROJN6XVI2G5aU1awyj-5au8yuU_JkNX8YNiUfAWcTOCuz0i5MFZjooziyWuktDhztFbhGpn-BPIVUoc5azUNe9sj5nU2GOglajSYRWxYoXnJNbj5NAqegJ1TzW2MB13yG3MOPhXnc3MpDNtA-mww8vV6Ib0yHIfNsWZo1CpBIw-C-OKrHTnBybaf2gg1rvAtp2ZKi_1KoPRKzixKrKDjaScl8TK9gbyf-SJ28_ayVKJcgChXS7l4kKdYoF1QS-CpIWaLmdGlHveHWd5idTWAt3XJhMeEcXqf5Pq-DW5ezMIttpYkZJh65ev6g2jWot70UgoubuD5UKnGLGTNE6m2oIJsOGGco77MR51jFM494Dbu7u2Iy6g1jXBXjFDOSI78VvWLSkhU7vtIcfvZ0M_UgemL_GAdgSqFmhq9FqeC6VTTIv5Touyn5TlPUUAKIB71_as9kl9B5-0Tpp6UReV4z2wb_07E147YmLaYbI1yCfbp7O3XImXOiWlufgc8anjD8r5u7TwJ0F-Jek99NrXH_ALgOse5znp8OeTM12QxSD_bxP-HtEz-_5v1bNdjaC0a48Xy9bM8VJdchrLTcgWbZX_oZOs4USPOSuklyLviOzbulaiCUdOLZ191pZUM9dAqQaBvCAMp34JtZ1_5xVHKEARWJLeflJbOADeZScBLNF82JJ-InbmVeQM9k-1c4BhZkIpjvynjpnPGJqoHmvJjJ659RaCv8Vh_HYu7CaV9uF3eeP8WhCwiVrJ80CHn_AQqNygEjTt3QF2A7TB0RBGWva1yXMQDSLMjQRk9ftwc_ToXOEDGyU8_tuUI9fs8DZCpNVCA7JakF9MI-9EsfeviTEOa0hw8-YLBHSxkhrqhn7SQyDCGgoW8T0tedk1S1-JmIdl1LHDfd7xpa_QRYV3T3oeHjoGDMicXgf0FB-vSg2RrnJjhcfIIjPMgosq1YeiRMhIajzCFHp0YSr0kgnf_4r5n7sIcfCknOQJbuyIvJwDVwB2Ha1fhBpYkylRScV-y_sjGF0UfK_B055FXM14lbmQ8-xW9sWa1lRFPpWlcT5Khi_cenXNDZxQLua8gGpOKTPaHrm774MknRZvDvSQZjkXMgZaPzqSEcpiXrb7F16kNvdAlw1zn0oW6ZqXuX5KhsIx1Jh0EmzdTvt1tT039-nceS0j6Apw_H4S9unoCJateqD8iYnPBdatfNrK6YrNGHPlmA6TRfzQvWes9Ddq-beA0vP98dS-ACJseoDmtJUf2mHGItv7ut7jVID8pDAeAyBy_9kN0z1cjHwFYLbiZQPVdCVkP_w9vBOJhvU07nShDivTIsd8OSk1HxFGCJ0zX0rj0pru7bAdAt2c85kQmcyAtngxJ8SmK4nAN0ecsYgg8PXrbmHr7W6YoFLTCJfWQ9f1PXplumngjyr3kwZ2oiUTgOafLO0wwkajpR-nncbXIJfdncS8ppH2jmWMWBhvw5snpaeA57GGT51efKInWBkSa2bS-v-WNCxIDAozgSHJNCQovPrtHa16eaRWvkd_QT_TrJ_uIwcqxjPUwdQ4aqqm4PGxSy7rIWSEMpsNgB9QZ1x0L2PXSulzn-ctp7K_dNZmxLGTMZuMI0V3AICJI9jjRsmF4e-K9k03PAf_-nt5v71XxXO9tSmeNivJg1RgTdDpRCN43LMs6VQuTW3hfjG2Pwj9Szkg58oFvG3aVBNGyiSx3OyZhlO2lbXCV7d76TgaFYPvFYq3-To8KKDjRWi2h602a96Ynna3ITT47eVCUZww4xSOA0LyjZKH-kWJbEy1HFCCrxI-9xjfC5AM-1HvL9q_cSdsrLZJ7tKFXjNc3UIxP3IYHnVtSjvFhDNYbvepxOfwPbxxDQe12aOO2Oo-lH41ljmwqz40eiZA75vT_nY2pcrw4wDdnXz0pVmpTxqrudA17hEE9SFAZNZFOYYwKjesc_uTBahP_APstmloL-GyXA6O3xOnNiJ0qMgS8Z8c72q1bqJMSjETkDB9L_FNUCqWYrLlg0mDSvFNZX4Ef3JJ9MV6oZbwnbZ8D5Scs1kLCbXe8SitgX7WZwexKl6B3Ie_wdQTRczUB8i2-VYbp9OIAwrHFMlWVFusT3N_Ycgwew-PZP3y4s1Vn0OXHyop5sEX0-X60_xl-tfAmUnHsep2RNNL6EUZrJiFXVR2q5DKlneiiSM-XpuM6v1j_SeweNvbLeClnlvXZ2tcIm9NaUIEtPtD8vggB0gd4PyDaCh8xmUdBirf543g7mqrfH4hFfxPz_841tHLMO8xZ_4NIa2qjVYygv2Yir74DXrA0Jv6Jbn2FO8GDKmRqLxC3py9XwJs7UfdPczCYi5fPF8S9Kwsz4Y7AW7OIi1GyzIXOro2Maf_w1Dma50h2rMwE0nx7p56rKjkrnq2zDxeCEaoSsQ1Cv0mkci4684mAPJXrhb3lfPOywKPh6c5v0jCjsH4trY-PMgREQDLSjaXaIUh7RNW1XXSLUaM-gkrrNbACVU3Vo76kGD4yQK3q6FwWHwIaGvVCKV7mXt0H60oEzP-KG_U7Hd5NESrrmQX0WDALU28PGvbqJ0YJdPXYxcIbuQAswZxj-b0KB-iv3pu4TN8jbOqJWcyzuNuZBS_qkznwlHL--zb6WfWKUQdx1Aefd-GRcZtEwdx75lHouwYndpc_7Y0TPcEaVciY3tCmetRSL_aUj-I71i_fugpW0iJlDzzRya6Eibg3H4LDF4xLyUcwMUcE5l6Uv_xV19DS7ND94FQwmaWSk1w85XsimZl-gg7MYzTz9AP94H2WR-w-vqsq94C0q7tOmxOxgIJhs-kPsyKlmy6syaaTbpKev0xdF8G0cQeFDQO3e0ydaUav8jmslNOyO7TbynkuFI_IQbQxSeAusAAoGb2wjK4nEIO8P2GHC9qWaH6D_uM7HmUGgHOR4tETUJqcno7RxpGCQld-aJd_iEZzwh5woBpln0yAaeK5XXiQe7n39Xa74ywlNG66n8nZoNPjGbMAJ5jOBMn0Q2bwKETbLpr2CS_N8GhNrvdZMYpsNqFCOOT5LEXgmK9ACBWhbX_Ce2c7ceTRUFIPPCwsEUVuSDH-jHsDw551wKAiNKNry5DS_gH_IIV78cBrh_43_YWgc6GpAIykkUK64TRuUdD_arTY5dBttOFX1ZKqYJHrAfoHtZQFpitnKZCoUo30oB7D__25zGVOaXENxK-1g1Q&cid=CAQSTgBpAlJWctwOGy4ydZ_lLKmSAlvnnRVat0eYnt4dNRmMYMGNLUiqjbEmr1kC_gqY8v_LesBW3oXzhkWrM9LBgEDE1oggqJNhQRm0efUv3xgB&xfc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvpEuFbK2aXrgU-3wBftaYpE7sQCjl5MvdQwST8PQefmKaL2Us-hMzgHYCY0T_v-wNA_FD_T19zu2AjIy-E02mu56W7eNydGIbBIuG1bi8E9t9-0ZOW6xPye_UJ0tOmbcE5bG38bsoRl0ssJ7W50gcVR1sONYWk1njy6_rpfUvHQaX7b16S-kU7JvzZOpIIMZ7X5hTa0vhRgZEzSEUTOobFWqVu4iSNmRDSFi1LjZxYQ0HhFiYnovky1Sgd4dA1x6ya3GM-QKoxzHe93b7ik-kiqeC7bF99gC_IMZi-c8bcD3BU9pSqIFEnCYfJs2qkDQmX5wBcJlXX12vBOnpwi2SKq56dSHsUmsXw1_N0%26sai%3DAMfl-YQbqd42sWwcWCfLPVWuoq1S7VYG0_56EVc8cTqO7OoMbmJ7UeLLyiajZKmopS8-JrbW_9iKxcWsXcZpzFvvFE0AOgiCRnia5UTc1dNphf7p9N4tsXHyyoqPHIjd1e2dvqicPCBE36uUNN_VunFqDx8%26sig%3DCg0ArKJSzH2_27zYAKPJEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&dv3_ver=m202301230201&rfl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&ds=l&xdt=1&iif=1&cor=13864210483356740000&adk=1535393347&idt=212&cac=0&dtd=38

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02ad1ef8f47f2e6a133a2b3ede751317d509983e33e411183f684e2a6d3c16bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38956
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 in
us.q2s15.com/v5/ 2 B
170 B 60ms
59ms Ping
text/plain 52.45.209.233
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://us.q2s15.com/v5/in
Requested by: Host: cdn.watchingthat.net
URL: https://cdn.watchingthat.net/us.wtat.plugin-jw_ima.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.209.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-209-233.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryhMWcT0DjtyfgJ6gP

Response headers

access-control-allow-origin: https://nypost.com
date: Tue, 11 Jul 2023 01:55:15 GMT
access-control-allow-credentials: true
x-powered-by: Express
content-length: 2
vary: Origin
content-type: text/plain; charset=utf-8

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame 05CD 5 KB
2 KB 73ms
72ms XHR
text/plain 104.18.43.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1---&pubcid=a878d8e0-8a80-4366-920e-95a5dee32438&publisherId=OZONENYP0001&siteId=1500000033&cb=1689040511067&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.43.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a6c20e701eea918a07f14992cbca599d8159c7c0d6003b3627047e1b6e1544f

Request headers

Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1---&pubcid=a878d8e0-8a80-4366-920e-95a5dee32438&publisherId=OZONENYP0001&siteId=1500000033&cb=1689040511067&bidder=ozone
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://elb.the-ozone-project.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 7e4d6c5418eb02ed-MIA
expires: 0

GET
H2 200 grumi-ip.js Show response
rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/ Frame 55FD 14 KB
6 KB 284ms
69ms Script
application/javascript 2600:9000:2511:1600:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/ads/tags/v22.2.1/ads/ads.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:1600:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f62c6457ddefdfd96ebc104603ccc8368e73afb6085b7b8018674cf5d3974ebe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:01:39 GMT
x-amz-version-id: Qnrdy4hJjs6k8McyBwg.pCPTNroFGptC
content-encoding: br
last-modified: Mon, 27 Mar 2023 06:19:37 GMT
server: AmazonS3
via: 1.1 931eba134e92940e6c080405fee84c64.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
etag: W/"22b4da07003fc88ea067e3f866ea9c5a"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=14400, stale-while-revalidate=14400, immutable
age: 3217
x-amz-cf-id: YWmAcg_Asu6XV3-lCwQy3YHNXdO4EkW2HH2j3NRLKB2bg7am4E5Y3Q==

GET
H2 200 hb_270443_13401.js Show response
player.spotim.market/prebidlink/469177/ Frame 55FD 918 B
785 B 181ms
56ms Script
application/javascript 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.spotim.market/prebidlink/469177/hb_270443_13401.js
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: 155634641e0af9f8618778ad4385e5ecb1a8c61808b59d593963f9f6efc73bbb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 13 Jul 2023 01:55:15 GMT
date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: gzip
last-modified: Fri, 07 Jul 2023 12:15:00 GMT
server: nginx
etag: W/"64a801c4-396"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 55FD 77 KB
26 KB 251ms
246ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61885bd84502e0e5ea6844f35f66efe286bcc6c12cdc6e4bb43f3a366539b6c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26352
x-xss-protection: 0
server: cafe
etag: 462 / 19549 / 31075866 / config-hash: 18038137322586664424
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:15 GMT

GET
H2 200 wrapper_hb_270443_13401.js Show response
player.spotim.market/prebidlink/469177/ Frame 55FD 2 KB
1 KB 181ms
57ms Script
application/javascript 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.spotim.market/prebidlink/469177/wrapper_hb_270443_13401.js
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: 930edb05bfea3ec02eb67b7026045685466f40cb725a481e51ce2e59f219baa4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 13 Jul 2023 01:55:15 GMT
date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: gzip
last-modified: Fri, 07 Jul 2023 12:15:00 GMT
server: nginx
etag: W/"64a801c4-6ff"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H2 200 obtp.js Show response
amplify.outbrain.com/cp/ 23 KB
7 KB 90ms
67ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/external/publishers/common/obPvTracker.js?advId=00c0feecc40196b47a738de28ad44794ac
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4b8f2b177e73f0072f1c899e85882e5b8b72c4bfdec8e1d9d431b163079dc8d7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: gzip
last-modified: Mon, 26 Jun 2023 11:53:23 GMT
server: AkamaiNetStorage
etag: "afd3aec78079479ef637fa1e1a4ddf26:1687780672.794656"
vary: Accept-Encoding
content-type: application/x-javascript
x-rg: NA
cache-control: max-age=1200
x-cc: US
accept-ranges: bytes
content-length: 7020
expires: Tue, 11 Jul 2023 02:15:15 GMT

GET
H3

200

sync Show response
capi.connatix.com/core/ Frame 5EC0
Redirect Chain

https://capi.connatix.com/core/sync?v=293038
https://capi.connatix.com/core/sync?v=293038&final=true

4 KB
2 KB

96ms
95ms

XHR
application/json

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/sync?v=293038&final=true
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9303ad00039183e7a6d979f2b518c1b1e438693fcc8ee47de7554b0230ba7a7e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c571f3ddb29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 11 Jul 2023 01:55:15 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/x-protobuf
location: https://capi.connatix.com:443/core/sync?v=293038&final=true
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c54fab5da23-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 player.css
cds.connatix.com/p/293038/ 66 KB
11 KB 47ms
46ms Stylesheet
text/css 172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/293038/player.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b1eba1a5f554c6d27c50b2c6803b71fd6587b89a1384e14b783b06e3f746e0a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
x-amz-version-id: o9NXkxFt7BSY15NULtJd5z8SJEP_j1W.
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 10 Jul 2023 13:34:03 GMT
server: cloudflare
etag: W/"538527869698efa213c4e87e3ab2b161"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 7e4d6c54fc1fd9b5-MIA
access-control-allow-headers: range
expires: Wed, 10 Jul 2024 01:55:15 GMT

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 7DF1 3 KB
1 KB 224ms
65ms Document
text/html 3.234.48.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.234.48.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-48-99.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 8f7c0e066cabbcd89e0b392b2e0dfc5ac1953124e54fa795eb82c5fbe3f6076e

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 11 Jul 2023 01:55:15 GMT
etag: W/"02f3612df1f55c0851f2f9cffd62990b3"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 1A25 2 KB
815 B 248ms
78ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1---&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 sync Show response
ssbsync.smartadserver.com/api/ Frame B4A0 971 B
1 KB 57ms
57ms Document
text/html 23.105.12.142
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.142 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: b4fe36f2bca9983bd463ce1a59c448cf6c427c2ecbccbd8933bd9c7ad83cff0e

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 971
content-type: text/html
date: Tue, 11 Jul 2023 01:55:14 GMT

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 53EC 2 KB
2 KB 68ms
67ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 62896654b8f6e7524d36ede5333e5f035b243dcf3d6ffe2321d2f1d7d2318018

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1589
Content-Type: text/html
Date: Tue, 11 Jul 2023 01:55:15 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 956F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
554 B

182ms
61ms

Document
text/html

23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:15 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 11 Jul 2023 01:55:15 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8B43 16 KB
6 KB 63ms
62ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1---&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=126795
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Tue, 11 Jul 2023 01:55:15 GMT
expires: Wed, 12 Jul 2023 13:08:30 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 1A56 4 KB
5 KB 241ms
79ms Document
text/html 2600:9000:21dd:ce00:1f:4c18:bd40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:ce00:1f:4c18:bd40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: db228ef5979b52e619f2bdd8df89e5825ea3788fc8408f6c37f0f5592b8c0ad8

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-type: text/html
date: Tue, 11 Jul 2023 01:55:15 GMT
server: istio-envoy
via: 1.1 0a84c1b70b100e694edd23e638bf7fa8.cloudfront.net (CloudFront)
x-amz-cf-id: fKx1Rs5kEC3RdKXIsGFlSrtnpTTd8NUBLRdlSSLY-_8mq34qmqCI5A==
x-amz-cf-pop: EWR53-C2
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 2

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame B993 635 B
1 KB 208ms
67ms Document
text/html 174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1---&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: 87d3d65539afd772d52afea5bbb4b2b87765f1c49261c506867f439c6752bd88

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 635
Content-Type: text/html; charset=utf-8
Date: Tue, 11 Jul 2023 01:55:15 GMT
Pragma: no-cache
Server: nginx

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame A716 3 KB
4 KB 221ms
60ms Document
text/html 54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: c5e803fad31693e155f67432f7b9d3938742cf0187f5daec984959927f967432

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-type: text/html
date: Tue, 11 Jul 2023 01:55:15 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 usersync.html Show response
ad-cdn.technoratimedia.com/html/ Frame 60CD 17 KB
7 KB 139ms
34ms Document
text/html 2606:2800:21f:2cf1:7be6:911:71d9:25f7
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ad-cdn.technoratimedia.com/html/usersync.html?gdpr=0&gdpr_consent=&us_privacy=1---&srv=cs&source=duration&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D362%26uid%3D%5BUSER_ID%5D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:21f:2cf1:7be6:911:71d9:25f7 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mib/5B12) /
Resource Hash: 959b323d6d404b16646fff656d108c0ef6079419e6a5536ff04f24b69a706d67

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: access-control-allow-credentials,access-control-allow-methods,access-control-allow-origin,date,etag,opc-client-info,opc-request-id,x-api-id
age: 262
cache-control: max-age=900
content-encoding: gzip
content-length: 6056
content-md5: BWNiLq3WgjMFnqlZeqylmg==
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:15 GMT
etag: 3c7cbe5d-b074-41c0-9aea-5feaec65b4f6
expires: Tue, 11 Jul 2023 02:10:15 GMT
last-modified: Fri, 09 Jun 2023 15:10:42 GMT
opc-request-id: iad-1:jyPFs6gGE4Cws-YhkxZors5C0nm11WakeDHzdBKpuYB_LzMLy8-r546JIeslRpks
server: ECAcc (mib/5B12)
storage-tier: Standard
vary: Accept-Encoding
version-id: 54260ee6-b896-4a59-bf66-caede0de27cf
x-api-id: native
x-cache: HIT

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=6113698130532189562

0
344 B

69ms
68ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=6113698130532189562
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: d53773f7-738e-40b2-a3eb-82d2bbd31ed5
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ads.servenobid.com/sync?pid=312&uid=6113698130532189562
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=G9dTiRZHFS2J8TOYTsGYe0sx

0
350 B

206ms
68ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=G9dTiRZHFS2J8TOYTsGYe0sx
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=G9dTiRZHFS2J8TOYTsGYe0sx
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2dca1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID&sovrn_retry=true
https://ads.servenobid.com/sync?pid=310&uid=G9dTiRZHFS2J8TOYTsGYe0sx

0
350 B

68ms
68ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=G9dTiRZHFS2J8TOYTsGYe0sx
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ads.servenobid.com/sync?pid=310&uid=G9dTiRZHFS2J8TOYTsGYe0sx
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET

cs
cs-server-s2s.yellowblue.io/ Frame D8DA
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1689040515556
https://ad.turn.com/r/cs?pid=45&rndcb=8806750173
https://sync.1rx.io/usersync/turn/6971283231311444352?dspret=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005?redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11579%26id%3DRX-45a5c1a4-eba9-4f1a-acfa-bcedfb6...
https://cs-server-s2s.yellowblue.io/cs?aid=11579&id=RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=978477416365413599

0
344 B

72ms
68ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=978477416365413599
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=978477416365413599
Date: Tue, 11 Jul 2023 01:55:15 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
https://ads.servenobid.com/sync?pid=332&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d

0
357 B

68ms
67ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=332&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:15 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-154
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ads.servenobid.com/sync?pid=332&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET

usermatchredir
ssum.casalemedia.com/ Frame D8DA
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1---&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F4420%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26A%3D38bc671c-6131-44bc-bfdd-1dc5d12a8d38%26bidder%3Dappnexus%26cbx%3...
https://prebid.a-mo.net/cchain/0/4420?gdpr=0&gdpr_consent=&us_privacy=1---&A=38bc671c-6131-44bc-bfdd-1dc5d12a8d38&bidder=appnexus&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&...
https://cm.adform.net/cookie?gdpr=0&gdpr_consent=&redirect_url=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F2%2F4420%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26A%3D38bc671c-6131-44bc-bfdd-1dc5d...
https://prebid.a-mo.net/cchain/2/4420?gdpr=0&gdpr_consent=&us_privacy=1---&A=38bc671c-6131-44bc-bfdd-1dc5d12a8d38&bidder=adform&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3D&ui...
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F5%2F4420%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---%26A%3...

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A

0
367 B

67ms
67ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A
date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://ads.servenobid.com/sync?pid=346&uid=ua-8f6538e6-7221-3c91-9e5a-837ae1e5f9bc

0
358 B

71ms
67ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=346&uid=ua-8f6538e6-7221-3c91-9e5a-837ae1e5f9bc
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=346&uid=ua-8f6538e6-7221-3c91-9e5a-837ae1e5f9bc
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ads.servenobid.com/sync?pid=339&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A

0
367 B

68ms
67ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-5ruvD1tE2uHLsoOm9U951cZsHeyXpUYQWxOZzPc-~A
date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=KW3eSFMR&gdpr=0&gdpr_consent=&us_privacy=1---&
https://ads.servenobid.com/sync?pid=351&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0

0
356 B

68ms
67ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=351&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=351&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
date: Tue, 11 Jul 2023 01:55:15 GMT
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame D8DA
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D353%26uid%3D%3Cvsid%3E
https://ads.servenobid.com/sync?pid=353&uid=3320421111524274000V10

0
346 B

70ms
69ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=353&uid=3320421111524274000V10
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Tue, 11 Jul 2023 01:55:15 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
location: https://ads.servenobid.com/sync?pid=353&uid=3320421111524274000V10
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:15 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame A03A 0
859 B 207ms
69ms Script
text/html 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:15 GMT
AN-X-Request-Uuid: b5696202-8673-4ba6-a47c-33854c6d27f0
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DC5A 0
859 B 206ms
68ms Script
text/html 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a23-46-248-18.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:15 GMT
AN-X-Request-Uuid: dc7b7b87-cd05-421b-aa95-b5e6cebac82e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 pubcid.php Show response
hbx.media.net/ Frame 9CC4 57 KB
18 KB 145ms
69ms Script
text/html 23.46.248.18
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hbx.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.46.248.18 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains, max-age=604800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
content-encoding: gzip
date: Tue, 11 Jul 2023 01:55:15 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: max-age=1800
content-length: 18543
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 02:25:15 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 9CC4 88 B
328 B 58ms
57ms Script
text/javascript 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=1---&j=window.advBidxc.mnetRtusId

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8dfcea8b859acb8f78032a15e498e197f8c8603ed52aaf18c3449d79550d7144

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:14 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1267114
expires: 60

GET
H2

200

cksync.html Show response
contextual.media.net/ Frame 15A3
Redirect Chain

https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3320421111524274000V10%26type%3Drkt%26refUrl%3D%26vid%3D904051543233204211115242740...
https://contextual.media.net/cksync.html?cs=8&vsid=3320421111524274000V10&type=rkt&refUrl=&vid=90405154323320421111524274000V10&ovsid=978477416365413599

235 B
659 B

119ms
118ms

Document
text/html

23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3320421111524274000V10&type=rkt&refUrl=&vid=90405154323320421111524274000V10&ovsid=978477416365413599

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

7adfac299561b9d5ab03c88e9d582cf76bd31746a4c0564d7d0d428199c943df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-length: 235
content-type: text/html;charset=UTF-8
date: Tue, 11 Jul 2023 01:55:15 GMT
expires: Tue, 11 Jul 2023 01:55:15 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

Redirect headers

Content-Length: 0
Date: Tue, 11 Jul 2023 01:55:15 GMT
Location: https://contextual.media.net/cksync.html?cs=8&vsid=3320421111524274000V10&type=rkt&refUrl=&vid=90405154323320421111524274000V10&ovsid=978477416365413599
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

cksync.php
contextual.media.net/ Frame 9CC4
Redirect Chain

https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3320421111524274000V10%26type%3Dcon%26refUrl...
https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=81855cbb121215e&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D33...
https://contextual.media.net/cksync.php?cs=8&vsid=3320421111524274000V10&type=con&refUrl=&vid=90405154323320421111524274000V10&ovsid=AAAIpKfIJF73OgMZkAH5AAAAAAA&expiration=1689126915&is_secure=true

61 B
468 B

99ms
97ms

Image
image/gif

23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3320421111524274000V10&type=con&refUrl=&vid=90405154323320421111524274000V10&ovsid=AAAIpKfIJF73OgMZkAH5AAAAAAA&expiration=1689126915&is_secure=true

Requested by

Protocol

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:16 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://contextual.media.net/cksync.php?cs=8&vsid=3320421111524274000V10&type=con&refUrl=&vid=90405154323320421111524274000V10&ovsid=AAAIpKfIJF73OgMZkAH5AAAAAAA&expiration=1689126915&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1

200
OK

RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
sync.targeting.unrulymedia.com/csync/ Frame 9CC4
Redirect Chain

https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3320421111524274000V10%26type%3Dr1%26refUrl%3D%26vid%3D90405154323320421111...
https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&zcc=1&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3320421111524274000V10%26type%3Dr1%26refUrl%3D%26vid%3D90405154323320...
https://ad.turn.com/r/cs?pid=45&rndcb=7954974922
https://sync.1rx.io/usersync/turn/6971283231311444352?dspret=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005

43 B
452 B

218ms
59ms

Image
image/gif

199.127.204.171
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Server: 199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:18 GMT
Server: Tengine
Connection: keep-alive
Content-Length: 43
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Tengine
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: 0

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 9CC4
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzMyMDQyMTExMTUyNDI3NDAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEC1pY1t8EDNvW_2W27ck1xE&google_cver=1

61 B
722 B

159ms
108ms

Image
image/gif

23.52.158.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEC1pY1t8EDNvW_2W27ck1xE&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Server: 23.52.158.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-158-180.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
X-Check-Cacheable: YES
Server: Apache
X-Akamai-Pragma-Client-IP: 23.44.237.140, 4.7.166.102
X-Serial: 66004
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 61
x-mnet-hl2: E
Expires: Tue, 11 Jul 2023 01:55:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEC1pY1t8EDNvW_2W27ck1xE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 9CC4
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3320421111524274000V10%26type%3Ddxu%26refUrl%3D%26vid%3D90405154323320421111524...
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3320421111524274000V10%26type%3Ddxu%26refUrl%3D%26vid%3D90405154323320421...
https://contextual.media.net/cksync.php?cs=8&vsid=3320421111524274000V10&type=dxu&refUrl=&vid=90405154323320421111524274000V10&ovsid=bks7MZr81Qj2AX5

61 B
459 B

97ms
97ms

Image
image/gif

23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3320421111524274000V10&type=dxu&refUrl=&vid=90405154323320421111524274000V10&ovsid=bks7MZr81Qj2AX5

Requested by

Protocol

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:17 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:17 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-782-g97d928b#rel-ec2-master i-0c4fb7eae92d7cbad@us-east-1d@dxedge-app-us-east-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3320421111524274000V10&type=dxu&refUrl=&vid=90405154323320421111524274000V10&ovsid=bks7MZr81Qj2AX5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 9CC4
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=04be89c4-bea7-45ac-b688-63ea5594789c

61 B
623 B

96ms
95ms

Image
image/gif

23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=04be89c4-bea7-45ac-b688-63ea5594789c

Requested by

Protocol

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:15 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:15 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:14 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=04be89c4-bea7-45ac-b688-63ea5594789c
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 903888
content-length: 0
expires: Tue, 11 Jul 2023 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 9CC4
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=medianet&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=medianet&gdpr=0&user_id=i_RPqN_2FvqQ-U-o2PUDrd7wHq-QoRaoiKGc5hMl
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=0&gdpr_consent=&gdpr_pd=

61 B
472 B

100ms
99ms

Image
image/gif

23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=0&gdpr_consent=&gdpr_pd=

Requested by

Protocol

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:16 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:16 GMT

Redirect headers

Location: //contextual.media.net/cksync.php?cs=1&type=bs&ovsid=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=0&gdpr_consent=&gdpr_pd=
Date: Tue, 11 Jul 2023 01:55:16 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET /
b1sync.zemanta.com/usersync/medianet/ Frame 9CC4 0
0

GET
H/1.1 200
OK /
dmp.adblade.com/srv/sync/gateway/ Frame 9CC4 43 B
229 B 209ms
59ms Image
image/gif 34.199.73.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.adblade.com/srv/sync/gateway/?cId=Medianet;__src=adblade
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.199.73.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-199-73-116.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

cksync.php
contextual.media.net/ Frame 9CC4
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=3320421111524274000V10
https://contextual.media.net/cksync.php?type=mf&ovsid=1d1ea802-532c-43e0-b670-ad442f4cee1c&cs=1

61 B
471 B

157ms
157ms

Image
image/gif

23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?type=mf&ovsid=1d1ea802-532c-43e0-b670-ad442f4cee1c&cs=1

Requested by

Protocol

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:16 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:16 GMT

Redirect headers

location: //contextual.media.net/cksync.php?type=mf&ovsid=1d1ea802-532c-43e0-b670-ad442f4cee1c&cs=1
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 710489.gif
id.rlcdn.com/ Frame 9CC4 42 B
60 B 78ms
74ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/710489.gif
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 9CC4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

61 B
733 B

270ms
144ms

Image
image/gif

23.52.158.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Server: 23.52.158.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-158-180.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:15 GMT
X-Check-Cacheable: YES
Server: Apache
X-Akamai-Pragma-Client-IP: 23.44.237.140, 4.7.166.102
X-Serial: 66004
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 61
x-mnet-hl2: E
Expires: Tue, 11 Jul 2023 01:55:15 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

cksync.php
contextual.media.net/ Frame 9CC4
Redirect Chain

https://creativecdn.com/cm-notify?pi=medianet
https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=KQzI03wLm8jPizONN02F&pi=medianet

61 B
463 B

163ms
162ms

Image
image/gif

23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=KQzI03wLm8jPizONN02F&pi=medianet

Requested by

Protocol

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:16 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:16 GMT

Redirect headers

location: https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=KQzI03wLm8jPizONN02F&pi=medianet
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT, Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK l Show response
mcdp-sadc1.outbrain.com/ 2 B
381 B 448ms
113ms Fetch
text/plain 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-sadc1.outbrain.com/l?token=d579536aa98b431581e715c8993a38e6_770_1689040513726&tm=5997&eT=0&widgetWidth=341&widgetHeight=291&widgetX=629&widgetY=8829&wRV=2010370&pVis=0&lsd=88e5793e-8fe2-496f-913d-a5fa43da29db&eIdx=&ccpa=1---&rtt=1870&oo=false&lo=3002&obreq=2778&mvreq=7589&mvres=9459&cet=4g&to=1689040505990&umv=1&ll=0&chs=1&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?ver=1.0.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: gzip
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: content-range
X-TraceId: 666d026ed2647212dd451bb0efe13371
Content-Length: 28

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5359 42 B
64 B 208ms
81ms Fetch
image/gif 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsteXFz0P8m6k9iv9inGbi5uQnbNcip9L10MPv-IBblQfCQD7DMIbIESPu1U1WknUcozud4qzLFGnbi7m1zBY6b1dOoOsaZiwugoKA6Arkx6XBi82AWf&sig=Cg0ArKJSzDnBHETFA2WUEAE&id=lidar2&mcvt=1683&p=557,0,564,1&mtos=1683,1683,1683,1683,1683&tos=1683,0,0,0,0&v=20230710&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=2122588546&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1689040512716&rpt=1064&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8F9D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1

43 B
632 B

194ms
66ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMOQi-QBMAE&v=APEucNVLbmeihUK8EUhurFJtqoAcgwqA-mMTidb4zy2nj9FMlZKWc1HFZJZDeKWKY5R7zXH77R6DIgMttv8FoajI60hCf7jMYg
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8F9D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZKy2gPeKFcFmKMEQLWWTawAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1

43 B
632 B

198ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMOQi-QBMAE&v=APEucNVLbmeihUK8EUhurFJtqoAcgwqA-mMTidb4zy2nj9FMlZKWc1HFZJZDeKWKY5R7zXH77R6DIgMttv8FoajI60hCf7jMYg
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEH7qtju_6PZ3yojVpWza4is&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8F9D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGZITOc4QuWsU3G-yt2EUp0&google_cver=1

43 B
1 KB

79ms
77ms

Image
image/gif

68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGZITOc4QuWsU3G-yt2EUp0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMOQi-QBMAE&v=APEucNVLbmeihUK8EUhurFJtqoAcgwqA-mMTidb4zy2nj9FMlZKWc1HFZJZDeKWKY5R7zXH77R6DIgMttv8FoajI60hCf7jMYg

Protocol

HTTP/1.1

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
AN-X-Request-Uuid: f8f3f672-a5de-4784-888b-e77f2e2feccd
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGZITOc4QuWsU3G-yt2EUp0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8F9D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjExMzY5ODEzMDUzMjE4OTU2Mg%3D%3D

170 B
189 B

82ms
79ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjExMzY5ODEzMDUzMjE4OTU2Mg%3D%3D

Requested by

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9ad99d32-3e70-441a-820b-9c04478c6af6
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjExMzY5ODEzMDUzMjE4OTU2Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BDDA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJfN7lXbE8qXGu4jJKuwxHM&google_cver=1

43 B
61 B

57ms
56ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJfN7lXbE8qXGu4jJKuwxHM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMSVi-QBMAE&v=APEucNWamYOVobN0LcIXrJM8dJwoEF9Nhs9wgf-MAl2UqMLP4wc1xXru4QyjBZHBOv9xTWsjTM5MOiXVmOsi8C10R366J-tIGw
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJfN7lXbE8qXGu4jJKuwxHM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BDDA
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjZjZDBhZWQtMDgwZC0yOTc3LWZiYTItZmFiMDM4MWJkMjQz

170 B
188 B

78ms
78ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjZjZDBhZWQtMDgwZC0yOTc3LWZiYTItZmFiMDM4MWJkMjQz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMSVi-QBMAE&v=APEucNWamYOVobN0LcIXrJM8dJwoEF9Nhs9wgf-MAl2UqMLP4wc1xXru4QyjBZHBOv9xTWsjTM5MOiXVmOsi8C10R366J-tIGw

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjZjZDBhZWQtMDgwZC0yOTc3LWZiYTItZmFiMDM4MWJkMjQz
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame BDDA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESECFpJFWMSJ8PY0cVKmZjA7k&google_cver=1

23 B
163 B

153ms
149ms

Image
image/gif

72.247.69.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESECFpJFWMSJ8PY0cVKmZjA7k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGMSVi-QBMAE&v=APEucNWamYOVobN0LcIXrJM8dJwoEF9Nhs9wgf-MAl2UqMLP4wc1xXru4QyjBZHBOv9xTWsjTM5MOiXVmOsi8C10R366J-tIGw
Protocol: H2
Server: 72.247.69.164 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-69-164.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Tue, 11 Jul 2023 01:55:16 GMT
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESECFpJFWMSJ8PY0cVKmZjA7k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BDDA
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NmJhYWIxNzctMjQzZC00YTUxLWJkMWItYjlkMjIwMmVjNWFh

170 B
189 B

78ms
78ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NmJhYWIxNzctMjQzZC00YTUxLWJkMWItYjlkMjIwMmVjNWFh

Requested by

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: akka-http/10.2.10
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NmJhYWIxNzctMjQzZC00YTUxLWJkMWItYjlkMjIwMmVjNWFh
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Tue, 11 Jul 2023 01:55:15 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame 4B65
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESEN7qSz0WsfouqetG06Ztr2Q&google_cver=1

43 B
175 B

180ms
57ms

Image
image/gif

2600:1f18:612b:4232:9bc:5016:ef4e:2655
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESEN7qSz0WsfouqetG06Ztr2Q&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGJySi-QBMAE&v=APEucNVNceyrSPE9NDCCydok_BL-lMKu6iLiqLKDW8_4573EjVAFQnJsriWkFHNoNiTYs_2W9LMI8uSCzASb2SzBdxKe-EYokQ
Protocol: H2
Server: 2600:1f18:612b:4232:9bc:5016:ef4e:2655 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Tue, 11 Jul 2023 01:55:16 GMT
server: nginx
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://partners.tremorhub.com/sync?UIGL=CAESEN7qSz0WsfouqetG06Ztr2Q&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

partner
sync.search.spotxchange.com/ Frame 4B65
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuIDXAALVFdJrOuIrYqa3Y&google_cver=1

43 B
419 B

64ms
60ms

Image
image/gif

192.35.249.137
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuIDXAALVFdJrOuIrYqa3Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGJySi-QBMAE&v=APEucNVNceyrSPE9NDCCydok_BL-lMKu6iLiqLKDW8_4573EjVAFQnJsriWkFHNoNiTYs_2W9LMI8uSCzASb2SzBdxKe-EYokQ
Protocol: H2
Server: 192.35.249.137 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 243
content-length: 43

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuIDXAALVFdJrOuIrYqa3Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4B65
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZjliYmMyYTctMWY4ZC0xMWVlLTg0NWUtMWJiYzNhYjcwMjAz

170 B
189 B

77ms
77ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZjliYmMyYTctMWY4ZC0xMWVlLTg0NWUtMWJiYzNhYjcwMjAz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGJySi-QBMAE&v=APEucNVNceyrSPE9NDCCydok_BL-lMKu6iLiqLKDW8_4573EjVAFQnJsriWkFHNoNiTYs_2W9LMI8uSCzASb2SzBdxKe-EYokQ

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 11 Jul 2023 01:55:15 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ZjliYmMyYTctMWY4ZC0xMWVlLTg0NWUtMWJiYzNhYjcwMjAz
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 495
content-length: 0

POST
H3 200 events Show response
api.permutive.com/v2.0/batch/ 101 B
129 B 140ms
140ms XHR
application/json 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/batch/events?enrich=false&sdkp=true&k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: e71d7b0d7c4e6e051e72356fa15efdfc2933706b3c774b32fad101496d967550

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
content-encoding: gzip
via: 1.1 google
server: Permutive
vary: Origin
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D0E7
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS14OTZ1SUs1RTJ1RUxlYUNQSEVkWll3emJWVlp4bnlmRH5B

170 B
189 B

79ms
79ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS14OTZ1SUs1RTJ1RUxlYUNQSEVkWll3emJWVlp4bnlmRH5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGLuUi-QBMAE&v=APEucNVGJJt0DittW8EekV0wS9SiTbO_ULMHyahIHrRACZ457-1O6Ebx6EPbi3oQxsHzLt81VUcX4QrV03KyETSpWDynXfLcSw

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS14OTZ1SUs1RTJ1RUxlYUNQSEVkWll3emJWVlp4bnlmRH5B
date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200

user-registering
ads.stickyadstv.com/ Frame D0E7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_cm&google_dbm
https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEBD8cegnA2oczSk0habnj-E&google_cver=1

43 B
601 B

70ms
67ms

Image
image/gif

63.251.28.234
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEBD8cegnA2oczSk0habnj-E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL8BEPX1x8MCGLuUi-QBMAE&v=APEucNVGJJt0DittW8EekV0wS9SiTbO_ULMHyahIHrRACZ457-1O6Ebx6EPbi3oQxsHzLt81VUcX4QrV03KyETSpWDynXfLcSw
Protocol: HTTP/1.1
Server: 63.251.28.234 , United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1689040516368050-117

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.stickyadstv.com/user-registering?dataProviderId=141&userId=CAESEBD8cegnA2oczSk0habnj-E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 317
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D0E7
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=11
https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=YjM3NDg2M2M2YzM0YWJhOTg0ODQwOGI2YjI2Yjk0Ng==&gdpr=0&gdpr_consent=

170 B
189 B

78ms
77ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=YjM3NDg2M2M2YzM0YWJhOTg0ODQwOGI2YjI2Yjk0Ng==&gdpr=0&gdpr_consent=

Requested by

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=stickyxchange_dbm&google_hm=YjM3NDg2M2M2YzM0YWJhOTg0ODQwOGI2YjI2Yjk0Ng==&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1689040516173057-267

GET
H/1.1 200
OK dv-measurements4122.js Show response
cdn.doubleverify.com/ Frame 241D 547 KB
104 KB 202ms
69ms Script
application/javascript 2600:1400:9000::6875:b641
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements4122.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 6c0a263cc7f40c33f21c21323b8b0cdef80fa00a1467d58e87f6cf3de6e0e11a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jul 2023 07:43:16 GMT
Server: UploadServer
ETag: "9b4ec8c5f3573c4020d70289eee8e2d0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 106219
Expires: Fri, 05 Jul 2024 07:43:26 GMT

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 05CD
Redirect Chain

https://ads.yieldmo.com/pbsync?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redirectUri=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dyieldmo%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D...
https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone

0
687 B

73ms
72ms

Image
text/plain

104.18.43.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 104.18.43.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://elb.the-ozone-project.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
cache-control: no-cache, no-store, must-revalidate
cf-ray: 7e4d6c5b7beb02ed-MIA
content-length: 0
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://elb.the-ozone-project.com/setuid?bidder=yieldmo&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame B4A0 0
344 B 68ms
67ms Image
image/avif 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=8004212043844932477&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B4A0
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=ODAwNDIxMjA0Mzg0NDkzMjQ3Nw==&gdpr=0&gdpr_consent=

170 B
189 B

79ms
79ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=ODAwNDIxMjA0Mzg0NDkzMjQ3Nw==&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=ODAwNDIxMjA0Mzg0NDkzMjQ3Nw==&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame B4A0
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=

43 B
446 B

172ms
85ms

Image
image/gif

216.22.16.9
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 216.22.16.9 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache,no-store
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 299

GET
H2

200

v1
match.sharethrough.com/sync/ Frame B4A0
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=8004212043844932477&gdpr=0&gdpr_consent=

68 B
604 B

57ms
57ms

Image
image/png

54.161.177.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=8004212043844932477&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Server: 54.161.177.158 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-177-158.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=8004212043844932477&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame B4A0
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3D...
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8004212043844932477&gdpr=0&gdpr_consent=

43 B
855 B

424ms
145ms

Image
image/gif

52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8004212043844932477&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 2PNBZC7FZ56K2WC4R5C9
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=8004212043844932477&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2 200 ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 53EC 43 B
601 B 63ms
62ms Image
image/gif 2600:1f18:4e9:5a07:e525:84df:6700:168e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:e525:84df:6700:168e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 53EC
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562

43 B
632 B

193ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:15 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: ca437c68-23ff-4797-bacb-2e132133ed1a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 53EC
Redirect Chain

https://ad.turn.com/r/cs?pid=21
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352

43 B
632 B

193ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 53EC
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt

43 B
632 B

198ms
66ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-mia-kmia1760066-MIA
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1689040516.416048,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK ibs:dpid=23728&dpuuid=ZKy2gPeKFcFmKMEQLWWTawAA%263820
dpm.demdex.net/ Frame 53EC 42 B
942 B 332ms
111ms Image
image/gif 44.238.178.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZKy2gPeKFcFmKMEQLWWTawAA%263820?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.238.178.222 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

DCS: dcs-prod-usw2-1-v046-0916fabba.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: PWSTc6F8Skw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame 53EC 0
285 B 194ms
56ms Image
text/plain 18.235.225.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.235.225.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-235-225-8.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 53EC
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=54feae5b-ad48-4a1b-abf7-d7f60d078709&expiration=1720662916

43 B
632 B

113ms
68ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=54feae5b-ad48-4a1b-abf7-d7f60d078709&expiration=1720662916
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=54feae5b-ad48-4a1b-abf7-d7f60d078709&expiration=1720662916
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 53EC
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=bks7MZr81Qj2AX5

43 B
632 B

124ms
66ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=bks7MZr81Qj2AX5
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:15 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-782-g97d928b#rel-ec2-master i-0ae988fe303957462@us-east-1d@dxedge-app-us-east-1-prod-asg
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=bks7MZr81Qj2AX5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 53EC 0
357 B 74ms
66ms Image
image/avif 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame B752 172 KB
60 KB 194ms
66ms Script
text/javascript 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Origin: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 09:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58807
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jul 2023 09:35:08 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/ Frame B752 11 KB
4 KB 61ms
61ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/omrhp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1928
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 25 Jul 2023 01:23:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/ Frame B752 30 KB
11 KB 61ms
61ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/abg_lite.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:59:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:59:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B752 41 KB
13 KB 63ms
63ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1928
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Jul 2024 01:23:07 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 94DA 172 KB
60 KB 80ms
69ms Script
text/javascript 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Origin: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 09:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58807
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jul 2023 09:35:08 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/ Frame 94DA 11 KB
4 KB 68ms
67ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/omrhp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1928
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 25 Jul 2023 01:23:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/ Frame 94DA 30 KB
11 KB 62ms
62ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/abg_lite.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:59:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:59:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 94DA 41 KB
13 KB 63ms
63ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1928
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Jul 2024 01:23:07 GMT

GET
H2 200 r
eb2.3lift.com/ 37 B
139 B 58ms
58ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/r?inv_code=NYPost_Sidebar_native_header&aid=22344930957597454546970&rev=16f6bb0&domain=nypost.com&ref=https%253A%252F%252Fnypost.com%252F2023%252F05%252F10%252Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%252F&pr=un&rr=auction&cb=32800
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

POST
H2 204 rum Show response
elb.the-ozone-project.com/cdn-cgi/ Frame 05CD 0
160 B 40ms
40ms XHR
text/plain 104.18.43.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://elb.the-ozone-project.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.43.178 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1---&pubcid=a878d8e0-8a80-4366-920e-95a5dee32438&publisherId=OZONENYP0001&siteId=1500000033&cb=1689040511067&bidder=ozone
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: application/json

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://elb.the-ozone-project.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7e4d6c59490002ed-MIA

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 991F 172 KB
60 KB 65ms
64ms Script
text/javascript 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Origin: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 09:35:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58808
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Jul 2023 09:35:08 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/ Frame 991F 11 KB
4 KB 63ms
62ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/omrhp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1929
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 25 Jul 2023 01:23:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/ Frame 991F 30 KB
11 KB 61ms
61ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/abg_lite.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:59:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28538
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:59:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 991F 41 KB
13 KB 64ms
64ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1929
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Jul 2024 01:23:07 GMT

GET
H/1.1

200
OK

user-sync
sync.adkernel.com/ Frame B993
Redirect Chain

https://ib.adnxs.com/getuid?%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D181225%26dsp%3D578434%26t%3Dimage%26uid%3D%24UID%26us_privacy%3D1---
https://sync.adkernel.com/user-sync?zone=181225&dsp=578434&t=image&uid=6113698130532189562&us_privacy=1---

42 B
353 B

205ms
73ms

Image
image/gif

174.137.133.32
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?zone=181225&dsp=578434&t=image&uid=6113698130532189562&us_privacy=1---
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1---&
Protocol: HTTP/1.1
Server: 174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.adkernel.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: close
Content-Length: 42

Redirect headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9cb189f4-5fba-40c6-b473-72b6a9d26473
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: //sync.adkernel.com/user-sync?zone=181225&dsp=578434&t=image&uid=6113698130532189562&us_privacy=1---
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_efe9fb35-b351-445a-a7bf-cf233302f5d3&gdpr=0&gdpr_consent=&us_privacy=1---
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=77d2511f-217d-4cd5-ab00-40ca3f33ff85&ssp=gumgum2&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10594788499610823859&ssp=gumgum2&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=bsw&i=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=0&gdpr_consent=&us_privacy=

35 B
250 B

82ms
81ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=0&gdpr_consent=&us_privacy=
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET

rmpssp
sync.1rx.io/usersync2/ Frame 7DF1
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_efe9fb35-b351-445a-a7bf-cf233302f5d3&obuid=ENC(Yjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzMCGN25SH3ZaX0k9Eq9WsFvjwN...
https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0
https://sync.1rx.io/usersync2/rmpssp?sub=outbrain&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dunruly%26uid%3Duuid%3D%5BRX_UUID%5D%26obUid%3DYjc-QdJTCCfTMUuCHVduaTmiipd2cZG-Uq3x5nzM...

0
0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74

35 B
250 B

61ms
61ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-fa763840-129b-5755-4167-d9f8635171e4$ip$38.132.118.74
Date: Tue, 11 Jul 2023 01:55:16 GMT
Connection: keep-alive
Content-Length: 127
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-Ktk8niJE2pehHoS4Uvh1vIJ46CQxmK5RGxiC~A

35 B
250 B

64ms
62ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-Ktk8niJE2pehHoS4Uvh1vIJ46CQxmK5RGxiC~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-Ktk8niJE2pehHoS4Uvh1vIJ46CQxmK5RGxiC~A
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a

35 B
250 B

64ms
62ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a
Date: Tue, 11 Jul 2023 01:55:16 GMT
Connection: keep-alive
X-CI-RTID: 2b7840d0-2243-4db3-b3d0-6b8bd0848be9
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=964902DB58AB4FCDA0596BF7610A8B60

35 B
250 B

134ms
60ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=964902DB58AB4FCDA0596BF7610A8B60
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 834792849
location: https://usersync.gumgum.com/usersync?b=snc&i=964902DB58AB4FCDA0596BF7610A8B60
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
https://usersync.gumgum.com/usersync?b=dit&i=di_510862e8c55d403395bb1

35 B
250 B

65ms
63ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=dit&i=di_510862e8c55d403395bb1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=dit&i=di_510862e8c55d403395bb1
date: Tue, 11 Jul 2023 01:55:16 GMT
content-type: image/gif
server: c
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET /
b1sync.zemanta.com/usersync/gumgum/ Frame 7DF1 0
0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9

35 B
250 B

63ms
61ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9
access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:16 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 7DF1
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=8xRLQOLR1WBf&ev=1&pid=558355

35 B
250 B

119ms
59ms

Image
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=8xRLQOLR1WBf&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://usersync.gumgum.com/usersync?b=pln&i=8xRLQOLR1WBf&ev=1&pid=558355
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

GET
H2 200 sync
ads.servenobid.com/ Frame 7DF1 0
358 B 74ms
69ms Image
image/avif 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=u_efe9fb35-b351-445a-a7bf-cf233302f5d3
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 6BB6 2 KB
2 KB 69ms
68ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: 4d1b5fa32f28eb0bf72c5390d43b45702c01332d022e555006a0c08a68a256d6

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1878
Content-Type: text/html
Date: Tue, 11 Jul 2023 01:55:16 GMT
Expires: 0
Keep-Alive: timeout=1, max=498
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/ Frame 2178 30 KB
11 KB 66ms
64ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/abg_lite.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 17:59:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28538
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Jul 2023 17:59:38 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/ Frame 2178 11 KB
4 KB 65ms
64ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230706/r20110914/elements/html/omrhp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1929
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 25 Jul 2023 01:23:07 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2178 0
0 244ms
102ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXDeES5NXomP-rrVpKGfEehgchQ7MwYudAvAmKKsk6jlQvMjQHpGgxirhCP73icMhYOyOYXIDQ8CsxVSLobFMtlJbcWzajkXl_2OWzbsLRu_TzvdtdDScpQVT1bzXrg3rtGmBEFktQAdeV-iD6Jz4B_gL8g9g8ROvbaC2nKb4zm0NhxL4yIiGwvHGy3Z3bu0anzw6FFkdkQpUMQkCLAjKpv1BKY1dTb4MIqjgp1kbVimjov-TWxW4AKuK4ZTqf-zxw1kwmfsuRXpV2bnglJEAW6T5rHVyqmtl52T0hp0mUILZSu6ysEbHBVrB4hAEqEyw4XLLOOC9swnYmEKcuD65C4abLycvDuYC2PPkk-MA_RIGDDrjiGRSxVibwPd97UuZbl5cjw6lWuIem1j3lOt4Cwf7qF-ga2Vx5pwqvzGE9qL0pdV5R3VTVHPMVsseY8C1Ur4XfJ2ZwN5iSdAhl6YFyZY2T3GXbOrPMHgiIPvJxUUaJ3SSQcrmSpOKC2naxHiQC-fW1EeOl0Y1Zb0pyLXjp84FHcM7C8FG9fQcQmecgr7AqMkQo34GDCImAuV3v0AAN5n-YJY6QaZdn-dIqj_-t3nATD4KBkRwmgP-IKonQbX8_GFd2QXzM-hV36rJv-k5mgnMqmKdIhsrQu-ZKQSYAzIZg8dduIZqS1MAs9siVojp9CVewWuaq_6U1P8CKgG5LJoWS8X7vcXFw0OXe1xaeD_v4Z1p6PlVz3NUemP2GTI8UKOtg7TML6KMGDGveG6QvoE8jygDLWAR0ZvYp4V7qGhrR1OuPyLsWxTvRhRgTnv48qrdOzxrBnDYl33EONwRCMu8L4aHe2F6HwLUeD9IEqS6ORu7-VR9fltUT8E2FMSKJa-PKoAsF0SqokM4GoCIsZ_CFNoUzUrUxzV06e2Ctop8SxVQ6pWdxfQN9z8tgqQ19YEZbk2h4dj11uyOPtIdA2C4CUYZDeUHQosQApZQjcpin8uuDCzsv7JFu7wCNXlZUnORgmiD5f0Sqmwy_mwMRasLqQCJ08TtDskmKCHmImuTZO5UZhS95mgvYmfDeNwzJTiqVnzyihgjlW06mf8CqMDvJ6NZIXMA8XbHtcdz0lzZjdzHal4yloL6JSIUVvwhRjslM1RlptiNxrhHpL_mKSYv5e-iASAwDKUnFTMWbjnqQpPHaZB5vPC_COn1baf5qt7hab7gsl3WV7eOF6WrQ5llA2aaz8X9T6WTG8iGStVxWfLjlwg-S13bZu2GbhdMoL8RVJxcWGvn-N215oZ0mCmPiWZWKPUdjnYNNF8iTp_AZJW1Z8e4-okDkhpbPwrJ9VRWOiRZSX6AafcF-FABwFQF3FRRqlOaBbyRiiEgkbScHrNIeRT8Clj0GjitiClh6Dllzcs_2LVrckFMmVvuxgJhw1cL_SzPSX7eo1sskqGNHF-u_L_EjxGw7Ln82SkLECFD9Yp4ZrISZvsq7w2t4nkHdh3qJO3HZJLTO6rwadkwnMapX2DXXSgNRKaMitxqCp5L-xnb4lXuZTYfuUX61J5W6Re10L9l0rtjduLFFUCdHUImMDE6RouJ-2uBxzEPsXxQMpE7dK8v4Y4pBCdmprg0-9rBdJMbcgTF-4nv928ZAFnbKdZ2Lr62UvzaA196sk3hcY2E_zsZLrdmnAgFE6ArzPDkaSFTuyBHNMe4mbrftSp0tUNmMY_KPVoxQU-RPaEcaHkLtJikPBpl1-HLVHUnYj7xdglV3vKdxBzpA1flc-8xvooppMiBHQ8TyPi47&sai=AMfl-YTk-2SfcpdX2OadhHdXeXiPNRqODj9gTxUjxYbT7r3Wppd-Nt1fi_3ylNXQ7cQOWK--rMyhXvSgIvpZxnm57CNtdh8N49tiFJyvVDHtSGupLFToza3n13tYTI8uYLoXaizLcS18k1ySJW-qk4PjVd4shrOolzl7ZZpqPf0CUJ6o4lBvCVf80I7vEwXNciFFVX7AE0iFaBgfq5XyTQxk5ZC3HCdzKyTSThtid6IGH7qZSCdhrrWFFwM2DvhxKSB-w3rOTwkvqJecBbhPamlKWVSh1PgDUR2kme6PwdJ0iruWyfGja3qP9Mfz13jFKPcoCEKR6PCZW6I8Sb8itG_UAmztBe_Fixyi53JZfsMxYCbdja0F7FjjhgAr2OPLS98HnI9efhqYxOy7GbYdPEWO-31BAo6gI_8NGuHavvx3TVdvwNLneRzXCNBDTTit-oZ0saciz2nwxJdpOhh4stddnpjeIgfSevq3BhURJ_RXdi4i3ExrU4VFTKRpmqIcf5bpcOHGgOBssp0W1OvBaA&sig=Cg0ArKJSzBfTmKKBics5EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230706.30734&arae=0&ftch=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 11 Jul 2023 01:55:16 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:16 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 2178 8 KB
4 KB 196ms
66ms Script
application/javascript 2600:1400:9000::6875:b641
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 39399d443a3ab24886d829aae4ac8b33492ab78b193aeadda64586f0467b5ef5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jul 2023 12:19:54 GMT
Server: UploadServer
ETag: "8f00be3da9a0f0d7a1a8c47b91364b82"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3377
Expires: Thu, 06 Jul 2023 12:35:20 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2178 41 KB
13 KB 67ms
66ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:23:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1929
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Jul 2024 01:23:07 GMT

GET
H2 200 8825659011494979369
s0.2mdn.net/simgad/ Frame 2178 6 KB
6 KB 70ms
67ms Image
image/png 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8825659011494979369

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14c9d37b7fee1b0b21bf9cd9e778418547bf8b3426c80424e25a24a85dcbd756

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 18:59:38 GMT
x-content-type-options: nosniff
age: 284138
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6133
x-xss-protection: 0
last-modified: Wed, 29 Mar 2023 20:23:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 06 Jul 2024 18:59:38 GMT

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 2178 35 B
2 KB 291ms
112ms Image
image/gif 2600:1400:9000:18b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=11428822&siteID=N3340.3424460DV360DISPLAY&creativeID=189203611&placementID=362694898&rnd=2874111367&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:9000:18b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Date: Tue, 11 Jul 2023 01:55:16 GMT
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: unsafe-url
Vary: Accept-Encoding
X-Frame-Options: ALLOWALL
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Tue, 11 Jul 2023 01:55:16 GMT

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 034B 2 KB
2 KB 99ms
67ms Document
text/html 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b622b829d93b3fb3d5822217802a2e92443fd921bca558fd3d2390e869c8191c

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 1709
Content-Type: text/html
Date: Tue, 11 Jul 2023 01:55:16 GMT
Expires: 0
Keep-Alive: timeout=1, max=497
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1

200
OK

RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
sync.targeting.unrulymedia.com/csync/ Frame A716
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings
https://ad.turn.com/r/cs?pid=45&rndcb=2793593741
https://sync.1rx.io/usersync/turn/6971283231311444352?dspret=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005

43 B
452 B

258ms
66ms

Image
image/gif

199.127.204.171
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: HTTP/1.1
Server: 199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:18 GMT
Server: Tengine
Connection: keep-alive
Content-Length: 43
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Tengine
Transfer-Encoding: chunked
Content-Type: text/html
Location: https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID
https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=50674DE4-1331-4B8B-A08E-394A47B0E933

0
329 B

60ms
59ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=50674DE4-1331-4B8B-A08E-394A47B0E933
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=50674DE4-1331-4B8B-A08E-394A47B0E933
date: Tue, 11 Jul 2023 01:55:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 115
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212205380595692

0
329 B

67ms
57ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212205380595692
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
referrer-policy: unsafe-url
server: 33XP010
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212205380595692
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET

cs
cs.minutemedia-prebid.com/ Frame A716
Redirect Chain

https://sync.1rx.io/usersync2/rise?redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11579%26id%3D%5BRX_UUID%5D
https://ad.turn.com/r/cs?pid=45&rndcb=7387660693
https://sync.1rx.io/usersync/turn/6971283231311444352?dspret=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005?redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21478%26id%3DRX-45a5c1a4-eba9-4f1a-acfa-bcedfb69e...
https://cs.minutemedia-prebid.com/cs?aid=21478&id=RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005

0
0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=194590&cb=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11583%26id%3D
https://cs-server-s2s.yellowblue.io/cs?aid=11583&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB

0
329 B

59ms
58ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11583&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cs-server-s2s.yellowblue.io/cs?aid=11583&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent=
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=6113698130532189562&gdpr=0&gdpr_consent=

0
329 B

169ms
61ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=6113698130532189562&gdpr=0&gdpr_consent=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1f005655-9a0c-44f9-b03a-bae04a6c912f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=6113698130532189562&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85

0
330 B

173ms
59ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Location: https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85
Date: Tue, 11 Jul 2023 01:55:16 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame A716
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11601&id=fa2f6c8560a3fb3df66f6dabfe34fb7c&gdpr_consent=&gdpr=0

0
329 B

60ms
59ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=fa2f6c8560a3fb3df66f6dabfe34fb7c&gdpr_consent=&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cs.yellowblue.io/cs?aid=11601&id=fa2f6c8560a3fb3df66f6dabfe34fb7c&gdpr_consent=&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1689040516897059-321

GET
H2 200 cksync.php
contextual.media.net/ Frame A716 61 B
458 B 105ms
98ms Image
image/gif 23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=25&type=ris&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11585%26id%3D%3Cvsid%3E

Requested by

Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:16 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:16 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d

0
329 B

60ms
59ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-154
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=abffe4cf-3d63-416b-878c-7c5dbef394e1&gdpr_consent=null&gdpr=0

0
329 B

59ms
59ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=abffe4cf-3d63-416b-878c-7c5dbef394e1&gdpr_consent=null&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=abffe4cf-3d63-416b-878c-7c5dbef394e1&gdpr_consent=null&gdpr=0
date: Tue, 11 Jul 2023 01:55:16 GMT
server: _
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame A716
Redirect Chain

https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11591&id=y-6Lc0.P5E2uL5PG8Imzqe14DCfwliIDHt~A&gdpr_in_effect=0

0
329 B

221ms
61ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11591&id=y-6Lc0.P5E2uL5PG8Imzqe14DCfwliIDHt~A&gdpr_in_effect=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11591&id=y-6Lc0.P5E2uL5PG8Imzqe14DCfwliIDHt~A&gdpr_in_effect=0
date: Tue, 11 Jul 2023 01:55:16 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

cs
cs.yellowblue.io/ Frame A716
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11587&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0

0
329 B

222ms
61ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11587&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
date: Tue, 11 Jul 2023 01:55:16 GMT
content-length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=562615&ev=1&us_privacy=[US_PRIVACY]&gdpr=0&gdpr_consent=&rurl=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11592%26uid%3D%25%25VGUID%25%25
https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0

0
329 B

172ms
60ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://ads.yieldmo.com/pbsync?is=rise&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11584%26uid%3D$UID
https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=

0
329 B

173ms
59ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame A716
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=77&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11600&id=8004212043844932477&gdpr=0&gdpr_consent=

0
330 B

220ms
60ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11600&id=8004212043844932477&gdpr=0&gdpr_consent=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11600&id=8004212043844932477&gdpr=0&gdpr_consent=
date: Tue, 11 Jul 2023 01:55:16 GMT
content-length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame A716
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=72a2c5b1-1695-4a96-a505-fc9bd350c860

0
329 B

173ms
60ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=72a2c5b1-1695-4a96-a505-fc9bd350c860
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=72a2c5b1-1695-4a96-a505-fc9bd350c860
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame A716 0
340 B 72ms
67ms Image
image/avif 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=352&uid=1hfVTYLakj_s
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://csync.loopme.me/?pubid=11555&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&redirect=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21511%26id%3D%7Bdevice_id%7D
https://cs.minutemedia-prebid.com/cs?aid=21511&id=8f0c7cb8-4a61-4c7d-9f55-2872b48a4978&gdpr_consent=[USER_CONSENT]&gdpr=[GDPR]

0
330 B

240ms
60ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21511&id=8f0c7cb8-4a61-4c7d-9f55-2872b48a4978&gdpr_consent=[USER_CONSENT]&gdpr=[GDPR]
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21511&id=8f0c7cb8-4a61-4c7d-9f55-2872b48a4978&gdpr_consent=[USER_CONSENT]&gdpr=[GDPR]
date: Tue, 11 Jul 2023 01:55:16 GMT
server: _
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=44808&gdpr=0&gdpr_consent=&callback_url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21505%26id%3D$%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=44808&gdpr=0&gdpr_consent=&callback_url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21505%26id%3D%24%7BUSER_ID%7D&crf=1
https://cs.minutemedia-prebid.com/cs?aid=21505&id=90c34110-3d4e-53c0-b414-0545d0b8b3c1

0
330 B

66ms
60ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21505&id=90c34110-3d4e-53c0-b414-0545d0b8b3c1
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21505&id=90c34110-3d4e-53c0-b414-0545d0b8b3c1
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=3r9HMldH&gdpr=0&gdpr_consent=
https://cs.minutemedia-prebid.com/cs?aid=21496&id=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0

0
331 B

236ms
57ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21496&id=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21496&id=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
date: Tue, 11 Jul 2023 01:55:16 GMT
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=minutemedia
https://cs.minutemedia-prebid.com/cs?aid=21503&id=1d1ea802-532c-43e0-b670-ad442f4cee1c

0
330 B

283ms
107ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21503&id=1d1ea802-532c-43e0-b670-ad442f4cee1c
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: //cs.minutemedia-prebid.com/cs?aid=21503&id=1d1ea802-532c-43e0-b670-ad442f4cee1c
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://x.bidswitch.net/sync?ssp=minutemedia&gdpr=0&gdpr_consent=&user_id=%s
https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dminutemedia%26expires%3D30...
https://x.bidswitch.net/sync?dsp_id=429&user_id=90c34110-3d4e-53c0-b414-0545d0b8b3c1&ssp=minutemedia&expires=30&user_group=1&gdpr=0&gdpr_consent=
https://cs.minutemedia-prebid.com/cs?aid=21490&id=77d2511f-217d-4cd5-ab00-40ca3f33ff85

0
330 B

59ms
59ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21490&id=77d2511f-217d-4cd5-ab00-40ca3f33ff85
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Location: //cs.minutemedia-prebid.com/cs?aid=21490&id=77d2511f-217d-4cd5-ab00-40ca3f33ff85
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://visitor.omnitagjs.com/visitor/bsync?uid=a1aca1d7a7acd80e26595e82223f1e6f&name=MinuteMedia&gdpr=0&gdpr_consent=&url=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21502%26id%3D%5BBUYER...
https://cs.minutemedia-prebid.com/cs?aid=21502&id=da9d44676b65b29a232b3c70007e2cd7

0
330 B

59ms
59ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21502&id=da9d44676b65b29a232b3c70007e2cd7
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
location: https://cs.minutemedia-prebid.com/cs?aid=21502&id=da9d44676b65b29a232b3c70007e2cd7
p3p: CP="CAO PSA OUR"
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 4
content-length: 0
expires: 0

GET

prebid
rtb.openx.net/sync/ Frame 1A56
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21492%26uid%3D
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F1%2F2446%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D38bc671c-6131-44bc-bfdd-1dc5d1...
https://prebid.a-mo.net/cchain/1/2446?gdpr=0&gdpr_consent=&us_privacy=&A=38bc671c-6131-44bc-bfdd-1dc5d12a8d38&bidder=sovrn&cbx=aHR0cHM6Ly9jcy5taW51dGVtZWRpYS1wcmViaWQuY29tL2NzP2FpZD0yMTQ5MiZ1aWQ9&u...
https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F3%2F2446%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26A%3D38bc671c-6131-44bc-bfdd-1dc5d12a8d38%26...

0
0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=59&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]
https://cs.minutemedia-prebid.com/cs?aid=21498&id=8004212043844932477&gdpr=0&gdpr_consent=

0
330 B

239ms
61ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21498&id=8004212043844932477&gdpr=0&gdpr_consent=
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21498&id=8004212043844932477&gdpr=0&gdpr_consent=
date: Tue, 11 Jul 2023 01:55:16 GMT
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21488%26id%3D%24UID
https://cs.minutemedia-prebid.com/cs?aid=21488&id=G9dTiRZHFS2J8TOYTsGYe0sx

0
330 B

102ms
100ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21488&id=G9dTiRZHFS2J8TOYTsGYe0sx
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cs.minutemedia-prebid.com/cs?aid=21488&id=G9dTiRZHFS2J8TOYTsGYe0sx
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21480&id=1804524819996289569111

0
330 B

237ms
59ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21480&id=1804524819996289569111
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21480&id=1804524819996289569111
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21485%26puid%3D33XUSERID33X
https://cs.minutemedia-prebid.com/cs?aid=21485&puid=212205373389114

0
330 B

65ms
59ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21485&puid=212205373389114
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
referrer-policy: unsafe-url
server: 33XP011
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cs.minutemedia-prebid.com/cs?aid=21485&puid=212205373389114
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ad.360yield.com/server_match?partner_id=2073&r=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21489%26id%3D%7BPUB_USER_ID%7D
https://cs.minutemedia-prebid.com/cs?aid=21489&id=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9

0
330 B

282ms
105ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21489&id=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21489&id=9b6a8f5b-0673-4f7e-b163-07dd2963c5f9
access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:16 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ads.yieldmo.com/pbsync?is=mmed&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]&redirectUri=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21486%26uid%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21486&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]

0
330 B

235ms
58ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21486&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cs.minutemedia-prebid.com/cs?aid=21486&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=[US_PRIVACY]
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=196326&cb=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21476%26id%3D
https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZKy2gPeKFcFmKMEQLWWTawAA%263820

0
330 B

89ms
88ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZKy2gPeKFcFmKMEQLWWTawAA%263820
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cs.minutemedia-prebid.com/cs?aid=21476&id=ZKy2gPeKFcFmKMEQLWWTawAA%263820
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21504%26uid%3D%5BUID%5D
https://cs.minutemedia-prebid.com/cs?aid=21504&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d

0
330 B

115ms
109ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21504&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-154
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cs.minutemedia-prebid.com/cs?aid=21504&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://u.openx.net/w/1.0/cm?id=29975467-6f1b-4e06-b545-920b22ea49b2&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21477%26id%3D
https://cs.minutemedia-prebid.com/cs?aid=21477&id=03fb3b23-bee8-4887-96da-b9feb2fa96c6

0
330 B

284ms
108ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21477&id=03fb3b23-bee8-4887-96da-b9feb2fa96c6
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cs.minutemedia-prebid.com/cs?aid=21477&id=03fb3b23-bee8-4887-96da-b9feb2fa96c6
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=562760&ev=1&us_privacy=[US_PRIVACY]&gdpr=0&gdpr_consent=&rurl=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21494%26id%3D%25%25VGUID%25%25
https://cs.minutemedia-prebid.com/cs?aid=21494&id=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562760&gdpr_consent=&gdpr=0

0
330 B

282ms
107ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21494&id=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562760&gdpr_consent=&gdpr=0
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://cs.minutemedia-prebid.com/cs?aid=21494&id=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562760&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

GET /
b1sync.zemanta.com/usersync/minutemedia/ Frame 1A56 0
0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21484%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21484&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=6113698130532189562

0
330 B

62ms
62ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21484&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=6113698130532189562
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8489becc-7dd4-4c45-8a0e-ab2836cce6b8
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cs.minutemedia-prebid.com/cs?aid=21484&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=6113698130532189562
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=161683&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21482%26id%3D%23PMUID
https://cs.minutemedia-prebid.com/cs?aid=21482&id=50674DE4-1331-4B8B-A08E-394A47B0E933

0
330 B

282ms
106ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21482&id=50674DE4-1331-4B8B-A08E-394A47B0E933
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21482&id=50674DE4-1331-4B8B-A08E-394A47B0E933
date: Tue, 11 Jul 2023 01:55:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 113
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://cs.admanmedia.com/sync/minute_media?gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21497%26puid%3D%5BUID%5D
https://cs.minutemedia-prebid.com/cs?aid=21497&puid=7d367312-dbdf-470d-a118-4944e664fed6

0
330 B

59ms
59ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21497&puid=7d367312-dbdf-470d-a118-4944e664fed6
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx
Transfer-Encoding: chunked
X-Frame-Options: DENY
Location: https://cs.minutemedia-prebid.com/cs?aid=21497&puid=7d367312-dbdf-470d-a118-4944e664fed6
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET

c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
sync.1rx.io/usersync/tradedesk/ Frame 1A56
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sportority
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2377386944
https://sync.1rx.io/usersync/tradedesk/c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

0
0

GET
H2

200

cs
cs.minutemedia-prebid.com/ Frame 1A56
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21495%26id%3D$UID&partner=minutemedia
https://cs.minutemedia-prebid.com/cs?aid=21495&id=ua-8f6538e6-7221-3c91-9e5a-837ae1e5f9bc

0
330 B

235ms
58ms

Image
application/javascript

34.225.236.157
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.minutemedia-prebid.com/cs?aid=21495&id=ua-8f6538e6-7221-3c91-9e5a-837ae1e5f9bc
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Server: 34.225.236.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-236-157.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-rtb.minutemedia-prebid.com/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.minutemedia-prebid.com/cs?aid=21495&id=ua-8f6538e6-7221-3c91-9e5a-837ae1e5f9bc
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 1A56 0
341 B 75ms
67ms Image
image/avif 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=348&uid=Dbf_TDRtCp_mm
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-rtb.minutemedia-prebid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 956F 34 KB
10 KB 181ms
61ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: feeb98f30c6b03b47d474792b88ea05241e469d24f193cafa3927310602ce670

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9478
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

POST
H3 200 ucl Show response
capi.connatix.com/tr/ Frame 5EC0 0
284 B 83ms
83ms XHR
application/x-protobuf 104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ucl?v=293038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c5b6f1fdb29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

POST
H3 200 pls Show response
capi.connatix.com/core/ Frame 5EC0 5 KB
3 KB 120ms
120ms XHR
application/x-protobuf 104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=293038
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0489fcca59fd360425d0e164653e403966f22c2a0407229d0cc3d2a89fe6250b

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c5b6f29db29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d17%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIndex%26api-tier%3d2%26uid%3d&gdpr=0
https://cks.connatix.com/cks?pid=17&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Index&api-tier=2&uid=ZKy2gPeKFcFmKMEQLWWTawAA%263820

139 B
214 B

91ms
53ms

Script
application/javascript

172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=17&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Index&api-tier=2&uid=ZKy2gPeKFcFmKMEQLWWTawAA%263820
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8aa8b19ec41fd25b95514568faacf7056d091a8c0d94b0787acd380337cb94c1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c5f6dc2d9b5-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cks.connatix.com/cks?pid=17&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Index&api-tier=2&uid=ZKy2gPeKFcFmKMEQLWWTawAA%263820
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d15%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dBeeswax%26api-tier%3d2%26uid%3d{userid}&gdpr=0
https://cks.connatix.com/cks?pid=15&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Beeswax&api-tier=2&uid=AADg507JWW0AACFXxNbRlQ&gdpr=0

132 B
247 B

52ms
52ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=15&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Beeswax&api-tier=2&uid=AADg507JWW0AACFXxNbRlQ&gdpr=0
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 813138eae7a0e5e6772ef6189c64af025e2db1a11716ab148154eb64d6a85d7b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f7cda53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=15&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Beeswax&api-tier=2&uid=AADg507JWW0AACFXxNbRlQ&gdpr=0
Date: Tue, 11 Jul 2023 01:55:16 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1&gdpr=0
https://cks.connatix.com/cks?pid=19&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttl=1691632516

146 B
254 B

57ms
57ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=19&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttl=1691632516
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1eeca17ebd45a991f9c798752aff19623af82f979c7b33d3ed155099388c432

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f7dda53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cks.connatix.com/cks?pid=19&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&ttl=1691632516
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 213

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ad.turn.com/r/cs?pid=67&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d21%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dAmobee%26api-tier%3d2%26uid%3D%23USER_ID%23&gdpr=0
https://cks.connatix.com/cks?pid=21&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Amobee&api-tier=2&uid=6971283231311444352

129 B
277 B

44ms
44ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=21&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Amobee&api-tier=2&uid=6971283231311444352
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79449d57af9d90f024142fb0600e0c469c1b6706f3aa4a156bc2d1ebcd0201a0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f80da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=21&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Amobee&api-tier=2&uid=6971283231311444352
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d25%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dTripleLift%26api-tier%3d2%26uid%3d%24UID&gdpr=0
https://cks.connatix.com/cks?pid=25&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=TripleLift&api-tier=2&uid=1804524819996289569111

132 B
243 B

53ms
52ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=25&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=TripleLift&api-tier=2&uid=1804524819996289569111
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c77557c0573985e2e61b53b5ebb3ceff12894ec396192f91f96841a3f2243ec1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f81da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=25&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=TripleLift&api-tier=2&uid=1804524819996289569111
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d6%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dAppNexus%26api-tier%3d2%26uid%3d%24UID&gdpr=0
https://cks.connatix.com/cks?pid=6&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=AppNexus&api-tier=2&uid=6113698130532189562&gdpr=0

128 B
240 B

44ms
44ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=6&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=AppNexus&api-tier=2&uid=6113698130532189562&gdpr=0
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70acf58a7602eccda90ae74518cd4e412e94aefea5454b0b2cc09e81926f8800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f82da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: dfe5861a-d071-4aa9-bc4b-6e9242644045
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cks.connatix.com/cks?pid=6&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=AppNexus&api-tier=2&uid=6113698130532189562&gdpr=0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 2D02
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east&gdpr=0
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0

281 B
554 B

96ms
60ms

Document
text/html

23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:16 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 11 Jul 2023 01:55:16 GMT
location: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0
server: AkamaiGHost

GET
H2 200 userSync.js Show response
ads.pubmatic.com/AdServer/js/ Frame 5EC0 7 KB
3 KB 76ms
62ms Script
application/javascript 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/userSync.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf105a11e980fd6a1810ee3e340f707b21c47353fd7dd00401791678bf904381

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: gzip
x-check-cacheable: YES
last-modified: Tue, 21 Mar 2023 06:09:39 GMT
x-akamai-pragma-client-ip: 23.44.237.207, 4.7.166.99
x-serial: 66382
server: Apache
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-type: application/javascript
cache-control: max-age=127159
accept-ranges: bytes
content-length: 2358
expires: Wed, 12 Jul 2023 13:14:35 GMT

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=561340&daaqp=1&ev=1&rurl=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d13%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dPulsePoint%26api-tier%3d2%26uid%3d%...
https://cks.connatix.com/cks?pid=13&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=PulsePoint&api-tier=2&uid=8xRLQOLR1WBf

122 B
238 B

45ms
45ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=13&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=PulsePoint&api-tier=2&uid=8xRLQOLR1WBf
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd1eb2507a730f36f2247c1891eca18e859b667ed8fa6b239573cd3d749eda02

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f84da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://cks.connatix.com/cks?pid=13&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=PulsePoint&api-tier=2&uid=8xRLQOLR1WBf
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://i.ctnsnet.com/int/cm?exc=24&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d28%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dCrimtan%26api-tier%3d2%26uid%3d%5Buser_id%5D&gdpr=0
https://cks.connatix.com/cks?pid=28&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Crimtan&api-tier=2&uid=2be7e92695f64149bd7353b755441339

142 B
251 B

53ms
53ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=28&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Crimtan&api-tier=2&uid=2be7e92695f64149bd7353b755441339
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f44b7bda0efd7cf5853fd22749052ab900603c35cfc97ca62a8afffd713c3454

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f86da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cks.connatix.com/cks?pid=28&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Crimtan&api-tier=2&uid=2be7e92695f64149bd7353b755441339
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cks Show response
cks.connatix.com/
Redirect Chain

https://csync.loopme.me/?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d18%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dLoopMe%26api-tier%3d2%26uid%3D%7Bdevice_id%7D%26pubid%3D11186&gdpr=0
https://cks.connatix.com/cks?pid=18&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=LoopMe&api-tier=2&uid=59817902-f959-462e-84c0-252cf780b358&pubid=11186&gdpr=0

146 B
159 B

44ms
42ms

Script
application/javascript

172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=18&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=LoopMe&api-tier=2&uid=59817902-f959-462e-84c0-252cf780b358&pubid=11186&gdpr=0
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed5d8b8864bd9707fb3d34cd90b6fecd4f46027144280ef33424f359961d767d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c609f96d9b5-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=18&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=LoopMe&api-tier=2&uid=59817902-f959-462e-84c0-252cf780b358&pubid=11186&gdpr=0
date: Tue, 11 Jul 2023 01:55:16 GMT
server: _
content-length: 0

GET
H3 200 712202.gif Show response
id.rlcdn.com/ 42 B
60 B 85ms
75ms Script
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://id.rlcdn.com/712202.gif?cparams=3b3525d7c1e0494ca886b79ce71081e5&gdpr=0
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=105&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d9%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dCentro%26api-tier%3d2%26uid%3d{userId}&...
https://cks.connatix.com/cks?pid=9&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Centro&api-tier=2&uid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&gdpr=0

159 B
263 B

50ms
50ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=9&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Centro&api-tier=2&uid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&gdpr=0
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a89c7a08a7258c662d0435ed808e3f3a1fcf00c6010f3fd68e81a245afa2cd62

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f87da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:15 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cks.connatix.com/cks?pid=9&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Centro&api-tier=2&uid=e804e58f-3347-4480-bf5a-68379a8f94a3-64acb681-5553&gdpr=0
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8600&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d10%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dSpotX%26api-tier%3d2%26uid%3d%24SPOTX...
https://cks.connatix.com/cks?pid=10&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=SpotX&api-tier=2&uid=f9bbc2a7-1f8d-11ee-845e-1bbc3ab70203

146 B
253 B

44ms
44ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=10&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=SpotX&api-tier=2&uid=f9bbc2a7-1f8d-11ee-845e-1bbc3ab70203
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5df325116d5f77ddd48f48099a3e207a153733fc2676c8e0d2d74ea175c7e570

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f88da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
location: https://cks.connatix.com/cks?pid=10&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=SpotX&api-tier=2&uid=f9bbc2a7-1f8d-11ee-845e-1bbc3ab70203
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 245
content-length: 0

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://connatix-supply-partners.tremorhub.com/sync?UISCX=3b3525d7c1e0494ca886b79ce71081e5&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d5%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dTel...
https://cks.connatix.com/cks?pid=5&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Telaria&api-tier=2&uid=ab6558a755ef433ca7d8a01d374a6f3f

141 B
250 B

46ms
46ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=5&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Telaria&api-tier=2&uid=ab6558a755ef433ca7d8a01d374a6f3f
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da3e5a45fc4a8ea51d65d92fbb0b115e02e593c44c6a194403b74dff0e7ff405

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f89da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=5&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Telaria&api-tier=2&uid=ab6558a755ef433ca7d8a01d374a6f3f
date: Tue, 11 Jul 2023 01:55:16 GMT
server: nginx
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame CB4C 3 KB
4 KB 79ms
69ms Document
text/html 54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 69b71bd24e37e88c87ce45a3fd8f7b3a759695960774d8b341996dea77e25f65

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
content-type: text/html
date: Tue, 11 Jul 2023 01:55:16 GMT
server: istio-envoy
x-envoy-upstream-service-time: 10

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://vop.sundaysky.com/sync/dmp?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d1%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dSundaySky%26api-tier%3d2%26uid%3d%24{ssky_uuid}&gdpr=0
https://vop.sundaysky.com/sync/dmp?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d1%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dSundaySky%26api-tier%3d2%26uid%3d%24{ssky_uuid}&gdpr=0&_...
https://cks.connatix.com/cks?pid=1&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=SundaySky&api-tier=2&uid=d6.d904cf9ee01b4ca2b69d718d1b9003b1

144 B
251 B

203ms
202ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=1&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=SundaySky&api-tier=2&uid=d6.d904cf9ee01b4ca2b69d718d1b9003b1
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a495828979d07ec2a1a59321549ce3797dc3a09866f4b54265877663b9ab01a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c689d81da53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=1&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=SundaySky&api-tier=2&uid=d6.d904cf9ee01b4ca2b69d718d1b9003b1
date: Tue, 11 Jul 2023 01:55:17 GMT
x-content-type-options: nosniff
content-length: 0
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=connatix&cspid=25&append=0&cb=${ADELPHIC_CACHE_BUSTER}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d29%26ev%3d3b3525d7c1e0494ca88...
https://cks.connatix.com/cks?pid=29&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Adelphic&api-tier=2&uid=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a

146 B
254 B

48ms
48ms

Script
application/javascript

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=29&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Adelphic&api-tier=2&uid=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c81aea1d8a56b6d85ec648d8f381d443ef7eb232eac13036203be58a2c98267f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c640f8bda53-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

Location: https://cks.connatix.com/cks?pid=29&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Adelphic&api-tier=2&uid=2cd0e088-b1f0-49c2-a379-7fe7c5982a7a
Date: Tue, 11 Jul 2023 01:55:16 GMT
Connection: keep-alive
X-CI-RTID: fa2da07e-3b9d-47d5-a2fd-54a29de6163a
Content-Length: 177
Content-Type: text/html; charset=utf-8

GET
H3

200

us Show response
capi.connatix.com/core/
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&source=connatix&uid=3b3525d7c1e0494ca886b79ce71081e5&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d26%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pn...
https://cks.connatix.com/cks?pid=26&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=Synacor&api-tier=2&uid=964902DB58AB4FCDA0596BF7610A8B60&direct=1
https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=964902DB58AB4FCDA0596BF7610A8B60&UserId=&tier=2

0
231 B

98ms
97ms

Script
application/json

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=964902DB58AB4FCDA0596BF7610A8B60&UserId=&tier=2
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c65bb6bdb29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
location: https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=964902DB58AB4FCDA0596BF7610A8B60&UserId=&tier=2
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 7e4d6c640f8fda53-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3

200

us
capi.connatix.com/core/ Frame 5EC0
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=7cf4c6c4-b915-4cbd-83cc-28c0f662a829&ph=51e220cb-8c97-4a65-b047-91c933b79b78&r=https%3a%2f%2fcapi.connatix.com%2fcore%2fus%3fDemandPartner%3d8%26UserId%3d3b3525d7...
https://capi.connatix.com/core/us?DemandPartner=8&UserId=3b3525d7c1e0494ca886b79ce71081e5&DemandPartnerName=OpenX&tier=2&DemandPartnerUserId=5698a980-68e6-4a3c-a053-03356672775d

0
231 B

102ms
102ms

Image
application/json

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/core/us?DemandPartner=8&UserId=3b3525d7c1e0494ca886b79ce71081e5&DemandPartnerName=OpenX&tier=2&DemandPartnerUserId=5698a980-68e6-4a3c-a053-03356672775d
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c5ead39db29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://capi.connatix.com/core/us?DemandPartner=8&UserId=3b3525d7c1e0494ca886b79ce71081e5&DemandPartnerName=OpenX&tier=2&DemandPartnerUserId=5698a980-68e6-4a3c-a053-03356672775d
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

us
capi.connatix.com/core/ Frame 5EC0
Redirect Chain

https://cs.media.net/cksync?cs=37&type=cn&redirect=https%3a%2f%2fcapi.connatix.com%2fcore%2fus%3fDemandPartner%3d31%26UserId%3d3b3525d7c1e0494ca886b79ce71081e5%26DemandPartnerName%3dMediaNet%26tier...
https://capi.connatix.com/core/us?DemandPartner=31&UserId=3b3525d7c1e0494ca886b79ce71081e5&DemandPartnerName=MediaNet&tier=2&DemandPartnerUserId=3320421111524274000V10

0
231 B

96ms
95ms

Image
application/json

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/core/us?DemandPartner=31&UserId=3b3525d7c1e0494ca886b79ce71081e5&DemandPartnerName=MediaNet&tier=2&DemandPartnerUserId=3320421111524274000V10
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c648923db29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
X-Check-Cacheable: YES
Server: Apache
X-Akamai-Pragma-Client-IP: 23.44.237.140, 4.7.166.102
X-Serial: 66004
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Location: https://capi.connatix.com/core/us?DemandPartner=31&UserId=3b3525d7c1e0494ca886b79ce71081e5&DemandPartnerName=MediaNet&tier=2&DemandPartnerUserId=3320421111524274000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H3

200

report
capi.connatix.com/us/google/ Frame 5EC0
Redirect Chain

https://capi.connatix.com/us/google/pixel?tier=2&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=connatix&google_hm=M2IzNTI1ZDdjMWUwNDk0Y2E4ODZiNzljZTcxMDgxZTU&extra1=3b3525d7c1e0494ca886b79ce71081e5&gdpr=0&google_redir=https%3a%2f%2fcapi.connatix....
https://capi.connatix.com/us/google/report?extra1=3b3525d7c1e0494ca886b79ce71081e5&gdpr=0

82 B
82 B

91ms
90ms

Image
image/gif

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/google/report?extra1=3b3525d7c1e0494ca886b79ce71081e5&gdpr=0
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 7e4d6c61cb72db29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://capi.connatix.com/us/google/report?extra1=3b3525d7c1e0494ca886b79ce71081e5&gdpr=0
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E1EA 1 KB
647 B 62ms
61ms Document
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58817
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Jul 2023 09:34:59 GMT
etag: 48472445140208031
expires: Tue, 11 Jul 2023 09:34:59 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame ECF7 0
48 B 67ms
65ms Script
text/plain 162.248.18.34
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 50ms
50ms Ping
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0DZ7LHF5PZ&gtm=45je37a0&_p=1555038604&cid=777521527.1689040509&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=2&sid=1689040508&sct=1&seg=0&dl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&dt=Wells%20Fargo%20VP%20Carl%20Nelson%20%27invited%20subordinate%20to%20exercise%20and%20shower%20with%20him%27%3A%20lawsuit&en=Buffer&_ee=1&ep.event_category=JW%20Player%20Video&ep.event_label=https%3A%2F%2Fcdn.jwplayer.com%2Fmanifests%2FZOo6mQs1.m3u8&ep.event_action=Buffer&ep.non_interaction=true&_et=1904
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0DZ7LHF5PZ&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2002 1 KB
647 B 68ms
65ms Document
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58817
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Jul 2023 09:34:59 GMT
etag: 48472445140208031
expires: Tue, 11 Jul 2023 09:34:59 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 94DA 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a009bf71892e2bb5d4ec4bcc3424a68f899c06058df8b67087ac627be31213b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 94DA 0
0 87ms
81ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJVHeM3Tf7k1-lDH6oGVrB4g7kxbcygIdZGAPVs4Sb5-JnbdNv6fayRogwLslWkmagKCjgijDkfsGXWW2272pblt6-5GJ73kMZTVk-6Va1jzRBRWVknBKDN6u1HhtIyTfKtaPceZ9Lj82vez-Y7s8dxzh92pP4Hu69KP9qIKFWzdi9hBSypwxMnyWdrNe-ZWdtcn3UnGhB6UkUClF6JQAvORj4lCJwDUOLDIjAuK_8ufN1oMEZLDbvC9xhkQeapmQbwISWYbLj2txvupyHeb7rFWonkj6oagORpntJ9mvLtcGnot3ENVKAbHYcM9td1DwXQ6-eVmHYBRuvk9K9d4ptpFpWx0A-PRQZ0nRB9xGUTw&sai=AMfl-YTHVfZGSBrfNC--YmKTkJlYzS5AGV5xjBusu_7ltGB_Wi5vLOzPqjJPyU5m2Rw380Q73j4TEoB8y3gR7Dm89ga0FFUC2HEQjKEmwSjimK9dx1yhdzx5Y9_n8EaAEW-Uwz8B9qn2pB9YNmcaMQGKd04&sig=Cg0ArKJSzJFs4BvmZO7bEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 11 Jul 2023 01:55:16 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A193 1 KB
647 B 62ms
61ms Document
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58817
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Jul 2023 09:34:59 GMT
etag: 48472445140208031
expires: Tue, 11 Jul 2023 09:34:59 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 991F 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9236123fde7413c0d39bdba12d66699854c90d8389846c8918ea49f2579fbb0a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 991F 0
0 83ms
82ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstLizJ6HPoGJ6MG4pjrckrwNvHLkil_thEUjWh6cjmW_RF2tcp6CCvmnRgaW5Kf7V95qaqPGQKJy8ZG5_BwmcuKOwtEo7gsYB8636jYSlEuzFn_iO_BJKogwhoRUPMKw3ofo2HtIQQChLLwYL9c7OGS92i8phdLahbSwpMQDqAKRHZ6h3TuqLbY8fBa1CdqGArnpPCNSg9DUxFrr9NT5YW7tmbYbazgudvvz_ijqyQETU9e5zpJUmS6wJJPXvh6wYnrAwknq_VwVUdGcq9XaykD9RZUKgm9BvOGdVBaZIU9ZGQRJ1P6x2EYqR37fS6d3b55UkWUMXQY0WBxocnMKEceygluJwu2a0aJwKjEnp4&sai=AMfl-YSnRA_8xb3itRaB5SnzxBsW6hKcPK650WTwuPnfNZ9qI7IZuCgDEbrazRsQhSuJ8UDt-XPZ6NqshgcJple7URJv9WlhmCVjgUCzVapspTY2eR5b0AuLBegFlvYe4GCi_GqcJjV8p8x2pUHBdNb3mCM&sig=Cg0ArKJSzOm54WGfumAHEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 11 Jul 2023 01:55:16 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 1EBB 2 KB
814 B 78ms
77ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5adb88524e24e50

Requested by

Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1---&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.adkernel.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET e9d4ff858b5e32317e843f5ed11b2659.gif
cs.iqzone.com/ Frame 9F40 0
0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame E471
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=atm&i=ZKy2gAAAAHvPCgAt&gdpr=0&gdpr_consent=

35 B
250 B

60ms
60ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=ZKy2gAAAAHvPCgAt&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:16 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Tue, 11 Jul 2023 01:55:16 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=ZKy2gAAAAHvPCgAt&gdpr=0&gdpr_consent=
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mia-kmia1760066-MIA
x-timer: S1689040517.720290,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 96BC 170 B
189 B 87ms
79ms Document
image/png 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9lZmU5ZmIzNS1iMzUxLTQ0NWEtYTdiZi1jZjIzMzMwMmY1ZDM=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9DCD 16 KB
6 KB 81ms
81ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=126794
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Tue, 11 Jul 2023 01:55:16 GMT
expires: Wed, 12 Jul 2023 13:08:30 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame F4B6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

35 B
250 B

61ms
60ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:16 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: private,no-cache, must-revalidate
content-length: 193
content-type: text/html
date: Tue, 11 Jul 2023 01:55:16 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 3170
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=ZKy2gMCo8YIAAA4Zog4AAAAA

35 B
250 B

59ms
59ms

Document
image/gif

52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=ZKy2gMCo8YIAAA4Zog4AAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:17 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Tue, 11 Jul 2023 01:55:17 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=ZKy2gMCo8YIAAA4Zog4AAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 2
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad48.dc4p.scaleout.jp
X-SO-IP: 38.132.118.74
X-SO-Key: ZKy2gMCo8YIAAA4Zog4AAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"38.132.118.74","key":"ZKy2gMCo8YIAAA4Zog4AAAAA","privacy_sensitive":false,"uid":"ZKy2gMCo8YIAAA4Zog4AAAAA","upstream_id":"m-ad48"}
X-SO-LB-Hostname: m-tgng26.dc4p.scaleout.jp
X-SO-UID: ZKy2gMCo8YIAAA4Zog4AAAAA
X-SO-Upstream-ID: m-ad48

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
194 B 476ms
115ms Script
application/javascript 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://tr.outbrain.com/cachedClickId?marketerId=00c0feecc40196b47a738de28ad44794ac,00c0feecc40196b47a738de28ad44794ac
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
X-TraceId: e0be6e376f25b4d129947af5a346fe37
Content-Length: 35
Content-Type: application/javascript

GET
H/1.1 200
OK 00c0feecc40196b47a738de28ad44794ac Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
394 B 312ms
166ms Script
text/html 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://wave.outbrain.com/mtWavesBundler/handler/00c0feecc40196b47a738de28ad44794ac
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:18 GMT
ob-sent-time: 1689040517971
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
X-RG: NA
Cache-Control: max-age=1200
X-CC: US
Connection: keep-alive
X-TraceId: 9fb232ef31f15d36e3e4d7c6e38fd02c
Content-Length: 2
CDN-Cache-Control: max-age=86400

GET
H/1.1 200
OK unifiedPixel
tr.outbrain.com/ 53 B
225 B 115ms
114ms Image
image/gif 38.133.127.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.outbrain.com/unifiedPixel?optOut=true&bust=06468852621147183&referrer=&cht=ot&marketerId=00c0feecc40196b47a738de28ad44794ac&name=PAGE_VIEW&dl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&g=1&obApiVersion=1.1&obtpVersion=2.0.5
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: no-cache
X-TraceId: 05fb1080e72a190c538010f4eb923d3e
Content-Length: 53
Content-Type: image/gif;

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C1F0 1 KB
647 B 61ms
61ms Document
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 58817
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Jul 2023 09:34:59 GMT
etag: 48472445140208031
expires: Tue, 11 Jul 2023 09:34:59 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame A150
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east

281 B
554 B

196ms
60ms

Document
text/html

23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D352%26uid%3D%7BpartnerId%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:16 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 11 Jul 2023 01:55:16 GMT
location: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame C05E 2 KB
814 B 78ms
78ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6BB6
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&us_privacy=1---
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562&us_privacy=1---

43 B
632 B

65ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562&us_privacy=1---
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 3925f661-4361-4112-a942-4e741a210226
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562&us_privacy=1---
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 6BB6 43 B
601 B 69ms
61ms Image
image/gif 2600:1f18:4e9:5a07:e525:84df:6700:168e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB?gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:e525:84df:6700:168e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6BB6
Redirect Chain

https://ad.turn.com/r/cs?pid=21&us_privacy=1---
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352

43 B
632 B

65ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6BB6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&us_privacy=1---
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt&us_privacy=1---

43 B
632 B

65ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt&us_privacy=1---
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-mia-kmia1760066-MIA
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1689040517.048938,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt&us_privacy=1---
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6BB6
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif?us_privacy=1---
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=54feae5b-ad48-4a1b-abf7-d7f60d078709&expiration=1720662917

43 B
632 B

114ms
78ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=54feae5b-ad48-4a1b-abf7-d7f60d078709&expiration=1720662917
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=54feae5b-ad48-4a1b-abf7-d7f60d078709&expiration=1720662917
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6BB6
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&us_privacy=1---&cm_callback_url=https%3A%2F...
https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&us_privacy=1---&cm_callback_url=https%3A%...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662095013109237

43 B
632 B

65ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662095013109237
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:18 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 563
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662095013109237
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7e4d6c644e178e03-MIA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6BB6
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&us_privacy=1---
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=bks7MZr81Qj2AX5&us_privacy=1---

43 B
632 B

81ms
73ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=bks7MZr81Qj2AX5&us_privacy=1---
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-782-g97d928b#rel-ec2-master i-07530d8be001bd58e@us-east-1b@dxedge-app-us-east-1-prod-asg
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=bks7MZr81Qj2AX5&us_privacy=1---
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 6BB6
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29&us_privacy=1---
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=4023335361986851824&expiration=1690250117

43 B
632 B

65ms
65ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=4023335361986851824&expiration=1690250117
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=4023335361986851824&expiration=1690250117
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 6BB6 43 B
102 B 142ms
41ms Image
image/gif 104.18.10.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZKy2gPeKFcFmKMEQLWWTawAA%263820=&us_privacy=1---
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 19105
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7e4d6c602fcbb3d4-MIA
content-length: 43
expires: Wed, 12 Jul 2023 01:55:17 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 034B
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&us_privacy=1---
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562&us_privacy=1---

43 B
632 B

65ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562&us_privacy=1---
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:16 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f83847d2-7af6-4783-ac20-ac9dac6c6845
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=6113698130532189562&us_privacy=1---
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 034B 43 B
601 B 70ms
68ms Image
image/gif 2600:1f18:4e9:5a07:e525:84df:6700:168e
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB?gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a07:e525:84df:6700:168e Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 034B
Redirect Chain

https://ad.turn.com/r/cs?pid=21&us_privacy=1---
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352

43 B
632 B

64ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=6971283231311444352
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 034B
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&us_privacy=1---
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt&us_privacy=1---

43 B
632 B

65ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt&us_privacy=1---
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-mia-kmia1760066-MIA
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1689040517.072165,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZKy2gAAAAHvPCgAt&us_privacy=1---
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 034B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB&gdpr_consent=&us_privacy=1---&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEOaotfZ9HkgdOTZIP3g2-W0&google_cver=1

43 B
632 B

64ms
64ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEOaotfZ9HkgdOTZIP3g2-W0&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEOaotfZ9HkgdOTZIP3g2-W0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 034B
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079&us_privacy=1---
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978477416365413599

43 B
632 B

88ms
73ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978477416365413599
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978477416365413599
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET

rum
dsum.casalemedia.com/ Frame 034B
Redirect Chain

https://x.bidswitch.net/sync?ssp=index&us_privacy=1---
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=77d2511f-217d-4cd5-ab00-40ca3f33ff85&ssp=index&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=419&user_id=10594788499610823859&ssp=index&gdpr=&gdpr_consent=
https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=77d2511f-217d-4cd5-ab00-40ca3f33ff85&gdpr=&gdpr_consent=&us_privacy=

0
0

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 034B 43 B
353 B 121ms
41ms Image
image/gif 104.18.10.47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZKy2gPeKFcFmKMEQLWWTawAA%263820=&us_privacy=1---
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.10.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 19105
etag: "902a3d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7e4d6c602fcdb3d4-MIA
content-length: 43
expires: Wed, 12 Jul 2023 01:55:17 GMT

GET
DATA 200
OK truncated
/ Frame 2178 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa5f79a73cd14d787076df301410335a44b32bccb932a97ec7b4bf2a3fe05f3e

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 3B0F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=minute_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east

281 B
554 B

197ms
61ms

Document
text/html

23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
Requested by: Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cs-rtb.minutemedia-prebid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:17 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 11 Jul 2023 01:55:16 GMT
location: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 86FD 2 KB
814 B 84ms
78ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=765b4e6bb9c8438

Requested by

Host: cs-rtb.minutemedia-prebid.com
URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cs-rtb.minutemedia-prebid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame A03A 0
859 B 93ms
75ms Script
text/html 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
AN-X-Request-Uuid: c8a2ae2f-2bd4-4c47-908d-aceff2177ef1
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DC5A 0
859 B 160ms
67ms Script
text/html 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a23-200-196-24.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
AN-X-Request-Uuid: 09ad4017-9585-4755-ab6d-071e0b9cad00
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame B752 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6ba4435a4def6e707966b7d43683572d634b0ebfc65f672653ff869a41e74f3

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B752 0
0 94ms
93ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJgoyFwGp2YknFPiDRlAADekiKjKs0i6JduZ1kvLs3XUIhaq5y-jdk_5pPwhtNoeJCB7Gp4hGMBAA8ZLinwdDf8Fkk15KnG_JWp6DaUU8-rFNf3vdqvFaEL4v0etFUP4u9QRKWdBZfqhNAFMHw_iCXWyfhPN1niBs6shGzi8Vd1DOrwgl6ZtH15ZGK9oqdL2yLcs3WnYSdh4sYuM_nTIlCgjkiEtZRf7zL9KYUgTL9bSGphsDQAvX_lIeg8151pO1P-tErBhrWvqKSPKmXLMdEKNHSbkTjroqDn9OznP8l2Nhr0Pu9xAMkeI6bw7i-sa7COQQd-l1j2-6lQoWAvGn0ra38YVgfkevPjJSjMOo&sai=AMfl-YSpeWoP81bchw8qiOGxwjgsly-34JHBl8YvLlDhPIYWQO9aVoFnVYZi6YEyLr0GICFw_rAZq1JhFwVdp1MKRdVFE0_49sIGx6AOmuq62ag2-nVX1OszB08ymbrY-c3Y0HkIbUt3YaEEqeKrZpELo9c&sig=Cg0ArKJSzBVe55igDCT-EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 11 Jul 2023 01:55:16 GMT

GET
H2 200 player.js Show response
player.aniview.com/script/6.1/ 39 KB
14 KB 71ms
68ms Script
text/javascript 2600:1402:9800:58f::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/player.js?v=1&type=s&pid=5e0e296628a061270b21ccab
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1402:9800:58f::2c79 Lithia Springs, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: ab9176da5caad82c490fa4c2a2c457985074080f18bcc0f7935b377551ec8c7c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycduOwniEgFaJfJPlcN4_61QH4kcqu2ARpTM2WEtE-6YsJ2PrqZg3I8qJ9wnJ51SBxx288uKeodYlp4zvBAT-x8GaWmqVkRXe
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 13568
last-modified: Mon, 10 Jul 2023 12:47:55 GMT
server: UploadServer
etag: "eab923619bfb9fa510f71ccaad8a1ef3"
vary: Accept-Encoding
x-goog-generation: 1688993274866256
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-goog-hash: crc32c=weyjtA==, md5=6rkjYZv7n6UQ9xzKrYoe8w==
access-control-expose-headers: Content-Type
cache-control: public, max-age=600
x-goog-stored-content-length: 13568
accept-ranges: bytes
expires: Tue, 11 Jul 2023 02:05:16 GMT

GET
H2 200 track
track1.aniview.com/ 0
97 B 72ms
69ms Image
text/plain 34.230.174.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?pid=5e0e296628a061270b21ccab&cid=64abcd8569f5a0d66d0714e6&e=playerLoaded&cb=1689040516873&r=https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.174.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-174-220.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/ Frame 55FD 426 KB
134 KB 76ms
76ms Script
text/javascript 2600:9000:2511:1600:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi.js
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:1600:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fd8ec65babdb27db01d5c68f49731d63b89ed05c0b7720b5a7d11bf0507c3be2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:01:39 GMT
x-amz-version-id: Zh508fxVpfRsDs1toNBp7jjeqHn_ILQA
content-encoding: br
last-modified: Tue, 11 Jul 2023 00:34:11 GMT
server: AmazonS3
via: 1.1 931eba134e92940e6c080405fee84c64.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P6
etag: W/"701177e1eba72287b97f37b8f26585c8"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age: 3218
x-amz-cf-id: SWIAe3WUyZ6XdxU8a2J_uRgNk54BvDvBER_tNgtdX3hjEwoLqml1wg==

GET
H2

200

cs
cs.yellowblue.io/ Frame CB4C
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11587&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0

0
329 B

60ms
59ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11587&uid=96dedcc8-503a-495a-a5e5-506ef122ffa1&gdpr=0
date: Tue, 11 Jul 2023 01:55:16 GMT
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame CB4C
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11601&id=beb29ba296d3d7d0f1d9a34b218f2f0&gdpr_consent=&gdpr=0

0
329 B

61ms
60ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=beb29ba296d3d7d0f1d9a34b218f2f0&gdpr_consent=&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:16 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cs.yellowblue.io/cs?aid=11601&id=beb29ba296d3d7d0f1d9a34b218f2f0&gdpr_consent=&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1689040516980026-297

GET
H2 200 cksync.php
contextual.media.net/ Frame CB4C 61 B
458 B 232ms
103ms Image
image/gif 23.200.196.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=25&type=ris&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11585%26id%3D%3Cvsid%3E

Requested by

Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.196.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 11 Jul 2023 01:55:17 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d

0
329 B

63ms
63ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-154
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=a3f69590-d171-49c4-bb32-fcc45a89b62d
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET

c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
sync.1rx.io/usersync/tradedesk/ Frame CB4C
Redirect Chain

https://sync.1rx.io/usersync2/rise?redir=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11579%26id%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7551845211
https://sync.1rx.io/usersync/tradedesk/c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

0
0

GET

c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6
sync.1rx.io/usersync/tradedesk/ Frame CB4C
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1982446492
https://sync.1rx.io/usersync/tradedesk/c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

0
0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://ads.yieldmo.com/pbsync?is=rise&gdpr=0&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11584%26uid%3D$UID
https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=

0
329 B

61ms
61ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cs-server-s2s.yellowblue.io/cs?aid=11584&uid=gf00fd914dad9f2d3e8f&gdpr=0&gdpr_consent=&us_privacy=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=194590&cb=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11583%26id%3D
https://cs-server-s2s.yellowblue.io/cs?aid=11583&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB

0
329 B

69ms
69ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11583&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cs-server-s2s.yellowblue.io/cs?aid=11583&id=ZKy2gPeKFcFmKMEQLWWTawAADuwAAAIB
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 0
Expires: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent=
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=6113698130532189562&gdpr=0&gdpr_consent=

0
329 B

68ms
67ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=6113698130532189562&gdpr=0&gdpr_consent=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: c69f322e-2a75-4812-ae2f-782c744aba46
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=6113698130532189562&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID
https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=50674DE4-1331-4B8B-A08E-394A47B0E933

0
329 B

59ms
59ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=50674DE4-1331-4B8B-A08E-394A47B0E933
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs-server-s2s.yellowblue.io/cs?aid=11576&id=50674DE4-1331-4B8B-A08E-394A47B0E933
date: Tue, 11 Jul 2023 01:55:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 115
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=72a2c5b1-1695-4a96-a505-fc9bd350c860

0
329 B

78ms
78ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=72a2c5b1-1695-4a96-a505-fc9bd350c860
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=72a2c5b1-1695-4a96-a505-fc9bd350c860
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=abffe4cf-3d63-416b-878c-7c5dbef394e1&gdpr_consent=null&gdpr=0

0
329 B

60ms
60ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=abffe4cf-3d63-416b-878c-7c5dbef394e1&gdpr_consent=null&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=abffe4cf-3d63-416b-878c-7c5dbef394e1&gdpr_consent=null&gdpr=0
date: Tue, 11 Jul 2023 01:55:17 GMT
server: _
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame CB4C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11591&id=y-6Lc0.P5E2uL5PG8Imzqe14DCfwliIDHt~A&gdpr_in_effect=0

0
329 B

60ms
60ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11591&id=y-6Lc0.P5E2uL5PG8Imzqe14DCfwliIDHt~A&gdpr_in_effect=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11591&id=y-6Lc0.P5E2uL5PG8Imzqe14DCfwliIDHt~A&gdpr_in_effect=0
date: Tue, 11 Jul 2023 01:55:17 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

cs
cs.yellowblue.io/ Frame CB4C
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=77&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11600&id=8004212043844932477&gdpr=0&gdpr_consent=

0
329 B

59ms
59ms

Image
application/javascript

3.226.99.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11600&id=8004212043844932477&gdpr=0&gdpr_consent=
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 3.226.99.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-99-159.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11600&id=8004212043844932477&gdpr=0&gdpr_consent=
date: Tue, 11 Jul 2023 01:55:17 GMT
content-length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85

0
329 B

72ms
72ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

Location: https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=77d2511f-217d-4cd5-ab00-40ca3f33ff85
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=562615&ev=1&us_privacy=[US_PRIVACY]&gdpr=0&gdpr_consent=&rurl=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11592%26uid%3D%25%25VGUID%25%25
https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0

0
329 B

59ms
59ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-US
location: https://cs-server-s2s.yellowblue.io/cs?aid=11592&uid=8xRLQOLR1WBf&ev=1&us_privacy=[US_PRIVACY]&pid=562615&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5bd7dc84cc-z5zgk
expires: -1

GET
H2

200

cs
cs-server-s2s.yellowblue.io/ Frame CB4C
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212205373389114

0
329 B

61ms
60ms

Image
application/javascript

54.174.190.28
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212205373389114
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H2
Server: 54.174.190.28 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-174-190-28.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: istio-envoy
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
access-control-allow-origin: https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
referrer-policy: unsafe-url
server: 33XP001
x-33x-status: 100000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212205373389114
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H3

200

us
capi.connatix.com/core/ Frame CB4C
Redirect Chain

https://cks.connatix.com/cks?pid=24&ev=3b3525d7c1e0494ca886b79ce71081e5&pname=IronSource&api-tier=2&uid=1hfVTYLakj_s&direct=1
https://capi.connatix.com/core/us?DemandPartner=24&DemandPartnerUserId=1hfVTYLakj_s&UserId=&tier=2

0
231 B

104ms
104ms

Image
application/json

104.18.33.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/core/us?DemandPartner=24&DemandPartnerUserId=1hfVTYLakj_s&UserId=&tier=2
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: H3
Server: 104.18.33.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cs-server-s2s.yellowblue.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7e4d6c648920db29-MIA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
location: https://capi.connatix.com/core/us?DemandPartner=24&DemandPartnerUserId=1hfVTYLakj_s&UserId=&tier=2
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 7e4d6c60cfcbd9b5-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 60CD
Redirect Chain

https://sync.technoratimedia.com/services?gdpr=0&gdpr_consent=&us_privacy=1---&srv=cs&source=duration&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D362%26uid%3D%5BUSER_ID%5D&att=99
https://ads.servenobid.com/sync?pid=362&uid=964902DB58AB4FCDA0596BF7610A8B60

0
356 B

147ms
67ms

Image
image/avif

18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=362&uid=964902DB58AB4FCDA0596BF7610A8B60
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html?usp_consent=1---
Protocol: H2
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ad-cdn.technoratimedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

date: Tue, 11 Jul 2023 01:55:16 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 844308672
location: https://ads.servenobid.com/sync?pid=362&uid=964902DB58AB4FCDA0596BF7610A8B60
access-control-allow-origin: https://ad-cdn.technoratimedia.com/
access-control-allow-credentials: true
content-length: 0

POST
H3 200 metrics Show response
api.permutive.com/v2.0/internal/ 2 B
37 B 157ms
157ms XHR
text/plain 34.107.254.252
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/internal/metrics?k=8716c0bf-3e57-4603-9c05-89d10477c922
Requested by: Host: 0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app
URL: https://0cf17917-395b-4f25-91cc-db3bdd6044b0.edge.permutive.app/f34a8612-9c89-4e7a-adeb-71a2902d9634-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:16 GMT
content-encoding: gzip
via: 1.1 google
server: Permutive
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22

GET
H/1.1 200
OK log
c21lg-d.media.net/ Frame 9CC4 35 B
296 B 278ms
126ms Image
image/gif 23.52.158.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-con&ovsid=71171655-0618-49ba-b85d-261c2a1236d1&cs=15&vsid=3320421111524274000V10
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.158.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-158-180.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2D02 34 KB
10 KB 113ms
64ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: feeb98f30c6b03b47d474792b88ea05241e469d24f193cafa3927310602ce670

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9477
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 2E74 2 KB
2 KB 64ms
63ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=85038494&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: cbce40767253f5da12546b7c97c49989e8bed81a6d1b64036c988a164b4e96f9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 11 Jul 2023 01:55:16 GMT
content-length: 1976
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK usermatchredir Show response
ssum-sec.casalemedia.com/ Frame 233D 43 B
632 B 71ms
69ms Document
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:17 GMT
Expires: 0
Keep-Alive: timeout=1, max=499
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2178 0
0 82ms
79ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXDeES5NXomP-rrVpKGfEehgchQ7MwYudAvAmKKsk6jlQvMjQHpGgxirhCP73icMhYOyOYXIDQ8CsxVSLobFMtlJbcWzajkXl_2OWzbsLRu_TzvdtdDScpQVT1bzXrg3rtGmBEFktQAdeV-iD6Jz4B_gL8g9g8ROvbaC2nKb4zm0NhxL4yIiGwvHGy3Z3bu0anzw6FFkdkQpUMQkCLAjKpv1BKY1dTb4MIqjgp1kbVimjov-TWxW4AKuK4ZTqf-zxw1kwmfsuRXpV2bnglJEAW6T5rHVyqmtl52T0hp0mUILZSu6ysEbHBVrB4hAEqEyw4XLLOOC9swnYmEKcuD65C4abLycvDuYC2PPkk-MA_RIGDDrjiGRSxVibwPd97UuZbl5cjw6lWuIem1j3lOt4Cwf7qF-ga2Vx5pwqvzGE9qL0pdV5R3VTVHPMVsseY8C1Ur4XfJ2ZwN5iSdAhl6YFyZY2T3GXbOrPMHgiIPvJxUUaJ3SSQcrmSpOKC2naxHiQC-fW1EeOl0Y1Zb0pyLXjp84FHcM7C8FG9fQcQmecgr7AqMkQo34GDCImAuV3v0AAN5n-YJY6QaZdn-dIqj_-t3nATD4KBkRwmgP-IKonQbX8_GFd2QXzM-hV36rJv-k5mgnMqmKdIhsrQu-ZKQSYAzIZg8dduIZqS1MAs9siVojp9CVewWuaq_6U1P8CKgG5LJoWS8X7vcXFw0OXe1xaeD_v4Z1p6PlVz3NUemP2GTI8UKOtg7TML6KMGDGveG6QvoE8jygDLWAR0ZvYp4V7qGhrR1OuPyLsWxTvRhRgTnv48qrdOzxrBnDYl33EONwRCMu8L4aHe2F6HwLUeD9IEqS6ORu7-VR9fltUT8E2FMSKJa-PKoAsF0SqokM4GoCIsZ_CFNoUzUrUxzV06e2Ctop8SxVQ6pWdxfQN9z8tgqQ19YEZbk2h4dj11uyOPtIdA2C4CUYZDeUHQosQApZQjcpin8uuDCzsv7JFu7wCNXlZUnORgmiD5f0Sqmwy_mwMRasLqQCJ08TtDskmKCHmImuTZO5UZhS95mgvYmfDeNwzJTiqVnzyihgjlW06mf8CqMDvJ6NZIXMA8XbHtcdz0lzZjdzHal4yloL6JSIUVvwhRjslM1RlptiNxrhHpL_mKSYv5e-iASAwDKUnFTMWbjnqQpPHaZB5vPC_COn1baf5qt7hab7gsl3WV7eOF6WrQ5llA2aaz8X9T6WTG8iGStVxWfLjlwg-S13bZu2GbhdMoL8RVJxcWGvn-N215oZ0mCmPiWZWKPUdjnYNNF8iTp_AZJW1Z8e4-okDkhpbPwrJ9VRWOiRZSX6AafcF-FABwFQF3FRRqlOaBbyRiiEgkbScHrNIeRT8Clj0GjitiClh6Dllzcs_2LVrckFMmVvuxgJhw1cL_SzPSX7eo1sskqGNHF-u_L_EjxGw7Ln82SkLECFD9Yp4ZrISZvsq7w2t4nkHdh3qJO3HZJLTO6rwadkwnMapX2DXXSgNRKaMitxqCp5L-xnb4lXuZTYfuUX61J5W6Re10L9l0rtjduLFFUCdHUImMDE6RouJ-2uBxzEPsXxQMpE7dK8v4Y4pBCdmprg0-9rBdJMbcgTF-4nv928ZAFnbKdZ2Lr62UvzaA196sk3hcY2E_zsZLrdmnAgFE6ArzPDkaSFTuyBHNMe4mbrftSp0tUNmMY_KPVoxQU-RPaEcaHkLtJikPBpl1-HLVHUnYj7xdglV3vKdxBzpA1flc-8xvooppMiBHQ8TyPi47&sai=AMfl-YTk-2SfcpdX2OadhHdXeXiPNRqODj9gTxUjxYbT7r3Wppd-Nt1fi_3ylNXQ7cQOWK--rMyhXvSgIvpZxnm57CNtdh8N49tiFJyvVDHtSGupLFToza3n13tYTI8uYLoXaizLcS18k1ySJW-qk4PjVd4shrOolzl7ZZpqPf0CUJ6o4lBvCVf80I7vEwXNciFFVX7AE0iFaBgfq5XyTQxk5ZC3HCdzKyTSThtid6IGH7qZSCdhrrWFFwM2DvhxKSB-w3rOTwkvqJecBbhPamlKWVSh1PgDUR2kme6PwdJ0iruWyfGja3qP9Mfz13jFKPcoCEKR6PCZW6I8Sb8itG_UAmztBe_Fixyi53JZfsMxYCbdja0F7FjjhgAr2OPLS98HnI9efhqYxOy7GbYdPEWO-31BAo6gI_8NGuHavvx3TVdvwNLneRzXCNBDTTit-oZ0saciz2nwxJdpOhh4stddnpjeIgfSevq3BhURJ_RXdi4i3ExrU4VFTKRpmqIcf5bpcOHGgOBssp0W1OvBaA&sig=Cg0ArKJSzBfTmKKBics5EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=845&vt=11&dtpt=843&dett=2&cstd=0&cisv=r20230706.30734&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2178 0
0 83ms
83ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv66tIQyOW67fvch4IA01wl02vyCv0lUxqqr7vcePnRXKwV-JTrsoJvhKMchpMiR0b5KYe8H2tWXFXO9DNUmOX_ltEwUHadx0F7ODz7ptln-YhlB-faiRQwLZowOpfJLGO7-q_vEAzdMti-v79Qrrrj4LV0Rp-cTPmx20EmomQXPz663q2oLxG0F_XssOF6DV2hsbWSo591uenoKaDAoXXeDncmJ5j2d1Yhdn2fOBbwzPlVpM598JkxZpmu9dWl1eS0GdtEYj8n5jCSoJ0ZQmeoaFR9pnojIVeldea7E57YiOYY-QsmHtsM9lOxhlm-dKtK_-8F4c3odkB8yazfK8E4yjPXamCnV6xk5E9wDs7QUi8&sai=AMfl-YTTl1ItQXmVOwT-jqkS-EgAxz6QqE9D87pSWjs8yzoGO0sJOShLvCKK91sYRq9EEVAlaQ7qkyJbtSbDKRU5_k4hR_MNkiwVnFQ7PQhYTRfOVd48_HXv4SocAUx9JYS0cBwBByCvci0Y6Fudpj6UuW8&sig=Cg0ArKJSzMwYRMYHyceMEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H2

200

cs Show response
um2.eqads.com/um/ Frame 048B
Redirect Chain

https://um2.eqads.com/um/cs?us_privacy=1---
https://um2.eqads.com/um/cs?us_privacy=1---&eq_cc=1

186 B
370 B

58ms
58ms

Document
text/html

3.222.197.118
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs?us_privacy=1---&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?us_privacy=1---&d=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.197.118 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-197-118.compute-1.amazonaws.com
Software: /
Resource Hash: 2f1c037ebf7b07cffc4a575c3c0bfaeca3a5cb11050c990c84c20b8291d785ec

Request headers

Referer: https://ssum-sec.casalemedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, must-revalidate
content-length: 186
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:17 GMT
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Tue, 11 Jul 2023 01:55:17 GMT
pragma: no-cache

Redirect headers

content-length: 57
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:17 GMT
location: /um/cs?us_privacy=1---&eq_cc=1

GET
H2 200 moatwrapper.js
svastx.moatads.com/thetradedeskvideo910663478306/ Frame 8B48 75 KB
0 225ms
68ms Script
application/x-javascript 23.52.156.48
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://svastx.moatads.com/thetradedeskvideo910663478306/moatwrapper.js
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/loader.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.156.48 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-156-48.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: gzip
last-modified: Tue, 09 May 2023 15:33:37 GMT
server: AmazonS3
x-amz-request-id: 564EFVMVZS2BMF8R
etag: "658b7c0efbb59728e86ca0608227b492"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=2092
accept-ranges: bytes
content-length: 22199
x-amz-id-2: k9AN44CeSi7/s+V9xv2J7Q9q850Jtx1ao1c3nOctz889ULAGW6pvT5odRwQCiI7GMoCBZuRBET9feRtykfnE1RGYCM7rf/5lLcdgcb4/T7c=

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 05CD
Redirect Chain

https://crb.kargo.com/api/v1/dsync/PrebidServer?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&r=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dkargo%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%2...
https://elb.the-ozone-project.com/setuid?bidder=kargo&uid=61f9aa47-07e9-56eb-02c2-9e78b398ac7a&us_privacy=pbs-ozone

0
919 B

193ms
85ms

Image
text/plain

104.18.43.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=kargo&uid=61f9aa47-07e9-56eb-02c2-9e78b398ac7a&us_privacy=pbs-ozone
Requested by: Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
Protocol: H2
Server: 104.18.43.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://elb.the-ozone-project.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
cache-control: no-cache, no-store, must-revalidate
cf-ray: 7e4d6c651e224984-MIA
content-length: 0
expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
X-Accel-Expires: 0
Vary: Origin
Content-Type: text/html; charset=utf-8
Location: https://elb.the-ozone-project.com/setuid?bidder=kargo&uid=61f9aa47-07e9-56eb-02c2-9e78b398ac7a&us_privacy=pbs-ozone
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Content-Length: 153
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK visit.js
tps.doubleverify.com/ Frame 241D 8 KB
0 168ms
55ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=1546&ttfrms=49&brid=3&brver=114.0.5735.198&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTau%3FJA%40DE%5D4%40%3ETaua_abTau_dTau%60_TauH6%3D%3DD%5C72C8%40%5CGA%5C%3A%3FG%3AE65%5CDF3%40C5%3A%3F2E6%5CE%40%5C6I6C4%3AD6%5C2%3F5%5CD9%40H6C%5CH%3AE9%5C9%3A%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau%3FJA%40DE%5D4%40%3ETar9EEADTbpTauTau%3FJA%40DE%5D4%40%3EU42%3FFC%3Dl9EEADTbpTauTau%3FJA%40DE%5D4%40%3ETaua_abTau_dTau%60_TauH6%3D%3DD%5C72C8%40%5CGA%5C%3A%3FG%3AE65%5CDF3%40C5%3A%3F2E6%5CE%40%5C6I6C4%3AD6%5C2%3F5%5CD9%40H6C%5CH%3AE9%5C9%3A%3ETau&srcurlD=0&aUrlD=0&ssl=https:&uid=1689040517121374&jsCallback=dvCallback_1689040517121852&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=4122&tgjsver=4122&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&fwc=4&fcl=3578&flt=47&fec=2284&fcifrms=51&brh=2&sdf=2&dvp_epl=462&noc=4&nav_pltfrm=Win32&ctx=21052880&cmp=DV457140&btreg=5402416556138244049805&btadsrv=5402416556138244049805&adsrv=104&unit=1x6&turl=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&seltag=1&sadv=4621758120&ord=2709739563&litm=5402416556&scrt=138244049805&splc=/5850/post.desktop/native/business/stories&adu=95731775&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_scripthash=1&t2te=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=260130812741.47174&dvp_tukv=33419389.479484443&dvp_tuid=563536439866&jurtd=3831233499
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 07/10/2023 01:55:17

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 2F5B
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east

281 B
554 B

61ms
61ms

Document
text/html

23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Requested by: Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d3b3525d7c1e0494ca886b79ce71081e5%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:17 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 11 Jul 2023 01:55:17 GMT
location: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
server: AkamaiGHost

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 0AED 2 KB
815 B 229ms
75ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 hbp_master_270443_13401.js Show response
player.spotim.market/prebidlink/31ee76261d87fed8cb9d4c465c48158c/ Frame 55FD 487 KB
152 KB 233ms
112ms Script
application/javascript 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.spotim.market/prebidlink/31ee76261d87fed8cb9d4c465c48158c/hbp_master_270443_13401.js
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9ccb703ea798b888a02a3e3ea17acfa09c9128da838c2b7baaec0d786aea637c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 13 Jul 2023 01:55:17 GMT
date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: gzip
last-modified: Thu, 22 Jun 2023 14:22:59 GMT
server: nginx
etag: W/"64945943-79de4"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H2 200 hbw_master_270443_13401.js
player.spotim.market/prebidlink/QaVY1/ Frame 55FD 162 KB
0 349ms
229ms Script
application/javascript 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.spotim.market/prebidlink/QaVY1/hbw_master_270443_13401.js
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Thu, 13 Jul 2023 01:55:17 GMT
date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: gzip
last-modified: Fri, 07 Jul 2023 12:15:00 GMT
server: nginx
etag: W/"64a801c4-2876f"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H3 200 pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/ Frame 55FD 392 KB
0 64ms
63ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307060101/pubads_impl.js?cb=31075866

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/191e27c7-e539-4da7-98e5-2d3c626338be/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 10 Jul 2023 15:36:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37122
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127592
x-xss-protection: 0
server: cafe
etag: 1084883806831873288
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 09 Jul 2024 15:36:35 GMT

GET
H2 200 668.2d37678bffd21012f11b.js Show response
libs.outbrain.com/video/obVideo/current/ 12 KB
4 KB 227ms
74ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/668.2d37678bffd21012f11b.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ba75a525c5e1b530bddf48416cd39331e409c45e7abcd501e5860c7c0bd4de19

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: gzip
last-modified: Mon, 10 Jul 2023 13:22:40 GMT
server: AkamaiNetStorage
etag: "4f68d1aefaed6b72a7e4411be358a175:1688995757.514207"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 4030
expires: Tue, 11 Jul 2023 05:55:18 GMT

GET
H2 200 334.81880c71f57faf73f08a.js Show response
libs.outbrain.com/video/obVideo/current/ 12 KB
4 KB 225ms
73ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/334.81880c71f57faf73f08a.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d2b30219a4c992a8bc36d32bcf438cffeeda237da78e37efc7f4d3493e6650d1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: gzip
last-modified: Mon, 10 Jul 2023 13:22:40 GMT
server: AkamaiNetStorage
etag: "de23ca737e6548e9e7c5e82320005492:1688995754.581446"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 3807
expires: Tue, 11 Jul 2023 05:55:18 GMT

GET
H2 200 688.9bd6642a2c4de45b624a.js Show response
libs.outbrain.com/video/obVideo/current/ 17 KB
6 KB 115ms
73ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/688.9bd6642a2c4de45b624a.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0f2c7388e0848e3ff52e36a278a50495f9931d22b2b80bbfb2b5ea66bbb8f176

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: gzip
last-modified: Mon, 10 Jul 2023 13:22:40 GMT
server: AkamaiNetStorage
etag: "5925430a015427a23f7f5ef1a0bc6cbc:1688995757.750808"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 5393
expires: Tue, 11 Jul 2023 05:55:18 GMT

GET
H2 200 822.726810bfd899ea226ac2.js Show response
libs.outbrain.com/video/obVideo/current/ 178 B
462 B 116ms
74ms Script
application/x-javascript 96.16.196.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://libs.outbrain.com/video/obVideo/current/822.726810bfd899ea226ac2.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.16.196.219 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-196-219.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 89a2d18b2cc89a3a8466cb2bf20928f950d2d0ae6f4bf9f4c270090a3224c567

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: gzip
last-modified: Mon, 10 Jul 2023 13:22:40 GMT
server: AkamaiNetStorage
etag: "399e7d178d16eb28c3a48dd0f1251c44:1688995759.559165"
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
content-length: 155
expires: Tue, 11 Jul 2023 05:55:18 GMT

GET
H2 200 25b6.svg
s.w.org/images/core/emoji/14.0.0/svg/ 231 B
463 B 108ms
32ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/14.0.0/svg/25b6.svg

Requested by

Host: nypost.com
URL: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

68596af11fc8972afb0ae7a3651cee7ea872da5db4dd918cc3237a8a53d18cda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nc: HIT mia 2
date: Tue, 11 Jul 2023 01:55:18 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Apr 2022 03:47:26 GMT
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, HEAD
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 231
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame B752 8 KB
4 KB 201ms
67ms Script
application/javascript 2600:1400:9000::6875:b641
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 39399d443a3ab24886d829aae4ac8b33492ab78b193aeadda64586f0467b5ef5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jul 2023 12:19:54 GMT
Server: UploadServer
ETag: "8f00be3da9a0f0d7a1a8c47b91364b82"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3377
Expires: Thu, 06 Jul 2023 12:35:20 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10829031822675935232/ Frame 7069 10 KB
2 KB 81ms
79ms Document
text/html 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=oo9fSwwSNo&t=1&renderingType=2&ev=01_250

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05ddf83ff66831cf5ec79d5ac1359fdb6e18cea78c0c747518bda4de855c671a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2451
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:17 GMT
expires: Wed, 10 Jul 2024 01:55:17 GMT
last-modified: Fri, 07 Jul 2023 21:39:44 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B752 0
0 99ms
98ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssiD4dxWTGcKRIvtcQrjpQHTShauYtAg5H0l1SoNODuLj7jR8f1Tf5m4ei3Bk00gCKqGO5If72nUZXLSU4xKKMMiHkMRGSeYLIwI8ohMyhYW8J-714Kh_WnOmplL_nHsJ9YP243yn0V864-rigYID7BMVvxLm8OQ23uOuDMAIZRXGepLGOTVtdVcwEsdBl9nI5vbJKO26ltmvynqopQ6omhSi8oCPTMT1o96rrhdAXt_I1wd983dmJBC_VXw-x7nVs1MQtqmgVKH5zKum76-sSkP0KdnzzTxgQZAHtwxe5e5cuIaaGO_GbKBGYF42TusS_LBjolvx_hfkyxYRF8nWsLDLjyX7BZwUKR8CvqVAqdgsqIlRcmr-Osh336hrekds8ii4Ht1GbFtA6Mh_boY-jk4AcyazTKuk64CMxX9r-rRCn-8oeSwYpnlDa69RPp-RXasHLQp-AZZ1BfMbTfrpBGttFBNMZnZNAOkCzA45cesAgKz4dNNGHxvNONIpjXOjlYVyD1JnOI0tD8Qz0Yfc9DfXr9SGnJru9x553zQ-F9QXjfBabLruOt1yoP_4iv8UkCykSpwGV2h_ZFIW6E7R9Zt8AlWk9WtS8m79WmTcDg3ZjFPXOr8HJtgtBhw0hfP1aR2Br5xymsz-qnl7HRc8dnADXQfg-qEU7AH6UNpUauoZATySvo2Z7tO9wDhNfKHcURyyTubxC3SaRHCcwi3xUb1rCEUQNzbvaIhEdvpCnkQtATfsygGxp6FqOaQ-7huKl0vkAC5UyfcdjLy-YgKXyjSmebDel7ApCARu2chXMt7BV256bQQ3SUf5lzLhwOQYIndfLclBaZup8DWsU-cZv37Qi85Xc3DgNvD4zMaZmRv5QU3VUJPow8qmbCFs_Vqyn3GE-AiPbB1EkbR4mmZu_HtknpM_mbZJ_DCo0NTavQ5katBCgVQ5PcZyYxW7LGFqszUFlnAuT7QSF3wI5ozxFu6BIZbsBoKUu0rRmcg8W21eapd2FCszfnt1MwzpnjcJaEOjO09gEF5o5ch-1MFa0zQDquWpxjNHNdcfx2YrcrDnYLeD3t4tTxmVBd0eb1H3oViSZff-C_WGVaI3khgXs9LseAttfcpS1Fxc42ncP2HsTFwBi5EbPi1uklykKcNfvZyF9d8sfWFx8b4UNPLvGd87spfdTmDKVZsTl7Ycy7mOulPTIDxegdv4d7Ysl4EqrNrHOqfcIklYLfQLtNubnyBrlsM_vg3IiQUDdetKd3bpyuywY7_59U9W5zX1pSNHpWHEicik_tZrcrvresPropx7SMEzNJpjMUStNuHydRio1vlA3aEl6lARbCbPyFB0iV4FLoU3GzBZuizHtM7DgaJaYVzlxNGlqqwVTAxXbwbZXKBTk4RY0RNZGKkp_hp3HPVs0SB4JG1pPfSPWa3GV7LuppKo8S7VW4-501I2OjfSvsyhmOe7moFjQsZJZ9QW2729ohOD4sQOfcBTWYTLUs7PIFrEQivVdKLVe_OU5TPEfktsPwW4MjBDGB293bhndCsSWHfRTfmXRcy0o7kBH3iIcAkk1dSBlu_e8VDu12VqlpLQZ3ppTNFwUN9H1xRWX4fgQNiGpzO9rWzOMEnG1CQgVdJxsXiqadu4jeSpXTH_rPbCTX4gEd49VVBi8-53Uevg6BGxZWAVinPC1AUf1IQNcYG3qcaMYQedLP-8eLBFrs4CzREeJmNbBGS0rviwISO3Eay089m4kUMBkJa9Jpot6YQVXKNIOrPZA&sai=AMfl-YSyw8aYybJnk5gkwCTgnHvrmMt8PLMjG4ksYbD4VudvQm3-gZmY0-wbUuaKDGtsq6R8czEOwsVtokNkpezk2ziRfy4E0D9T3Ujr2UZyZQSPuWqHvwjlHV_D6zAsK_Sfr27e5JsWuf0nEBdeCLnQvVxHenunbfb7s8krZvvc4eok0kUCaVoF6b0Owfvcls-ks7R11SC5U2PBk3xNc1_PrvRXjyDUU6WEpS4BVUT0m97eRvC85ekBmIjGHYNGo0-1zdzKqVTl1RCMTD4XcIXKJNBNAqiUHGNY3d3gxSiXzOFaWbveNl2WDUuaR7odkyk_LnYE6G3A5LlTV4D2VtZpFWnyfIhbXZm8H94qRHLcFhVtjZTiAc5Uc0cN95yqXgoEfU6uXKGhWByqIAIHtTb_q1_n2Pl8bfYZt-L7dExbVFgc35D1MkcSeiPpsxvJXpr-0-Kcnzt1Pk3WudNZ-fJE1ff8Gr1bDX4uo7F4ebiJzakZ8fWQGvQ1sLT7o3lQru3ik84BIkqZ_f6msqoaUA&sig=Cg0ArKJSzKMXDcAP8HAPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1516&cbvp=1&cstd=1495&cisv=r20230706.80592&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 11 Jul 2023 01:55:17 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame B752 35 B
1 KB 221ms
89ms Image
image/gif 2600:1400:9000:18b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=11428822&siteID=N3340.3424460DV360DISPLAY&creativeID=135952471&placementID=362556629&rnd=1695498327&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:9000:18b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Date: Tue, 11 Jul 2023 01:55:17 GMT
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: unsafe-url
Vary: Accept-Encoding
X-Frame-Options: ALLOWALL
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 94DA 8 KB
4 KB 198ms
67ms Script
application/javascript 2600:1400:9000::6875:b641
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 39399d443a3ab24886d829aae4ac8b33492ab78b193aeadda64586f0467b5ef5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jul 2023 12:19:54 GMT
Server: UploadServer
ETag: "8f00be3da9a0f0d7a1a8c47b91364b82"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3377
Expires: Thu, 06 Jul 2023 12:35:20 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7400983265688944640/ Frame AD79 10 KB
2 KB 85ms
78ms Document
text/html 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7400983265688944640/index.html?e=69&leftOffset=0&topOffset=0&c=grJmw21U2m&t=1&renderingType=2&ev=01_250

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05ddf83ff66831cf5ec79d5ac1359fdb6e18cea78c0c747518bda4de855c671a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2451
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:17 GMT
expires: Wed, 10 Jul 2024 01:55:17 GMT
last-modified: Fri, 07 Jul 2023 21:40:30 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 94DA 0
0 99ms
98ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstExh1DZBzD-nQpiJR-r9Yms6qGlhdj2fB0KFw5JId3-pJVT0aPqnmetyuVDfE12QUHtpffhNCgbKKfoGJ_4eoh6HOTvg0a_gJ6TT5PDiSmjf9jswciZuP9z9Pm7moT4HeHO_2Kfw4S5PpzNYSBj0SxTN7MLFNLV2ZLCi1N3k-3Owk5lqCLYxEX6RaNWS43JJ_Tg8-2JDTx-VfOKsSrM3NjsbnfabU39o7ajV6_tNduAm1hZmdiA3lP66K1lKy2Q7q4RbgWQkOeJktlV5A1n3YeiYVdixZFkt2SAvYzq81_6HPJ-Pju4sP28j-FF_7Qmqi-YQ2uxFvZXU25p5k8qG-dNVcD8FwHHVWqjCg9cgfrhiBEBxXKwqZzXOejz_RtD4BJTnjOr0pPmlBuB1FDpqRtUXMLS67e2QGrkDxGFZOAhlqTRXjMCvcXgotuQ30drDsQY6Sce2CnPuD3VysdQhpv8T8sU6NF_OJ2TrNveG7F6GUrpdsFbna5jzqKOopBQOmdzuXiETK3IJ4P2R9YGp_JQj_Zr8KtcLaH9V92s0ZGCjFrE9jKv6jrEQJ5Z9efT62vQiTRLBRg5PrAqERyJAL6iq3WWJFuftOEX84AZRzCbW76KkBVBqLmdOU3b7QVAll2zONg73gavydhkxF9fZAA7WLZetT-CKSzhQsCXX_d17NsV28q93KgqJpxQy5bEOUF7xr2088X6kpuz6tLjmGg-FWbwX6Pl2u2ymftwOfPhELdRjDM10DMZ8IVPHpGYE4LHFw-WjHu3oQU-VR5oP2P5IPpQqW-SNrzgkptnyhnCS3iEqDc00UG7hMdxiYKUJ2FMfz6C2BWULXGckp5Bl1S-cIkQOvDTETjUsO8g7psUgKvY9TbBPq5PXO9vd7ttQDrf7UVZYcREQA8RL-dqA9pl9T_FKjId9om5_bxvX1pU4XTUDro0cizmIp2RsHawjTd4Q7D0DDEX_D-znkWeSN8kkAEoEWDsXDc4dL3iGYvkhU5iUUiLWsrxDUcFZA7jHvePeODXbcI9iqE6D52wOF_ZymFmCbnyv7-7jpjs36Eu23zeg5OLslWbwfCHkjpIxSiOkmte3483hZyuy-L-vMHEVNcCVZ7uk30P7kXpRNiDTUK_aDdDY9xpujc6l0dhEc4dD-P0TRre5Y_7E0fo-OFCyvAR2k_cCb9tQ_2yBoyA50Oy15ZSK_hk55XNtlPE-EMuvNBUpu9s7b5e3bPPRedeUjgf7WOnIljdEHl1yoNrSab2SYjoR9sWNFJyOpytIsTeVQkTpQXZTbVp3ZMojcuepPtPt6XuIyiWChkGkfQzRGE0o7Pap1RLhsKKsvETwh_8aQSrDNjOa6T7wIKy8rFcKNZc2aKadIym3xaV4SkvP9R801aXx3GyOI2OhBZqUcfiYrzibhzxbP1xxVQUNIMABIElU1kU5FbgBZMXbjyGWEZQWD1PY3Tg_1znD09RD1zn2fYspXij33jhr9OihB76KoROlaZtrgJqJ7Bu5LwMQw6cnsxdFEb2ysnxfi37szGyi_KfQxrSlECW3Qxql9QWA7jTqSqC07aKMoHLYOcv0EpQOyAybJlUkxEeIvRysN53y3UJL1wJwYGC1m3yl81rrTVwjSUscFdE5tU0lcoKb40F6suV2Ts61yoKOVi4WjlpFwVu_BdHf0A5dsFsJ8j5Gs0VxEq3fRAhS230o37FajvSwGl4s80BvcHKwvqT-KoyLz1nQo20NK0lh6T8Sl0O7csHEoYamevThpWZc39WLGWLlMrSRrH4A&sai=AMfl-YR1LsucoMkX7UzcnHIIYRgwW5afmxoN9DfY9PYXUbE2_rgl7oyxdD9X7y0bqPvjsCUon0qYR-xlA2htRFHERbxiBwTAnSAsdT58MQbVEqrhJEf4N2TrGDXZ4Dq_8f8bUVQ0daDId_WHitrpiTd3Kv0PNprlokrD87erZLY_rRwLquKCawOhJDhc24ZbWNk0ybKUDehSs2jOYPpt-ZHfNOK6nLtoaWKwGN0b0oNX4xfcmc43eEfV3W7ORqcMzu4kNP8wbi_lwBzgrAuZcMGEzOaU1z3m3QrniO4G_o0XgKSeDJnZRyAo118IlCZvUMCRtbxlAZSbbMDKW7Uk_5OcJLMnCMc3YWHqqfJfsBrH8HW-s2GuS7OK0wW1TdM-FExJ1e1oPKOUagZffAMmVTt2ehQ1mCQ0m9_cZcQmwkSaVpDgpkeVzvhcJK3t-skopREUI0pN_hsJQ-ovWg4SIchq6w-bHvbt34QRE4NOWRG8-9mtfw4zsWHpSoOrmpckHDbQE67gu_CSjoN267BWoQ&sig=Cg0ArKJSzC2V-o9pAc24EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1438&cbvp=1&cstd=1419&cisv=r20230706.22249&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 11 Jul 2023 01:55:17 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 94DA 35 B
1 KB 247ms
114ms Image
image/gif 2600:1400:9000:18b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=11428822&siteID=N3340.3424460DV360DISPLAY&creativeID=155319553&placementID=362558090&rnd=1351037327&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:9000:18b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Date: Tue, 11 Jul 2023 01:55:17 GMT
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: unsafe-url
Vary: Accept-Encoding
X-Frame-Options: ALLOWALL
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame A150 34 KB
10 KB 70ms
70ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: feeb98f30c6b03b47d474792b88ea05241e469d24f193cafa3927310602ce670

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9477
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 991F 8 KB
4 KB 154ms
67ms Script
application/javascript 2600:1400:9000::6875:b641
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 39399d443a3ab24886d829aae4ac8b33492ab78b193aeadda64586f0467b5ef5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jul 2023 12:19:54 GMT
Server: UploadServer
ETag: "8f00be3da9a0f0d7a1a8c47b91364b82"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3377
Expires: Thu, 06 Jul 2023 12:35:20 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10829031822675935232/ Frame DE60 10 KB
2 KB 78ms
77ms Document
text/html 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=nmExgGNCQ9&t=1&renderingType=2&ev=01_250

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05ddf83ff66831cf5ec79d5ac1359fdb6e18cea78c0c747518bda4de855c671a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2451
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:55:17 GMT
expires: Wed, 10 Jul 2024 01:55:17 GMT
last-modified: Fri, 07 Jul 2023 21:39:44 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 991F 0
0 88ms
88ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstxLXh4-7qx0TgqQX4uQoJ3cKFYhlnoe7sF2W9p3BT5rZJvrDHsN06C4yNY7m8SvMfZTdLfyv3jTbLkTKHCF30ifsKPR5jkJy1iD_28F8WZQOJK-PPoJQ71BDzNtgcgVaUX9jQQQfv-eXMOoWJkXnSJAS2o-EqDT5w9xGes45Bxo5BxVbzYpCsjAFEDcmWMRhac7AYgrLQFyKhyCb676dK4qJ8bdDhVmfYfuJ0_oujS0u-Fa99IB3ZQqqhchmYg6GjYAbqyYyklXiuFvTHfkXbI_EO0CsPAxxPRyXXLJM2mt708tMJNdZYqJdFNiWzAEm4lYsJ04m-1fRAuQGxzvyLm9TKoya_YIGXg-WivpkjNflipzBk3En33Uk7hx2h3MPtiTOpaP4oZsxjCF_D-eaQFyCg5udm-9y9LLnbly8SA0tj5QR1X7PmqATDGdvFyIoengWiHve7Mkh2rgx46Csf5uNixG-AQ6NRpYQ7aqCj7oR0qXHE_k7uUyJ33irS41ehaDJGv0CuivEyHgvWTA7cgFbhYKFk24FpWTPdt0hVjJmE4I2MiRCrW5db8ZibXQuVFGXeJyTkTV7B68kMepTbkKIHG2qlNT9GjuU0IBX2clJ1fLU6rJmLgPi3Udr5UBWodZ7IMM5gtXbV2xFq3M6zK-DQ-zV1Shq0uLcxrs4LILJTzMZIabyL2bcvOXdIqjVFY3xwxA4C3eTcPhGiOlU9zO97oH0ZdQpulYzN74_00aPwkHGvt3-0a73b4wqWiKfndVc9MyxlrcYHel42gfvzbE-bmB9n3P6854swEJL0ucovftOoUwgdD-q2jXzzCQHYJpVtu7K_gZi-AT72R_HJtWOinqplow0JL4_2w-xRxmPyr_JzWATMdlnD-IrGS1emJfj3dBao67YU0W4yW5JDdQhrHyVwsPY1_9GMzVghRFa7w8wFiLWjQ1D-FVtvrQ3z1gc9e-ZBv4g7Uez52f2Eq3H3Xt3bt9ce6tPxE2WlPk6wxSNdGzknl_IqgbdDvSFax9XTDEazYtWyCFETZScjdNLXWx76RDRbobGHq1Tpuvs--bdT02k7eFZ2olG_nSJDZ4rrd4XsLtjhVE3tq3AoeUusdXlfqu393nfGb1lOE6HGBbAWE_EYawWUw0wD812E8xPJcYN8mFxnBqU_KFNmyznStDBDW9k4RuEJ03x8ct5GP956ggms_bUH6CCvjawovqzQdG6J9RIZ3EErKGKDZbXk-nBuNxty788kaD0JJLdm0Off0onIBwVvscO9M67WHCWPeGLN_d1Q-gcV_DU_OEkNtaORWfSrItBrLp5WsHQQwo_pR8tlimIn1gYE2jPxFf_-VOfnlW-3u1vUzl7wCaR3pJm5bBIFjTTrwLm0nlsXwAfp6-V6dJf8FtY8CBWv8Xy_d4lHIx7qZ4MvM1dQWDjja67FBdyY-U2kEHxC_TPLFr96CzCCLEqCFeNJlqxiZrfciQKHQPVnD0WYHd_2URxcQc4Y8dRbkr-xy7R9U8D7HYcycJ1T_d1wPOsjGU2BlUHFYg_b45cH5UkFqd1lmGQ5QcHcsGhWTEp6f-R03aeNEM37lG9efy5RrYOIsmpWmOLOj5nGLhNXfwBCMaG9xePTeS0PgkResLSUaN82WVhnhbn-QbkPsMCXs9BE7Xo2mH3BSq6vgbvGUkQImc5O83sMq0Py8xGhK9_0s9FL0JwFt48jZZI6-SA9asDmiVQgQBtOZ0ML_oF79Hl5dXQDxWrchxQ6xVaDXDF4CJqH0&sai=AMfl-YQFGcLNrjE0_Y11FPc14ajk7ssodO__z16SESE0nGMYQVFvMPRD7cSf8iuPviSpna88o3rnUHIgZTrADaHGzyh7ctbetbC3Wlxs6PzhYnqhEzYda9t9F1SGd5pkMlve33CU_BIO7XeulsyzGRNHY5-hma_HotEEfZgCw6B74AVkTkSgN_8n_yJh4pJaYWyhOV-Q8NkacHOG2mAEKgcfjRJhLfI5_242JrMHdb9ky_XxknUTQgfo0PvS-SlukZRpKtrbcIQW920mwSYRTrtn7kigd7ctri2z9TH2Avn1ThQEMnDQpDPPBODpBy9RF_IhXz0EWFMeXrqgdVS9oQk0UdpoCJ_Ob-G8fYE3aYmZGQcsKbrKoHaXOpzNDe1guuQa-hPveN69xoGZjBqeUmAg0B1KxfhihtFW0TVDMmOkhhiS1Jd-0hPARM-Weq7d26RitwOPgmmXzWTgNaNscpt2ctyvI3w1YaydielRYDbZQg2b-tUR3KXjB1IPX1MqTH_OFu_2nQ4JsnMrmpWGNw&sig=Cg0ArKJSzN26MTuN41_9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1310&cbvp=1&cstd=1296&cisv=r20230706.23291&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 11 Jul 2023 01:55:17 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 991F 35 B
1 KB 222ms
91ms Image
image/gif 2600:1400:9000:18b::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=11428822&siteID=N3340.3424460DV360DISPLAY&creativeID=135952471&placementID=362956986&rnd=2884078673&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2600:1400:9000:18b::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Date: Tue, 11 Jul 2023 01:55:17 GMT
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: unsafe-url
Vary: Accept-Encoding
X-Frame-Options: ALLOWALL
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Tue, 11 Jul 2023 01:55:17 GMT

OPTIONS
H2 200 async
api-2-0.spot.im/v1.0.0/conversation/ Frame 0
0 195ms
70ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/async

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-access-token,x-post-id,x-spot-id,x-spotim-device-uuid,x-spotim-device-v2,x-spotim-page-view-id
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:17 GMT
server: fasthttp
strict-transport-security: max-age=31536000
via: 1.1 98bc8180e0431e8f05afc9802305f1d2.cloudfront.net (CloudFront)
x-amz-cf-id: TnTy514aO6GiKLs6nb_x3rNkrcFNlNUWZxakJRc2eY04BWagOgPHVw==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

POST
H2 202 async Show response
api-2-0.spot.im/v1.0.0/conversation/ 3 B
2 KB 221ms
89ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/async

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/480-bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-post-id: 26897126
accept-language: en-US,en;q=0.9
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json
Accept: application/json
x-spot-id: sp_Sx8YukwE
x-spotim-page-view-id: 7c0165b7-2b99-4969-ad26-befdcc2f3ff1
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInZlcmlmaWVkIjpmYWxzZSwidXNlcl9pZCI6InVfRkVxaEw5ck9RQWk0IiwiZGlzcGxheV9uYW1lIjoiR29sZENvY2t0YWlsIiwidXNlcl9uYW1lIjoiR29sZENvY2t0YWlsIiwicmVnaXN0ZXJlZCI6ZmFsc2UsImltYWdlX2lkIjoiI0dvbGQtQ29ja3RhaWwiLCJyb2xlcyI6W10sInNzb19kYXRhIjpudWxsLCJwcm92aWRlcnMiOm51bGwsInJlcHV0YXRpb24iOnt9LCJzcG90X2lkIjoic3BfU3g4WXVrd0UiLCJsYXN0X2NoZWNrIjoxNjg5MDQwNTEyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMjMwNzExcmRDWkxoLjAzNzU4ZjRlMWRmNTJkNDZkZWJkMDI4M2JjYzNmNmMyNTEyZTc4NmQ1NTY3YzM1MjNhZDk5ZTdhODUxYWZlYTkiLCJwZXJtaXNzaW9ucyI6bnVsbCwic3BvdGltLWRldmljZS12MiI6ImRfSnJTNlFxeE42MTJnTFplMkp1RXgiLCJuZXR3b3JrIjp7Im5ldHdvcmtfaWQiOiJuZXRfbnlwb3N0IiwibmV0d29ya19uYW1lIjoiTllQb3N0IiwibmV0d29ya19pbWFnZV9pZCI6Ik5ZUG9zdCIsIm5ldHdvcmtfY29sb3IiOiIjQ0MzMzMzIn0sInNwb3RfbmFtZSI6IiIsImRvbWFpbiI6IiIsInJvbGVzX251bWJlciI6MCwidGVtcF91c2VyIjpmYWxzZSwiZXhwIjoxNzE3NDYyNTEyLCJzdWIiOiJ1X0ZFcWhMOXJPUUFpNCJ9.bJD27s1123S3CPCYGFsfSDBjC3EISpulrrTgoZoDPxo

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
via: 1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
x-spotim-networkid: net_nypost
content-length: 3
x-spotim-token: 01230711rdCZLh.03758f4e1df52d46debd0283bcc3f6c2512e786d5567c3523ad99e7a851afea9
x-request-id: fc4a4a84-1f8d-11ee-8b34-de9b898a41c2
x-guid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
server: fasthttp
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
x-amz-cf-id: cGn9FDs3w1laF8wM7iuF7EBXED4Ba7cg6k78AOvUw_4dHRjqTXVrZw==

GET
H2 200 insights.bin Show response
ins.connatix.com/48a517c38c408b59e57236f4b3ad80fc/ Frame 5EC0 540 B
643 B 220ms
98ms XHR
application/x-protobuf 172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/48a517c38c408b59e57236f4b3ad80fc/insights.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e76030157520ac7b8d4bb971fe52ff2f44418ebcd02167299073bf75b7c7a3b8

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 10 May 2023 17:36:39 GMT
server: cloudflare
etag: W/"850e1543e5e6290638c00238c2314db5"
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: application/x-protobuf
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
vary: Accept-Encoding
cf-ray: 7e4d6c64c99f6dce-MIA
alt-svc: h3=":443"; ma=86400
expires: Wed, 10 Jul 2024 01:55:17 GMT

GET
H/1.1 200
OK log
c21lg-d.media.net/ Frame 9CC4 35 B
296 B 133ms
133ms Image
image/gif 23.52.158.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-c&ovsid=YfrCWO9Hpdv07DRKQFvfSQ_Vl3huGJr6&cs=15&vsid=3320421111524274000V10
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU3I8M1G&prvid=2033%2C2030%2C2073%2C273%2C2027%2C159%2C2026%2C117%2C238%2C239%2C97%2C99%2C59%2C3012%2C3010%2C201%2C3007%2C246%2C4%2C126%2C203%2C9%2C171%2C173%2C294%2C251%2C178%2C3017%2C214%2C3016%2C3015%2C337%2C338%2C459%2C77%2C184%2C261%2C141%2C262%2C461%2C188%2C222%2C345%2C225%2C226%2C10000%2C80%2C108%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.52.158.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-158-180.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3B0F 34 KB
10 KB 61ms
61ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: feeb98f30c6b03b47d474792b88ea05241e469d24f193cafa3927310602ce670

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9477
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E1EA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wkt5MmdBQUFBSHZQQ2dBdA==&google_gid=CAESEJrQbtkTcf48HwOtUYmzbFE&google_cver=1&google_push=AaAOQGEhIvcsw1WLUd4kbYoeHpEsI9R6q8...

170 B
192 B

84ms
84ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wkt5MmdBQUFBSHZQQ2dBdA==&google_gid=CAESEJrQbtkTcf48HwOtUYmzbFE&google_cver=1&google_push=AaAOQGEhIvcsw1WLUd4kbYoeHpEsI9R6q8S5KS0W1n0uEzkIoAQvGAdVqgvF9Dpna8n3n5ZCdSRIcuTtRiH7tZbpTIx9keYRnQ

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-mia-kmia1760066-MIA
pragma: no-cache
date: Tue, 11 Jul 2023 01:55:17 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1689040518.825469,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=Wkt5MmdBQUFBSHZQQ2dBdA==&google_gid=CAESEJrQbtkTcf48HwOtUYmzbFE&google_cver=1&google_push=AaAOQGEhIvcsw1WLUd4kbYoeHpEsI9R6q8S5KS0W1n0uEzkIoAQvGAdVqgvF9Dpna8n3n5ZCdSRIcuTtRiH7tZbpTIx9keYRnQ
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET

pixel
cm.g.doubleclick.net/ Frame E1EA
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESELmpCi1sMnVXnPD_dndJYL4&google_cver=1&google_push=AaAOQGE8Kfat96jeYedY50tdfCSl2mOa5q0GPMnFo5stOX1bIq31OwP91hmhjNVmhvMpJBm9nZM8G7CDJpBYMNJH...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=j5LJQVCER_iuAAQozC1Dkg2&google_push=AaAOQGE8Kfat96jeYedY50tdfCSl2mOa5q0GPMnFo5stOX1bIq31OwP91hmhjNVmhvMpJBm9nZM8G7CDJpBYMNJHxPg1o0GRJfQ

0
0

GET

pixel
cm.g.doubleclick.net/ Frame E1EA
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEDU4TgGOru_SGJWMjxmC8GA&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MjM5NWQ0MDItMmI0Yi00MGZlLThhNTEtNWY0ZDNjNDFkMzU2&google_gid=CAESEDU4TgGOru_SGJWMjxmC8GA&google_cver=1&google_push=AaAOQGEL...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E1EA
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEN2k_tofzUGQu6CSRD6dUQg&google_cver=1&google_push=AaAOQGFPQ8Xc-VgVoQicAZB_47LlPMheeX8EOzhERNKWVIxDQ2u19sfBS8ECvMvWuo0bkwF9iFbKV4jUuqbZc3AuaFud...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFPQ8Xc-VgVoQicAZB_47LlPMheeX8EOzhERNKWVIxDQ2u19sfBS8ECvMvWuo0bkwF9iFbKV4jUuqbZc3AuaFud3pusFQ&google_hm=d9JRHyF9TNWrAEDKPzP_hQ==

170 B
192 B

85ms
84ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFPQ8Xc-VgVoQicAZB_47LlPMheeX8EOzhERNKWVIxDQ2u19sfBS8ECvMvWuo0bkwF9iFbKV4jUuqbZc3AuaFud3pusFQ&google_hm=d9JRHyF9TNWrAEDKPzP_hQ==

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AaAOQGFPQ8Xc-VgVoQicAZB_47LlPMheeX8EOzhERNKWVIxDQ2u19sfBS8ECvMvWuo0bkwF9iFbKV4jUuqbZc3AuaFud3pusFQ&google_hm=d9JRHyF9TNWrAEDKPzP_hQ==
Date: Tue, 11 Jul 2023 01:55:17 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E1EA
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEP5L-IaXvTah-YtpDcFsH98&google_cver=1&google_push=AaAOQGHyUA5jVwgMvh2H3uRsghHSd_IaUjXKP-ovKl1BIZVijZsr0B9GW4t4yhYofp7tY4KDMS466Ko4Sk5zX9tPLKBRPLCzszw
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D&google_push=AaAOQGHyUA5jVwgMvh2H3uRsghHSd_IaUjXKP-ovKl1BIZVijZsr0B9G...

170 B
192 B

78ms
77ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D&google_push=AaAOQGHyUA5jVwgMvh2H3uRsghHSd_IaUjXKP-ovKl1BIZVijZsr0B9GW4t4yhYofp7tY4KDMS466Ko4Sk5zX9tPLKBRPLCzszw

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgwNDUyNDgxOTk5NjI4OTU2OTExMQ%3D%3D&google_push=AaAOQGHyUA5jVwgMvh2H3uRsghHSd_IaUjXKP-ovKl1BIZVijZsr0B9GW4t4yhYofp7tY4KDMS466Ko4Sk5zX9tPLKBRPLCzszw
date: Tue, 11 Jul 2023 01:55:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET

pixel
cm.g.doubleclick.net/ Frame E1EA
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESELxSdDCELl4rskFQ4nEnUhQ&google_cver=1&google_push=AaAOQGH67a3Uurdr0yAHogYugNTal9BDiWAdNNmeJwTSzrHs5_k2pG6UpLHfQZr9X_rjYmdspVrMgYdJPOqxz-H6eB9vksZ7b8g
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AaAOQGH67a3Uurdr0yAHogYugNTal9BDiWAdNNmeJwTSzrHs5_k2pG6UpLHfQZr9X_rjYmdspVrMgYdJPOqxz-H6eB9vksZ7b8g&google_hm=8a43405f1e914cf07426...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E1EA
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEKkRQyNP0yQwDHtsy9qiP9U&google_cver=1&google_push=AaAOQGFiWhYsNG3c3iITKuM32tYNegbu7e02Yd1rINI4N0jt9cDi7Cwco5zaesJIkZk2LUZJe6r79fAkIMbzQPu...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=W67-VEitG0qr99f2DQeHCQ&google_push=AaAOQGFiWhYsNG3c3iITKuM32tYNegbu7e02Yd1rINI4N0jt9cDi7Cwco5zaesJIkZk2LUZJe6r79fAkIMbzQPuysbMuAh16-l4

170 B
192 B

87ms
87ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=W67-VEitG0qr99f2DQeHCQ&google_push=AaAOQGFiWhYsNG3c3iITKuM32tYNegbu7e02Yd1rINI4N0jt9cDi7Cwco5zaesJIkZk2LUZJe6r79fAkIMbzQPuysbMuAh16-l4

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=W67-VEitG0qr99f2DQeHCQ&google_push=AaAOQGFiWhYsNG3c3iITKuM32tYNegbu7e02Yd1rINI4N0jt9cDi7Cwco5zaesJIkZk2LUZJe6r79fAkIMbzQPuysbMuAh16-l4
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E1EA 0
14 B 80ms
75ms Image
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lb8W3YRWxHZAMHtne1TByoc9kAga_EXqAg2eQao7etgn1QQWg_cVUZaechT0BxbyqC5xkMBw

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET

pixel
cm.g.doubleclick.net/ Frame 2002
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELYc_rdCTzS9ffmwMafpN1E&google_cver=1&google_push=AaAOQGEIBbmrFt7dhCQ4QyKnWmoAShAqZHRO6C4YqbwU7jdDv-fj8Ppccs...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AaAOQGEIBbmrFt7dhCQ4QyKnWmoAShAqZHRO6C4YqbwU7jdDv-fj8Ppccs7nwpQd2u3UWigcEG0ivAI7BuhfXY7Q7JXUBcSh8y9w&google_hm=y-CfdZ...

0
0

GET

pixel
cm.g.doubleclick.net/ Frame 2002
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEJMz_O1ZGo4JT7vXqizj_Lc&google_cver=1&google_push=AaAOQGEZDP2km7nkF-VIX_TaobU_-tVBK2uiFKh0JWKbXhFzGJuH3--xty_0S6CWq3G3y_S5Tby-g...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AaAOQGEZDP2km7nkF-VIX_TaobU_-tVBK2uiFKh0JWKbXhFzGJuH3--xty_0S6CWq3G3y_S5Tby-gAOLy4Tu8Wltv6nP7efVMeEZ

0
0

GET

pixel
cm.g.doubleclick.net/ Frame 2002
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEDU4TgGOru_SGJWMjxmC8GA&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=M2RhN2MyMzYtOGIxMS00YzdmLWEyMmEtYjk4NTdhYjZjYzI0&google_gid=CAESEDU4TgGOru_SGJWMjxmC8GA&google_cver=1&google_push=AaAOQGHa...

0
0

GET

pixel
cm.g.doubleclick.net/ Frame 2002
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-81ZAWTFFut_JQIwF9y1B5GXCLlFEsUObugJ6Lg&google_push=PUSH_DATA

0
0

GET /
s.uuidksinc.net/match/47/ Frame 2002 0
0

GET /
b1sync.zemanta.com/usersync/googleadx/ Frame 2002 0
0

GET

pixel
cm.g.doubleclick.net/ Frame 2002
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEEyqlDwGyBI83KNmkvD5i0c&google_cver=1&google_push=AaAOQGES7BStDT8kDAI6uvmajgIpZHS8qIqUkHXOG6CF396cAqziQ85wT2UAc7RNAt...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AaAOQGES7BStDT8kDAI6uvmajgIpZHS8qIqUkHXOG6CF396cAqziQ85wT2UAc7RNAtuS5NDZ7J44vAuHZEut_uCqphJIVXUd8IIPnA&google_hm=K...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2002 0
14 B 94ms
93ms Image
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LcfCzGiZPdr9YvdyLKOKPAF-WFWzuafo51onN4Nsy0-QngG03Jj1BaSRLzA5xEIeTwFROA3Q

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame 048B 43 B
632 B 70ms
66ms Image
image/gif 192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=a574f743-628b-4303-bbe4-b219592d783e&expiration=1696989317
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs?us_privacy=1---&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

GET
H/1.1

200
OK

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=&gdpr_consent=&us_privacy=1---&redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1-...
https://sync.targeting.unrulymedia.com/csync/RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005?redir=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D%26gdpr_consent%3D%...
https://prebid-server.rubiconproject.com/setuid?bidder=unruly&gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&account=&f=i&uid=RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005

86 B
1 KB

243ms
60ms

Image
image/png

69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?bidder=unruly&gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&account=&f=i&uid=RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
Requested by: Host: blank
URL: about:blank
Protocol: HTTP/1.1
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/png
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-encoding: gzip
transfer-encoding: chunked
Expires: 0

Redirect headers

Date: Tue, 11 Jul 2023 01:55:18 GMT
Server: Tengine
ETag: RX45a5c1a4eba94f1aacfabcedfb69ec4d005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://prebid-server.rubiconproject.com/setuid?bidder=unruly&gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&account=&f=i&uid=RX-45a5c1a4-eba9-4f1a-acfa-bcedfb69ec4d-005
Content-Type: text/html
Connection: keep-alive

GET

sync
ads.servenobid.com/ Frame 956F
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=duration_media&khaos=LJXN3YYH-1F-G80F
https://ads.servenobid.com/sync?pid=323&uid=LJXN3YYH-1F-G80F

0
0

GET
H3 200 style.css
s0.2mdn.net/sadbundle/10829031822675935232/ Frame 7069 1 KB
489 B 69ms
69ms Stylesheet
text/css 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10829031822675935232/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=oo9fSwwSNo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d4a2077033a6422cf28b16cdbb4aac876ffb8b148f50211a391c5f9eb1b8dfc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=oo9fSwwSNo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 22:45:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270565
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 460
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 21:39:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 06 Jul 2024 22:45:52 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 7069 120 KB
41 KB 72ms
71ms Script
text/javascript 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=oo9fSwwSNo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=oo9fSwwSNo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 12 Jul 2023 01:53:16 GMT

GET logic.js
s0.2mdn.net/sadbundle/10829031822675935232/ Frame 7069 0
0

GET

pixel
cm.g.doubleclick.net/ Frame A193
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-81ZAWTFFut_JQIwF9y1B5GXCLlFEsUObugJ6Lg&google_push=PUSH_DATA

0
0

GET

pixel
cm.g.doubleclick.net/ Frame A193
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESECkJNjPOVByhd_wYaXCZ8Bw&google_cver=1&google_push=AaAOQGFg8yrzoIGJfPlKZ2gLn85lwVxLIKAp1wZhc-MSXYVTgiA-szcvnEpYtVEeb8rJw6QEW65qngj5mVTmqsE...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=-nY4QBKbV1VBZ9n4Y1Fx5CaEdko&google_push=AaAOQGFg8yrzoIGJfPlKZ2gLn85lwVxLIKAp1wZhc-MSXYVTgiA-szcvnEpYtVEeb8rJw6QEW65qngj5mVTmqs...

0
0

GET

pixel
cm.g.doubleclick.net/ Frame A193
Redirect Chain

https://google.partners.tremorhub.com/sync?UIDF=CAESEMecjMx3Fq670iMr2fqzXhE&google_cver=1&google_push=AaAOQGG1nqcQyKk-mtNiHTTxUXggLf10hJwcfcjhD5UxYPwMjI5slu6IRS4roIMoGSOR5dSdiem4q8KCbSktP29zvd8pYIGTgQ
https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=YWI2NTU4YTc1NWVmNDMzY2E3ZDhhMDFkMzc0YTZmM2Y%3D&UIDF=CAESEMecjMx3Fq670iMr2fqzXhE&google_cver=1&google_push=AaAOQGG1nqcQyKk-mtNiHTTxUXgg...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A193
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEHDs3L4qPvK517nOc8at4LY&google_cver=1&google_push=AaAOQGE2e3_B9QIXU5z9XDLUeUUPJ2S9p1KcZyuFOFhA_GGOa3qbqhOo4Fezy5eYwE8eJ1XQZMsC46...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AaAOQGE2e3_B9QIXU5z9XDLUeUUPJ2S9p1KcZyuFOFhA_GGOa3qbqhOo4Fezy5eYwE8eJ1XQZMsC46aTsG1sd6CxhJFPPqMuORw&google_hm=ODAwNDIxMjA...

170 B
192 B

79ms
79ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AaAOQGE2e3_B9QIXU5z9XDLUeUUPJ2S9p1KcZyuFOFhA_GGOa3qbqhOo4Fezy5eYwE8eJ1XQZMsC46aTsG1sd6CxhJFPPqMuORw&google_hm=ODAwNDIxMjA0Mzg0NDkzMjQ3Nw%3D%3D

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AaAOQGE2e3_B9QIXU5z9XDLUeUUPJ2S9p1KcZyuFOFhA_GGOa3qbqhOo4Fezy5eYwE8eJ1XQZMsC46aTsG1sd6CxhJFPPqMuORw&google_hm=ODAwNDIxMjA0Mzg0NDkzMjQ3Nw%3D%3D
date: Tue, 11 Jul 2023 01:55:16 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A193
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEKkRQyNP0yQwDHtsy9qiP9U&google_cver=1&google_push=AaAOQGHJ4DolfSweg-rUFHXu1dxbYn9236LDxDF5EhJ2Oq3ZmFQNhuojqpkdjV6O_IWVB904njwrf6Htgy1DoDi...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=W67-VEitG0qr99f2DQeHCQ&google_push=AaAOQGHJ4DolfSweg-rUFHXu1dxbYn9236LDxDF5EhJ2Oq3ZmFQNhuojqpkdjV6O_IWVB904njwrf6Htgy1DoDiXDcbVFZrU8ZDw

170 B
192 B

78ms
77ms

Image
image/png

142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=W67-VEitG0qr99f2DQeHCQ&google_push=AaAOQGHJ4DolfSweg-rUFHXu1dxbYn9236LDxDF5EhJ2Oq3ZmFQNhuojqpkdjV6O_IWVB904njwrf6Htgy1DoDiXDcbVFZrU8ZDw

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=W67-VEitG0qr99f2DQeHCQ&google_push=AaAOQGHJ4DolfSweg-rUFHXu1dxbYn9236LDxDF5EhJ2Oq3ZmFQNhuojqpkdjV6O_IWVB904njwrf6Htgy1DoDiXDcbVFZrU8ZDw
Date: Tue, 11 Jul 2023 01:55:17 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET CAESEFd5qP_Qx6aJkNZV9Cy75ls
an.yandex.ru/mapuid/google/ Frame A193 0
0

GET

pixel
cm.g.doubleclick.net/ Frame A193
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEHHfLgrfaXSuUCi34jvbtog&google_cver=1&google_push=AaAOQGEG_HHajLuoO...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NjExMzY5ODEzMDUzMjE4OTU2Mg%3D%3D&google_gid=CAESEHHfLgrfaXSuUCi34jvbtog&google_cver=1&google_push=AaAOQGEG_HHajLuoOyRytPFSg64hT0JTpJ...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A193 0
14 B 77ms
75ms Image
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LG_BsQEqeInSWQ3MChnvUllA3e5cJ4OBDWgjQ6sm9tRr27fgSxQXlES9DGR-_IUcWaqj4NPZc4

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 style.css
s0.2mdn.net/sadbundle/7400983265688944640/ Frame AD79 1 KB
492 B 64ms
64ms Stylesheet
text/css 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7400983265688944640/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7400983265688944640/index.html?e=69&leftOffset=0&topOffset=0&c=grJmw21U2m&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37dbe9692ba2bab321d05d32c9e680880cec53641d066bdd9bd04e37b3c83f93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7400983265688944640/index.html?e=69&leftOffset=0&topOffset=0&c=grJmw21U2m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 22:51:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270232
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 463
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 21:40:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 06 Jul 2024 22:51:25 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame AD79 120 KB
41 KB 90ms
88ms Script
text/javascript 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7400983265688944640/index.html?e=69&leftOffset=0&topOffset=0&c=grJmw21U2m&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7400983265688944640/index.html?e=69&leftOffset=0&topOffset=0&c=grJmw21U2m&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 12 Jul 2023 01:53:16 GMT

GET logic.js
s0.2mdn.net/sadbundle/7400983265688944640/ Frame AD79 0
0

GET
H2 200 sync Show response
ads.servenobid.com/ Frame B993 0
344 B 69ms
56ms Document
text/html 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/sync?pid=152&uid=A5973365521208486233
Requested by: Host: sync.adkernel.com
URL: https://sync.adkernel.com/user-sync?zone=181225&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D152%26uid%3D%7BUID%7D&gdpr=0&gdpr_consent=&us_privacy=1---&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.adkernel.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
amp-access-control-allow-source-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length: 0
content-type: text/html;charset=ISO-8859-1
date: Tue, 11 Jul 2023 01:55:17 GMT

GET
H/1.1 200
OK usync.js
eus.rubiconproject.com/ Frame 2F5B 34 KB
0 81ms
69ms Script
text/html 23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:17 GMT
Content-Encoding: gzip
Last-Modified: Mon, 10 Jul 2023 04:32:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9477
Connection: keep-alive
Content-Length: 10154
Expires: Tue, 11 Jul 2023 04:33:14 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/10829031822675935232/ Frame DE60 1 KB
489 B 65ms
65ms Stylesheet
text/css 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10829031822675935232/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=nmExgGNCQ9&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d4a2077033a6422cf28b16cdbb4aac876ffb8b148f50211a391c5f9eb1b8dfc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=nmExgGNCQ9&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 07 Jul 2023 22:45:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270565
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 460
x-xss-protection: 0
last-modified: Fri, 07 Jul 2023 21:39:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 06 Jul 2024 22:45:52 GMT

GET
H3 200 Enabler_01_250.js
s0.2mdn.net/879366/ Frame DE60 120 KB
0 84ms
83ms Script
text/javascript 2607:f8b0:4006:820::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=nmExgGNCQ9&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2006 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10829031822675935232/index.html?e=69&leftOffset=0&topOffset=0&c=nmExgGNCQ9&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 121
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 12 Jul 2023 01:53:16 GMT

GET logic.js
s0.2mdn.net/sadbundle/10829031822675935232/ Frame DE60 0
0

GET
H2 200 ad-container-bundle.js Show response
static-cdn.spot.im/production/conversation/tags/v3.81.36/ 852 B
958 B 179ms
59ms Script
application/javascript 54.230.163.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-cdn.spot.im/production/conversation/tags/v3.81.36/ad-container-bundle.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-100.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 58ca8a8728aab5eb04ff421770d9fd8fdf965900a774a3ca3bd6c18240bcb913

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 16:04:35 GMT
content-encoding: br
via: 1.1 0a41fb8a1e6869f7cc14f05241a462fa.cloudfront.net (CloudFront)
x-amz-version-id: 5l1mQI845xxUlo6Tfs5c9.GNemj9x8v2
x-amz-cf-pop: EWR53-C3
age: 1158644
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 484
last-modified: Tue, 27 Jun 2023 16:02:08 GMT
server: AmazonS3
etag: "bb245ffafcdb8bde4d253e8fd5421cdb"
vary: Origin
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: eG5SE_3rzlO2cqkefpl7TMbyLu8hK4_uduciEJ-9R-h8Q940PcbdZA==

GET

pixel
cm.g.doubleclick.net/ Frame C1F0
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEJMz_O1ZGo4JT7vXqizj_Lc&google_cver=1&google_push=AaAOQGGahTRAB0nlbazTUMM7MF9XvtlQnInGSyrTozFMCuM0ZaZxgaWk9ngK9lXSgLJY4ZgWPdMY-...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AaAOQGGahTRAB0nlbazTUMM7MF9XvtlQnInGSyrTozFMCuM0ZaZxgaWk9ngK9lXSgLJY4ZgWPdMY-w67Oruv4rTajIN8BdxvsRs

0
0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame C1F0 0
173 B 147ms
57ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEELBy6GzUTy5hjiPE_DM5Ks&google_cver=1&google_push=AaAOQGG3o3jSDl2QHOuOp3UWqX8H--4wlspJVNu2omgXWNXG_FyOT75IXNjw3ZrVJr2GpJXP248ebWsEgM6t-SMKv-ZOPFa-Bks
Requested by: Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET

pixel
cm.g.doubleclick.net/ Frame C1F0
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEK5GqiW8jSpmXDGXeVErOiM&google_cver=1&google_push=AaAOQGGdxkvHdJW6mEtnTGAVxiPyEOs_DuStjVhqnAwEIdDuA1eoL087ZRGXszbzz0JXpxUGFs4f8aerpB0i-dumAW-JovcIrt0
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MzY4MDU3MzE4MkI5RkY3Qg==

0
0

GET /
b1sync.zemanta.com/usersync/googleadx/ Frame C1F0 0
0

GET

pixel
cm.g.doubleclick.net/ Frame C1F0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOi4rfCjYPV0b3vViPUJR_w&google_cver=1&google_push=AaAOQGGUoSO2p51yZ1XuryreCou-lyHVi7m1Dn6geFUL_aITezCRI3ed0um1La4vwdF1RqBQ3cd...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpYTjNZWUgtMUYtRzgwRg==&google_push=AaAOQGGUoSO2p51yZ1XuryreCou-lyHVi7m1Dn6geFUL_aITezCRI3ed0um1La4vwdF1RqBQ3cd-smLqSlBwckQWBuoSqTF0Qjg

0
0

GET

pixel
cm.g.doubleclick.net/ Frame C1F0
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEJs3bouD_LCPWbgXjH9mM4I&google_cver=1&google_push=AaAOQGH9U5qBOTaW8zmxkzBBLPbZNcHZbDzpbhiN7qCPBgZ6TZYKGLCynLFYq-WyquolaCRsvRzyzvFhub2FvOBNx...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=OTZkZWRjYzgtNTAzYS00OTVhLWE1ZTUtNTA2ZWYxMjJmZmEx&google_push=AaAOQGH9U5qBOTaW8zmxkzBBLPbZNcHZbDzpbhiN7qCPBgZ6TZYKGLCynLFYq-Wy...

0
0

GET

pixel
cm.g.doubleclick.net/ Frame C1F0
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEIrYnfO7ViI_kporkcjaD7k&google_cver=1&google_push=AaAOQGGpHfRBqVmM14AjgjJ0V5HHR47SbjnIOMdthjGUGQAtaTK-vMlxmT39Oyg1Z5wq3Ex5c5dqxQUVQWi...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AaAOQGGpHfRBqVmM14AjgjJ0V5HHR47SbjnIOMdthjGUGQAtaTK-vMlxmT39Oyg1Z5wq3Ex5c5dqxQUVQWi1ZM7aFSEctMpUx-4

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C1F0 0
14 B 76ms
74ms Image
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JRJdo3yC68IQ1gk4Jahkv12x7E9Ciua5GoWM_7WfOjZfwEyERaWXdFqLRM6Ghp52v42dsunoc

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 94DA 0
0 89ms
88ms Fetch
image/gif 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvu9K6cHsOXY330uzlKpZ6L6MBtqKOCge5fX59ogYR38mSoyJkAtH-IqFGyLeHncF5LDDCcCNlBp4gZ-IfstfyoPUCaNscNQSCrTntJXIITQlCCN4LRARJWqk3C7aXwR2_m8byLiXaVNEGrZuB5l5FKXDHa2_Ck52K0aUW_cHA2MTy4q6ICvshse35gzK8HPon6YmiUX4bgS9Aob6S2GukuattjqY-493bJycR1Eog&sai=AMfl-YQFazr01dJwOlPKs0jF8bEscY26B1yCN5oFpBD08omk4_8tI28NISbGnhOWgYrEDcuXLjBrDluCvJM34OA3MxIAiGI85hH0FX9__rOt2_7MnkRLIc14iOaX1KCJPZIhYFrLgVrcbDkc4rkr6FC1&sig=Cg0ArKJSzP2dWmv7-jCiEAE&cid=CAQSTgBpAlJWctwOGy4ydZ_lLKmSAlvnnRVat0eYnt4dNRmMYMGNLUiqjbEmr1kC_gqY8v_LesBW3oXzhkWrM9LBgEDE1oggqJNhQRm0efUv3xgB&id=lidar2&mcvt=1381&p=237,315,487,1285&mtos=1381,1381,1381,1381,1381&tos=1381,0,0,0,0&v=20230710&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3705377758&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1689040512579&rpt=3935&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster
image6.pubmatic.com/AdServer/ Frame 4287 4 KB
0 63ms
63ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=98410093&p=156758&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156758&userIdMacro=PM_UID&predirect=https%3A%2F%2Fsync.spotim.market%2Fcsync%3Ft%3Da%26ep%3D281178%26extuid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 11 Jul 2023 01:55:16 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 76BB 22 KB
0 64ms
63ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1930
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:23:08 GMT
expires: Wed, 10 Jul 2024 01:23:08 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 14DB 22 KB
0 64ms
63ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1930
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:23:08 GMT
expires: Wed, 10 Jul 2024 01:23:08 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame C2F5 22 KB
0 71ms
63ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1930
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:23:08 GMT
expires: Wed, 10 Jul 2024 01:23:08 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK dv-measurements4122.js
cdn.doubleverify.com/ Frame 13AA 547 KB
0 70ms
70ms Script
application/javascript 2600:1400:9000::6875:b641
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements4122.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Tue, 11 Jul 2023 01:55:18 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jul 2023 07:43:16 GMT
Server: UploadServer
ETag: "9b4ec8c5f3573c4020d70289eee8e2d0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 106219
Expires: Fri, 05 Jul 2024 07:43:26 GMT

GET
H3 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame FAEF 22 KB
0 63ms
63ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/b-e09f10f-a7b8af42.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1930
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jul 2023 01:23:08 GMT
expires: Wed, 10 Jul 2024 01:23:08 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2178 0
26 B 92ms
92ms Image
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodarir&v=30&d=1&s=1&f=0.01&bgai=By4w5g7asZObYD9GvyQO16qC4AQAAAAA4AeAEAg

Requested by

Host: 0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com
URL: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://0a0637f1941b0e05d3fbec0a7001146a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usync.html
eus.rubiconproject.com/ Frame 49F1
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=synacor_xapi&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=synacor_xapi&endpoint=us-east

0
0

95ms
95ms

Document
text/html

23.196.181.108
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=synacor_xapi&endpoint=us-east
Requested by: Host: ad-cdn.technoratimedia.com
URL: https://ad-cdn.technoratimedia.com/html/usersync.html?gdpr=0&gdpr_consent=&us_privacy=1---&srv=cs&source=duration&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D362%26uid%3D%5BUSER_ID%5D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.196.181.108 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-196-181-108.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Referer: https://ad-cdn.technoratimedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jul 2023 01:55:18 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 11 Jul 2023 01:55:18 GMT
location: https://eus.rubiconproject.com/usync.html?p=synacor_xapi&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame D875 0
0 193ms
69ms Document
text/html 72.247.71.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156344&userIdMacro=%24UID%24&predirect=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D45%26uid%3D%24UID%24
Requested by: Host: ad-cdn.technoratimedia.com
URL: https://ad-cdn.technoratimedia.com/html/usersync.html?gdpr=0&gdpr_consent=&us_privacy=1---&srv=cs&source=duration&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D362%26uid%3D%5BUSER_ID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.71.192 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-71-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Referer: https://ad-cdn.technoratimedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=126792
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Tue, 11 Jul 2023 01:55:18 GMT
expires: Wed, 12 Jul 2023 13:08:30 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 cm
us-u.openx.net/w/1.0/ Frame 497D 0
0 85ms
66ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=8da2f9dd-77de-4961-a71d-959c5609fdb1&ph=9c552f28-6766-4d68-8e0e-995276acc8c6&r=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D50%26uid%3D%7BOPENX_ID%7D
Requested by: Host: ad-cdn.technoratimedia.com
URL: https://ad-cdn.technoratimedia.com/html/usersync.html?gdpr=0&gdpr_consent=&us_privacy=1---&srv=cs&source=duration&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D362%26uid%3D%5BUSER_ID%5D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash

Request headers

Referer: https://ad-cdn.technoratimedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 682
content-type: text/html
date: Tue, 11 Jul 2023 01:55:18 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET

/
hde.tynt.com/deb/ Frame 3396
Redirect Chain

https://pixel.33across.com/ps?m=xch&rt=html&id=0014000001aXjnGAAS&ru=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D61%26uid%3D33XUSERID33X
https://de.tynt.com/deb/?m=xch&rt=html&id=0014000001aXjnGAAS&ru=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D61%26uid%3D33XUSERID33X
https://hde.tynt.com/deb/?m=xch&rt=html&id=0014000001aXjnGAAS&ru=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D61%26uid%3D33XUSERID33X&b=1

0
0

GET
H2 200 /
onetag-sys.com/usync/ Frame FCD1 0
0 98ms
73ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=572a470226457b8

Requested by

Host: ad-cdn.technoratimedia.com
URL: https://ad-cdn.technoratimedia.com/html/usersync.html?gdpr=0&gdpr_consent=&us_privacy=1---&srv=cs&source=duration&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D362%26uid%3D%5BUSER_ID%5D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://ad-cdn.technoratimedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 200 sync
eb2.3lift.com/ Frame F8CA 0
0 82ms
58ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D88%26uid%3D%24UID
Requested by: Host: ad-cdn.technoratimedia.com
URL: https://ad-cdn.technoratimedia.com/html/usersync.html?gdpr=0&gdpr_consent=&us_privacy=1---&srv=cs&source=duration&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D362%26uid%3D%5BUSER_ID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Referer: https://ad-cdn.technoratimedia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1356
content-type: text/html; charset=utf-8
date: Tue, 11 Jul 2023 01:55:18 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET

services
uat-net.technoratimedia.com/ Frame 60CD
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=technoratimedia&ttd_tpi=1
https://uat-net.technoratimedia.com/services?srv=cs&pid=7&uid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6

0
0

GET getuid
secure.adnxs.com/ Frame 60CD 0
0

GET sync
gum.criteo.com/ Frame 60CD 0
0

GET

pixel
cm.g.doubleclick.net/ Frame 60CD
Redirect Chain

https://match.prod.bidr.io/cookie-sync/syn
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEZzUwN0pXVzBBQUNGWHhOYlJsUQ&bee_sync_partners=pm%2Cpp%2Csas%2Csyn&bee_sync_current_partner=adx&bee_sync_initiator=syn...

0
0

GET

generic
match.adsrvr.org/track/cmf/ Frame 60CD
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=synacor&redir=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D76%26uid%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4502681299

0
0

GET server_match
ad.360yield.com/ Frame 60CD 0
0

GET sync
ups.analytics.yahoo.com/ups/58266/ Frame 60CD 0
0

GET

services
sync.technoratimedia.com/ Frame 60CD
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=191740&cb=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26pid%3D82%26uid%3D
https://sync.technoratimedia.com/services?srv=cs&pid=82&uid=ZKy2gPeKFcFmKMEQLWWTawAA%263820

0
0

GET idSync
sync.aralego.com/ Frame 60CD 0
0

GET

sync
odr.mookie1.com/t/v2/ Frame 60CD
Redirect Chain

https://x.bidswitch.net/sync?ssp=synacor&user_id=964902DB58AB4FCDA0596BF7610A8B60
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=77d2511f-217d-4cd5-ab00-40ca3f33ff85&ssp=synacor&gdpr=&gdpr_consent=

0
0

GET current
synacor-match.dotomi.com/match/bounce/ Frame 60CD 0
0

GET cksync.php
contextual.media.net/ Frame 60CD 0
0

GET rtb-h
sync.taboola.com/sg/synacorrtb-network/1/ Frame 60CD 0
0

OPTIONS
H2 200 read
api-2-0.spot.im/v1.0.0/conversation/ Frame 0
0 88ms
65ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/read

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-access-token,x-post-id,x-spot-id,x-spotim-device-uuid,x-spotim-device-v2,x-spotim-page-view-id
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:18 GMT
server: fasthttp
strict-transport-security: max-age=31536000
via: 1.1 98bc8180e0431e8f05afc9802305f1d2.cloudfront.net (CloudFront)
x-amz-cf-id: AYeTnThxwN92yRyXUOguzKACcC2tw4EgI_t0B8jPGbuiHHpbHxOrVA==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

POST
H2 200 read Show response
api-2-0.spot.im/v1.0.0/conversation/ 5 KB
2 KB 268ms
267ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/read

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/480-bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

29f85166852dda78dc1782e2b9f17679405a3b61e0d50eb78355ddb707107266

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-post-id: 26897126
accept-language: en-US,en;q=0.9
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json
Accept: application/json
x-spot-id: sp_Sx8YukwE
x-spotim-page-view-id: 7c0165b7-2b99-4969-ad26-befdcc2f3ff1
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInZlcmlmaWVkIjpmYWxzZSwidXNlcl9pZCI6InVfRkVxaEw5ck9RQWk0IiwiZGlzcGxheV9uYW1lIjoiR29sZENvY2t0YWlsIiwidXNlcl9uYW1lIjoiR29sZENvY2t0YWlsIiwicmVnaXN0ZXJlZCI6ZmFsc2UsImltYWdlX2lkIjoiI0dvbGQtQ29ja3RhaWwiLCJyb2xlcyI6W10sInNzb19kYXRhIjpudWxsLCJwcm92aWRlcnMiOm51bGwsInJlcHV0YXRpb24iOnt9LCJzcG90X2lkIjoic3BfU3g4WXVrd0UiLCJsYXN0X2NoZWNrIjoxNjg5MDQwNTEyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMjMwNzExcmRDWkxoLjAzNzU4ZjRlMWRmNTJkNDZkZWJkMDI4M2JjYzNmNmMyNTEyZTc4NmQ1NTY3YzM1MjNhZDk5ZTdhODUxYWZlYTkiLCJwZXJtaXNzaW9ucyI6bnVsbCwic3BvdGltLWRldmljZS12MiI6ImRfSnJTNlFxeE42MTJnTFplMkp1RXgiLCJuZXR3b3JrIjp7Im5ldHdvcmtfaWQiOiJuZXRfbnlwb3N0IiwibmV0d29ya19uYW1lIjoiTllQb3N0IiwibmV0d29ya19pbWFnZV9pZCI6Ik5ZUG9zdCIsIm5ldHdvcmtfY29sb3IiOiIjQ0MzMzMzIn0sInNwb3RfbmFtZSI6IiIsImRvbWFpbiI6IiIsInJvbGVzX251bWJlciI6MCwidGVtcF91c2VyIjpmYWxzZSwiZXhwIjoxNzE3NDYyNTEyLCJzdWIiOiJ1X0ZFcWhMOXJPUUFpNCJ9.bJD27s1123S3CPCYGFsfSDBjC3EISpulrrTgoZoDPxo

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: gzip
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
strict-transport-security: max-age=31536000
via: 1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
x-spotim-networkid: net_nypost
x-spotim-token: 01230711rdCZLh.03758f4e1df52d46debd0283bcc3f6c2512e786d5567c3523ad99e7a851afea9
x-request-id: fc8ce9fd-1f8d-11ee-96f5-96ba416595ce
x-guid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
server: fasthttp
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
x-amz-cf-id: hAmMjILNOdTliRopdTGhl52GwI089tTuHjjNATE72IZDzZzTUrEklg==

POST us
capi.connatix.com/core/ Frame 5EC0 0
0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 6C5F 0
0 334ms
218ms Document
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=50674DE4-1331-4B8B-A08E-394A47B0E933&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:18 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 259S91QB1AVW9VDZJJVZ

GET

services
sync.technoratimedia.com/ Frame 8AD5
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AADg507JWW0AACFXxNbRlQ&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dsyn%252Csas%252...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=pm&bee_sync_hop_count=1&ev=AADg507JWW0AACFXxNbRlQ&pid=558...
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AADg507JWW0AACFXxNbRlQ&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_syn...

0
0

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 3005
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_510862e8c55d403395bb1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

64ms
63ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Tue, 11 Jul 2023 01:55:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Tue, 11 Jul 2023 01:55:17 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 5BDF
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6113698130532189562&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

72ms
71ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Tue, 11 Jul 2023 01:55:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Tue, 11 Jul 2023 01:55:18 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame F8A4
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ipMQSd6RSRuRnhBJ2ZJcTN-XQU6RxklJicZrpBJU
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

0
0

65ms
64ms

Document
text/plain

162.248.18.32
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private,max-age=86400
date: Tue, 11 Jul 2023 01:55:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Mon, 10 Jul 2023 23:11:22 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET

bridge.gif
cm.adgrx.com/ Frame 3BE5
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=

0
0

GET
H/1.1 200 usersync
usersync.gumgum.com/ Frame C18F 0
0 76ms
73ms Document
image/gif 52.207.45.55
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=pbm&i=50674DE4-1331-4B8B-A08E-394A47B0E933
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.207.45.55 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-45-55.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 11 Jul 2023 01:55:18 GMT
Expires: 0
Pragma: no-cache

GET sd
us-u.openx.net/w/1.0/ Frame 2E74 0
0

GET Martin
crb.kargo.com/api/v1/dsync/ Frame 2E74 0
0

GET sync
sync.bfmio.com/ Frame 2E74 0
0

GET syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 2E74 0
0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame 2E74 0
0

GET sync
x.bidswitch.net/ Frame 2E74 0
0

GET CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 2E74 0
0

GET pixelSync
pixel-sync.sitescout.com/dmp/ Frame 2E74 0
0

POST ucl
capi.connatix.com/tr/ Frame 5EC0 0
0

POST sr
capi.connatix.com/tr/ Frame 5EC0 0
0

GET ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 5EC0 0
0

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 77 KB
26 KB 99ms
98ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/nc-nypost/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21bb0ac7bc205a189039ae2c5c8744f64f51d7cef103fe353e6aa707df72e31d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nypost.com/2023/05/10/wells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 11 Jul 2023 01:55:18 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26356
x-xss-protection: 0
server: cafe
etag: 204 / 19549 / 31075835 / config-hash: 18038137322586664424
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 11 Jul 2023 01:55:18 GMT

GET 2_media.bin
vid.connatix.com/pid-8ae371c3-0e93-499d-a72c-f743029599b4/60764267-557e-410f-85cb-f102d92ee134/4e600944-20fe-434b-af30-f534230c4e2c/ Frame 5EC0 0
0

GET ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 5EC0 0
0

GET elements.ui.ad96891c5e83ab265b66.js
cds.connatix.com/p/293038/ Frame 5EC0 0
0

POST us
capi.connatix.com/core/ Frame 5EC0 0
0

GET sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 2D02 0
0

GET dv-measurements4122.js
cdn.doubleverify.com/ Frame DD70 0
0

GET dv-measurements4122.js
cdn.doubleverify.com/ Frame 82B4 0
0

GET dv-measurements4122.js
cdn.doubleverify.com/ Frame F195 0
0

GET view
googleads4.g.doubleclick.net/pcs/ Frame 94DA 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 94DA 0
0

GET dc_oe=ChMIraCpn8aFgAMVwhOICR3jPQcPEAAYACCB-odKQhMIsa7UncaFgAMVQt2zCh0DXwYX;met=1;&timestamp=1689040518608;eid1=871060;ecn1=1;etm1=0;
ade.googlesyndication.com/ddm/activity/ Frame 94DA 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 5359 0
0

POST /
pl.connatix.com/ Frame 5EC0 0
0

POST csi
csi.gstatic.com/ Frame 80E2 0
0

GET view
googleads4.g.doubleclick.net/pcs/ Frame B752 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame B752 0
0

GET dc_oe=ChMIz9Oln8aFgAMVMx-ICR3gKAPsEAAYACDX8OlAQhMIsK7UncaFgAMVQt2zCh0DXwYX;met=1;&timestamp=1689040518644;eid1=871060;ecn1=1;etm1=0;
ade.googlesyndication.com/ddm/activity/ Frame B752 0
0

GET view
securepubads.g.doubleclick.net/pcs/ Frame C604 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame C604 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 2178 0
0

GET view
googleads4.g.doubleclick.net/pcs/ Frame 991F 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 991F 0
0

GET dc_oe=ChMI4Jytn8aFgAMVQQ2ICR0CrgKqEAAYACDX8OlAQhMIsq7UncaFgAMVQt2zCh0DXwYX;met=1;&timestamp=1689040518684;eid1=871060;ecn1=1;etm1=0;
ade.googlesyndication.com/ddm/activity/ Frame 991F 0
0

POST iev
csm.va.us.criteo.net/ Frame B693 0
0

POST rum
elb.the-ozone-project.com/cdn-cgi/ Frame 05CD 0
0

POST
H2 204 event-stream Show response
k.p-n.io/ 0
125 B 191ms
61ms Fetch 52.6.180.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://k.p-n.io/event-stream
Requested by: Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=lGrO4sEYCy0zUu2DRBSBxuOWIGo8lGqPv8wE
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.6.180.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-180-113.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:19 GMT
access-control-allow-headers: *
access-control-max-age: 600
access-control-allow-methods: *

POST
H2 204 event-stream Show response
k.p-n.io/ 0
126 B 141ms
60ms Fetch 52.6.180.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://k.p-n.io/event-stream
Requested by: Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=lGrO4sEYCy0zUu2DRBSBxuOWIGo8lGqPv8wE
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.6.180.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-180-113.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Tue, 11 Jul 2023 01:55:19 GMT
access-control-allow-headers: *
access-control-max-age: 600
access-control-allow-methods: *

POST
H2 200 metric
metrics-logger.spot.im/ 0
0 234ms
57ms Fetch 35.153.251.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics-logger.spot.im/metric
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/metrics-reporter-bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.251.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-251-106.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://nypost.com
date: Tue, 11 Jul 2023 01:55:19 GMT
content-length: 0

POST
H2 200 pixels
pix.spot.im/api/v1/ 0
230 B 252ms
130ms Ping
application/json 108.138.128.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.spot.im/api/v1/pixels
Requested by: Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/386-bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-41.jfk50.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 11 Jul 2023 01:55:19 GMT
via: 1.1 6d9771d39a0475d92b50bdd9caae11c2.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P4
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
content-length: 0
x-amz-cf-id: 6BA5o_GUHUGCL3svCBNDTGdL0Oc1QMF5M1k5DFc-BxTsmzb0zrkXiA==

GET
H/1.1

200
OK

setuid
prebid-server.rubiconproject.com/
Redirect Chain

https://crb.kargo.com/api/v1/dsync/PrebidServer?gdpr=&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fprebid-server.rubiconproject.com%2Fsetuid%3Fbidder%3Dkargo%26gdpr%3D%26gdpr_consent%3D%26us_priva...
https://prebid-server.rubiconproject.com/setuid?account=&bidder=kargo&f=i&uid=61f9aa47-07e9-56eb-02c2-9e78b398ac7a&us_privacy=1---

86 B
1 KB

59ms
58ms

Image
image/png

69.173.151.96
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-server.rubiconproject.com/setuid?account=&bidder=kargo&f=i&uid=61f9aa47-07e9-56eb-02c2-9e78b398ac7a&us_privacy=1---
Requested by: Host: blank
URL: about:blank
Protocol: HTTP/1.1
Server: 69.173.151.96 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-type: image/png
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
content-encoding: gzip
transfer-encoding: chunked
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:19 GMT
Content-Encoding: gzip
X-Accel-Expires: 0
Vary: Origin
Content-Type: text/html; charset=utf-8
Location: https://prebid-server.rubiconproject.com/setuid?account=&bidder=kargo&f=i&uid=61f9aa47-07e9-56eb-02c2-9e78b398ac7a&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Content-Length: 166
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 200 read Show response
api-2-0.spot.im/v1.0.0/conversation/realtime/ 59 B
659 B 73ms
73ms Fetch
application/json 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/realtime/read

Requested by

Host: static-cdn.spot.im
URL: https://static-cdn.spot.im/production/launcher/tags/v3.7.2/launcher/480-bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

5f13ec04325a2603e98847d00e281a771bf38133eed700d0a859e21187634be9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
x-post-id: 26897126
accept-language: en-US,en;q=0.9
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json
Accept: application/json
x-spot-id: sp_Sx8YukwE
x-spotim-page-view-id: 7c0165b7-2b99-4969-ad26-befdcc2f3ff1
Referer
x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6IiIsInZlcmlmaWVkIjpmYWxzZSwidXNlcl9pZCI6InVfRkVxaEw5ck9RQWk0IiwiZGlzcGxheV9uYW1lIjoiR29sZENvY2t0YWlsIiwidXNlcl9uYW1lIjoiR29sZENvY2t0YWlsIiwicmVnaXN0ZXJlZCI6ZmFsc2UsImltYWdlX2lkIjoiI0dvbGQtQ29ja3RhaWwiLCJyb2xlcyI6W10sInNzb19kYXRhIjpudWxsLCJwcm92aWRlcnMiOm51bGwsInJlcHV0YXRpb24iOnt9LCJzcG90X2lkIjoic3BfU3g4WXVrd0UiLCJsYXN0X2NoZWNrIjoxNjg5MDQwNTEyLCJ2ZXJzaW9uIjoyLCJ4LXNwb3RpbS10b2tlbiI6IjAxMjMwNzExcmRDWkxoLjAzNzU4ZjRlMWRmNTJkNDZkZWJkMDI4M2JjYzNmNmMyNTEyZTc4NmQ1NTY3YzM1MjNhZDk5ZTdhODUxYWZlYTkiLCJwZXJtaXNzaW9ucyI6bnVsbCwic3BvdGltLWRldmljZS12MiI6ImRfSnJTNlFxeE42MTJnTFplMkp1RXgiLCJuZXR3b3JrIjp7Im5ldHdvcmtfaWQiOiJuZXRfbnlwb3N0IiwibmV0d29ya19uYW1lIjoiTllQb3N0IiwibmV0d29ya19pbWFnZV9pZCI6Ik5ZUG9zdCIsIm5ldHdvcmtfY29sb3IiOiIjQ0MzMzMzIn0sInNwb3RfbmFtZSI6IiIsImRvbWFpbiI6IiIsInJvbGVzX251bWJlciI6MCwidGVtcF91c2VyIjpmYWxzZSwiZXhwIjoxNzE3NDYyNTEyLCJzdWIiOiJ1X0ZFcWhMOXJPUUFpNCJ9.bJD27s1123S3CPCYGFsfSDBjC3EISpulrrTgoZoDPxo

Response headers

date: Tue, 11 Jul 2023 01:55:19 GMT
via: 1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
x-spotim-device-uuid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront
x-spotim-networkid: net_nypost
content-length: 59
x-spotim-token: 01230711rdCZLh.03758f4e1df52d46debd0283bcc3f6c2512e786d5567c3523ad99e7a851afea9
x-request-id: fd52edb1-1f8d-11ee-882c-f61662323ee3
x-guid: 2a8cfef8-0561-456f-8d69-0693d7efdda3
server: fasthttp
x-spotim-device-v2: d_JrS6QqxN612gLZe2JuEx
access-control-max-age: 86400
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
x-amz-cf-id: UD2IOPEoeOCvvXW2Eg7Pwml5FTkta6ydW9DYZaJwm7GDFnwMjl_OCg==

OPTIONS
H2 200 read
api-2-0.spot.im/v1.0.0/conversation/realtime/ Frame 0
0 70ms
70ms Preflight 18.164.96.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-2-0.spot.im/v1.0.0/conversation/realtime/read

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.96.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fasthttp /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-access-token,x-post-id,x-spot-id,x-spotim-device-uuid,x-spotim-device-v2,x-spotim-page-view-id
Access-Control-Request-Method: POST
Origin: https://nypost.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-user-token,x-spot-id,x-post-id,x-access-token,x-openweb-token,x-spotim-page-view-id, x-spotim-device-v2, x-spotim-device-uuid, x-real-user-mode,x-auth-version,x-spotim-networkid,x-openweb-module-name,x-openweb-module-version
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-origin: https://nypost.com
access-control-expose-headers: x-spotim-token, x-spotim-networkid, x-access-token, x-openweb-token, x-spotim-device-v2, x-spotim-device-uuid,x-reset-token
access-control-max-age: 86400
content-length: 0
date: Tue, 11 Jul 2023 01:55:19 GMT
server: fasthttp
strict-transport-security: max-age=31536000
via: 1.1 98bc8180e0431e8f05afc9802305f1d2.cloudfront.net (CloudFront)
x-amz-cf-id: -vYq9fNf-FTt1VQqrFqv5oDnyLvEtPmsSok4bpzgzTe7VJ4XTgGrTg==
x-amz-cf-pop: JFK50-P5
x-cache: Miss from cloudfront

POST
H2 200 auction Show response
pg-prebid-server.rubiconproject.com/openrtb2/ 379 B
513 B 358ms
134ms XHR
application/json 54.201.51.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pg-prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.201.51.145 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-201-51-145.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4f291d5ab02655d3f122b14e605121af06ec116b48bc2e34e4e49d438eac0df8

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:28 GMT
content-encoding: gzip
x-prebid: pbs-java/1.123.0
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 281
expires: 0

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 2 B
523 B 74ms
73ms XHR
text/plain 104.18.43.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.43.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:27 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 7e4d6ca2fe8d4984-MIA
content-length: 2
expires: 0

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
520 B 677ms
677ms XHR
application/json 104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=214312
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e010ad3758ffe8f3b9e2096c56b4dcfdeb8139c8895d40aff752c9300e1f4a5d

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:28 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nx%2BlYjQ2rwx6EPnDJcpLXy%2B%2FOHu8LeCkdQ3Wbmi%2FZJ0NE35Py7%2FAXdL0ptrfc7dWNXtP0cdhcf7YKGKIsUikIBMAVgiroeZf6BPD2SUPfoAR9TOMoJYELVWKdnZtfbEoLCx3%2Fmmp"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7e4d6ca30d992251-MIA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H/1.1 200
OK nypost Show response
direct.adsrvr.org/bid/bidder/ 0
394 B 234ms
110ms XHR
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Show headers Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/nypost
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:28 GMT
x-openrtb-version: 2.3
server: Kestrel
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
975 B 189ms
188ms XHR
application/json 68.67.160.117
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:27 GMT
AN-X-Request-Uuid: e2cc4a85-4902-4c47-adf9-29d138bde78b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://nypost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 38.132.118.74; 38.132.118.74; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 731 B
936 B 255ms
67ms XHR
application/json 2602:803:c002:200::113
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11076&site_id=26782&zone_id=199490&size_id=57&p_pos=atf&us_privacy=1---&eid_pubcid.org=a878d8e0-8a80-4366-920e-95a5dee32438%5E1&tpid_tdid=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&eid_adserver.org=c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6&rf=about%3Ablank&kw=Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%2C&tg_v.permutive=74597&tg_i.page=https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F&tg_i.name=nypost.com&tg_i.domain=nypost.com&tg_i.cat=IAB1%2CIAB12%2CIAB17&tg_i.page_type=article&tg_i.testgroup=76&tg_i.pagesection=business&tg_i.pagetype=article&tg_i.psg=300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2&tg_i.pbadslot=%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories&tg_i.mnrf=1&tg_i.mnrfc=1&tg_i.src=mnrtd&tk_flint=pbjs_lite_v7.39.0&x_source.tid=43a3236d-ba5a-4c04-830a-36f4c7c56ef8&l_pb_bid_id=10447e585126a3d9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories&slots=1&rand=0.4944371140720436
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::113 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: afe2eb4b2a14c9d9f7210bc95becc379128abc91a93c03f2436f3605d6e91606

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:28 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 731
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 1 KB
818 B 93ms
92ms XHR
application/json 18.190.112.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=10414
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.112.82 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-112-82.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: be7f9cb1200daa6a07315a8aaa7cf5f34168fd67c5367b21c4447c9d8f558f2a

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:27 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 32 B
395 B 138ms
58ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU3I8M1G
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: dbe5b7ecbb1e59ac15de1b1ea340c9540f8d1cf1764c667aeca64a1fdd3b639c

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 11 Jul 2023 01:55:27 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://nypost.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Tue, 11 Jul 2023 01:55:27 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
655 B 182ms
66ms XHR
application/json 34.231.135.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%2244ab73ef-e1ea-4fb0-9297-5a6fdddbdbac%22%2C%22requestCount%22%3A0%2C%22timeout%22%3A2000%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1689040527836%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%221101444d0a520db4%22%3A%22_fomZp7UJsG%22%7D%2C%22bidSizes%22%3A%7B%221101444d0a520db4%22%3A%5B%5B970%2C250%5D%5D%7D%2C%22device%22%3A%7B%22width%22%3A1600%2C%22height%22%3A1200%2C%22sua%22%3A%7B%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%7D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_fomZp7UJsG%22%7D%2C%22userId%22%3A%7B%22pubcid%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%2C%22tdid%22%3A%22c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6%22%7D%2C%22userIdAsEids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22a878d8e0-8a80-4366-920e-95a5dee32438%22%2C%22atype%22%3A1%7D%5D%7D%2C%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%5D%7D%5D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22tid%22%3A%2243a3236d-ba5a-4c04-830a-36f4c7c56ef8%22%2C%22data%22%3A%7B%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories%22%7D%2C%22pbadslot%22%3A%22%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories%22%2C%22mnrf%22%3A1%2C%22mnrfc%22%3A1%2C%22src%22%3A%22mnrtd%22%7D%2C%22gpid%22%3A%22%2F5850%2Fpost.desktop%2Fbillb_atf%2Fbusiness%2Fstories%22%2C%22refresh%22%3A%7B%22mnrf%22%3A%221%22%2C%22mnrfc%22%3A1%7D%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22pos%22%3A1%2C%22sizes%22%3A%5B%5B970%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22div-gpt-ad-billb_atf%22%2C%22transactionId%22%3A%2243a3236d-ba5a-4c04-830a-36f4c7c56ef8%22%2C%22sizes%22%3A%5B%5B970%2C250%5D%5D%2C%22bidId%22%3A%221101444d0a520db4%22%2C%22bidderRequestId%22%3A%22109014e508fdaaac%22%2C%22auctionId%22%3A%2279e4d02d-787a-4f9a-8acd-985924a0b6d5%22%2C%22src%22%3A%22client%22%2C%22metrics%22%3A%7B%22userId.init.gdpr%22%3A%5B0%5D%2C%22userId.mod.init%22%3A%5B13.700000762939453%2C0.5999984741210938%5D%2C%22userId.mods.sharedId.init%22%3A%5B13.700000762939453%5D%2C%22userId.mods.unifiedId.init%22%3A%5B0.5999984741210938%5D%2C%22userId.init.modules%22%3A%5B17%5D%2C%22userId.callbacks.pending%22%3A%5B6318%5D%2C%22userId.mod.callback%22%3A%5B1.9000015258789062%2C1519.400001525879%5D%2C%22userId.mods.sharedId.callback%22%3A%5B1.9000015258789062%5D%2C%22userId.mods.unifiedId.callback%22%3A%5B1519.400001525879%5D%2C%22userId.callbacks.total%22%3A%5B1521.5%5D%2C%22userId.total%22%3A%5B7873.100002288818%5D%2C%22requestBids.usp%22%3A0.7000007629394531%2C%22requestBids.userId%22%3A0.2999992370605469%2C%22requestBids.rtd%22%3A1.9000015258789062%2C%22requestBids.validate%22%3A0.20000076293945312%2C%22requestBids.makeRequests%22%3A3.700000762939453%2C%22adapter.client.validate%22%3A0%2C%22adapters.client.kargo.validate%22%3A0%7D%2C%22bidRequestsCount%22%3A2%2C%22bidderRequestsCount%22%3A2%2C%22bidderWinsCount%22%3A0%2C%22ortb2%22%3A%7B%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fnypost.com%2F2023%2F05%2F10%2Fwells-fargo-vp-invited-subordinate-to-exercise-and-shower-with-him%2F%22%2C%22publisher%22%3A%7B%22domain%22%3A%22%22%7D%2C%22name%22%3A%22nypost.com%22%2C%22domain%22%3A%22nypost.com%22%2C%22keywords%22%3A%22Business%2Clawsuit%2Clawsuits%2Csexual%20harassment%2Cwells%20fargo%22%2C%22cat%22%3A%5B%22IAB1%22%2C%22IAB12%22%2C%22IAB17%22%5D%2C%22page_type%22%3A%22article%22%2C%22testgroup%22%3A%2276%22%2C%22ext%22%3A%7B%22data%22%3A%7B%22pagesection%22%3A%22business%22%2C%22pagetype%22%3A%22article%22%7D%7D%2C%22psg%22%3A%22300003%2C210002%2C230002%2C230004%2C112200%2C121100%2Cfrejb4%2C469txr%2C8byqwu%2C77i9s2%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22device%22%3A%7B%22w%22%3A1600%2C%22h%22%3A1200%2C%22dnt%22%3A0%2C%22ua%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36%22%2C%22language%22%3A%22en%22%2C%22sua%22%3A%7B%22source%22%3A2%2C%22browsers%22%3A%5B%5D%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22architecture%22%3A%22%22%7D%7D%7D%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%2C%22usp%22%3A%221---%22%2C%22tdID%22%3A%22c0ec1b81-0f99-4d50-8ab1-1b54e2c120d6%22%7D%2C%22pageURL%22%3A%22about%3Ablank%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.231.135.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-135-187.compute-1.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 11 Jul 2023 01:55:27 GMT
Content-Encoding: gzip
X-Accel-Expires: 0
Nbr: 505
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://nypost.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 26
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 200 cdb Show response
bidder.criteo.com/ 2 KB
2 KB 186ms
74ms XHR
application/json 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=135&profileId=185&av=35&wv=7.39.0&bundle=mFo6nF9vWFhVR2w2dmdjRFRDM0tqb29WUW5MSlZIM09VeHExTTZVMlpzMTdvb2YlMkJ0bHRKZFBIMXVaNllFWDFuSnJQcjB2QjVuJTJGd015JTJCdDYlMkZLYkprQXlGSjVpNkl3ZkhFazJVYkslMkJDZlBtZzVsbVk0UVNJYVAwT2ptRmxBbHJnNU9RNkY4STRMOGdPS3M1RUs2MFpEejRWNGVBJTNEJTNE&cb=44700185050

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e86337987ce4d92103ae10721ffe1e98dda00862b080311bc1dbb95f189d9b26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 11 Jul 2023 01:55:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://nypost.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
754 B 192ms
79ms XHR
application/json 34.232.232.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.39.0&referrer=about%3Ablank&tmax=2000&us_privacy=1---

Requested by

Host: us.tags.newscgp.com
URL: https://us.tags.newscgp.com/prod/prebid/nyp/pb.js?ver=1.0.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.232.232.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS