safehaven.com Open in urlscan Pro
54.201.238.66 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://safehaven.com.eu2.cas.ms/
Effective URL:
https://safehaven.com/
Submission: On May 08 via automatic, source certstream-suspicious (May 8th 2020, 11:54:53 am UTC)

Summary HTTP 262 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 51 IPs in 8 countries across 41 domains to perform 262 HTTP transactions. The main IP is 54.201.238.66, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is safehaven.com.
TLS certificate: Issued by Amazon on December 3rd 2019. Valid for: a year.

This is the only time safehaven.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.155.181.183 52.155.181.183	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	54.201.238.66 54.201.238.66	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE)
13	52.222.182.108 52.222.182.108	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700:303... 2606:4700:3035::6812:2130	13335 (CLOUDFLAR...) (CLOUDFLARENET)
36	2a00:1450:400... 2a00:1450:4001:81b::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:633c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2600:9000:209... 2600:9000:2093:8800:c:5250:79c0:21	16509 (AMAZON-02) (AMAZON-02)
5	2606:4700::68... 2606:4700::6810:85e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:209... 2600:9000:2093:3400:10:4f52:7800:21	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21f... 2600:9000:21f3:d600:17:eca0:da80:21	16509 (AMAZON-02) (AMAZON-02)
17	2600:9000:21f... 2600:9000:21f3:b000:3:442:6dc0:21	16509 (AMAZON-02) (AMAZON-02)
20	63.250.56.23 63.250.56.23	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
1 2	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1	172.217.18.162 172.217.18.162	15169 (GOOGLE) (GOOGLE)
7	216.58.210.2 216.58.210.2	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
6	104.16.68.69 104.16.68.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	52.222.191.80 52.222.191.80	16509 (AMAZON-02) (AMAZON-02)
1	134.209.131.220 134.209.131.220	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
9 14	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
1 3	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
5	69.173.144.141 69.173.144.141	26667 (RUBICONPR...) (RUBICONPROJECT)
1	72.251.249.14 72.251.249.14	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
2	185.33.221.13 185.33.221.13	29990 (ASN-APPNEX) (ASN-APPNEX)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:10:... 2606:4700:10::6814:3677	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	37.252.173.22 37.252.173.22	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a00:1450:400... 2a00:1450:400c:c08::9b	15169 (GOOGLE) (GOOGLE)
1	23.111.11.100 23.111.11.100	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
3	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	13.225.87.9 13.225.87.9	16509 (AMAZON-02) (AMAZON-02)
2	72.247.225.32 72.247.225.32	16625 (AKAMAI-AS) (AKAMAI-AS)
21	45.83.41.102 45.83.41.102	204548 (CLOUDWEBM...) (CLOUDWEBMANAGE-IL-FR)
1 2	18.195.193.185 18.195.193.185	16509 (AMAZON-02) (AMAZON-02)
1 1	138.201.34.178 138.201.34.178	24940 (HETZNER-AS) (HETZNER-AS)
1	18.194.51.59 18.194.51.59	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:824::200a	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:81f::2003	15169 (GOOGLE) (GOOGLE)
2 3	52.49.118.177 52.49.118.177	16509 (AMAZON-02) (AMAZON-02)
6 6	35.157.249.39 35.157.249.39	16509 (AMAZON-02) (AMAZON-02)
1 5	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
1 1	172.217.22.98 172.217.22.98	15169 (GOOGLE) (GOOGLE)
1	72.247.225.17 72.247.225.17	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.109.78.125 104.109.78.125	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	206.189.254.17 206.189.254.17	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1400	41041 (VCLK-EU-) (VCLK-EU-)
1 1	91.228.74.149 91.228.74.149	27281 (QUANTCAST) (QUANTCAST)
262	51

1 52.155.181.183 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

safehaven.com.eu2.cas.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.201.238.66 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-201-238-66.us-west-2.compute.amazonaws.com

safehaven.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 52.222.182.108 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-182-108.ham50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3035::6812:2130 (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

36 2a00:1450:4001:81b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:633c (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.districtm.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:2093:8800:c:5250:79c0:21 (United States)

ASN16509 (AMAZON-02, US)

d2p6ty67371ecn.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:85e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2093:3400:10:4f52:7800:21 (United States)

ASN16509 (AMAZON-02, US)

d1o9e4un86hhpc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:d600:17:eca0:da80:21 (United States)

ASN16509 (AMAZON-02, US)

d32r1sh890xpii.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2600:9000:21f3:b000:3:442:6dc0:21 (United States)

ASN16509 (AMAZON-02, US)

d2t794khe5w43b.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 63.250.56.23 (United States)

ASN41436 (CLOUDWEBMANAGE-EU, GB)

live.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s29-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 216.58.210.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.68.69 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.222.191.80 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-191-80.ham50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.209.131.220 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 9 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 147.120.95.34.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.141 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.251.249.14 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.13 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:3677 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.pushcrew.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 37.252.173.22 (Ascension Island)

ASN29990 (ASN-APPNEX, US)
PTR: 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.100 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.optmstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.87.9 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-9.fra2.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.247.225.32 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-32.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 45.83.41.102 (Frankfurt am Main, Germany)

ASN204548 (CLOUDWEBMANAGE-IL-FR, GB)

video.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.193.185 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-193-185.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 138.201.34.178 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.178.34.201.138.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.194.51.59 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-51-59.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.49.118.177 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-118-177.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.157.249.39 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-249-39.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:110:c305::8000 (United Kingdom) 1 redirects

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s18-in-f98.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.247.225.17 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-17.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.78.125 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.189.254.17 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1400 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.149 (United Kingdom) 1 redirects

ASN27281 (QUANTCAST, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	sekindo.com live.sekindo.com video.sekindo.com	3 MB
37	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	669 KB
32	cloudfront.net d2p6ty67371ecn.cloudfront.net d1o9e4un86hhpc.cloudfront.net d32r1sh890xpii.cloudfront.net d2t794khe5w43b.cloudfront.net	2 MB
21	advertising.com 15 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	10 KB
18	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	97 KB
13	adlightning.com tagan.adlightning.com	330 KB
12	googletagservices.com www.googletagservices.com	318 KB
10	googletagmanager.com www.googletagmanager.com	209 KB
9	google.de adservice.google.de www.google.de	2 KB
8	google.com www.google.com adservice.google.com	2 KB
8	adnxs.com ib.adnxs.com secure.adnxs.com acdn.adnxs.com	5 KB
7	yahoo.com 2 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	7 KB
6	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	9 KB
6	districtm.io cdn.districtm.io dmx.districtm.io	326 B
5	amazon-adsystem.com c.amazon-adsystem.com	59 KB
5	cloudflare.com cdnjs.cloudflare.com	106 KB
5	googleapis.com fonts.googleapis.com ajax.googleapis.com	10 KB
4	facebook.com www.facebook.com	534 B
4	admetricspro.com qd.admetricspro.com	162 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	gstatic.com fonts.gstatic.com	29 KB
3	facebook.net connect.facebook.net	272 KB
3	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	114 B
3	openx.net 1 redirects teachingaids-d.openx.net eu-u.openx.net	823 B
2	bidswitch.net 1 redirects x.bidswitch.net	921 B
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	83 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	266 B
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
1	quantserve.com 1 redirects pixel.quantserve.com	843 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	loopme.me 1 redirects csync.loopme.me	225 B
1	omappapi.com api.omappapi.com	10 KB
1	optmstr.com a.optmstr.com	60 KB
1	pushcrew.com cdn.pushcrew.com	68 KB
1	lijit.com ap.lijit.com	701 B
1	dotomi.com web.hb.ad.cpe.dotomi.com Failed aol-match.dotomi.com	104 B
1	googleadservices.com www.googleadservices.com	11 KB
1	districtm.ca cdn.districtm.ca	23 KB
1	safehaven.com safehaven.com	13 KB
1	cas.ms 1 redirects safehaven.com.eu2.cas.ms	253 B
0	adap.tv Failed sync.adap.tv Failed
262	41

	Domain	Requested by
24	pagead2.googlesyndication.com	tagan.adlightning.com pagead2.googlesyndication.com safehaven.com securepubads.g.doubleclick.net
21	video.sekindo.com	safehaven.com live.sekindo.com
20	live.sekindo.com	safehaven.com live.sekindo.com
17	d2t794khe5w43b.cloudfront.net	safehaven.com
14	adserver-us.adtech.advertising.com	9 redirects safehaven.com
13	tpc.googlesyndication.com	tagan.adlightning.com
13	tagan.adlightning.com	safehaven.com tagan.adlightning.com
12	www.googletagservices.com	safehaven.com tagan.adlightning.com securepubads.g.doubleclick.net
11	d2p6ty67371ecn.cloudfront.net	safehaven.com
10	www.googletagmanager.com	safehaven.com www.googletagmanager.com
9	googleads.g.doubleclick.net	tagan.adlightning.com
7	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net safehaven.com
6	pixel.advertising.com	6 redirects
6	adservice.google.de	tagan.adlightning.com
5	ups.analytics.yahoo.com	1 redirects safehaven.com
5	adservice.google.com	tagan.adlightning.com
5	secure.adnxs.com	cdn.districtm.ca
5	dmx.districtm.io	cdn.districtm.ca
5	fastlane.rubiconproject.com	qd.admetricspro.com
5	c.amazon-adsystem.com	safehaven.com c.amazon-adsystem.com live.sekindo.com
5	cdnjs.cloudflare.com	safehaven.com tagan.adlightning.com ajax.googleapis.com
4	www.facebook.com	safehaven.com connect.facebook.net
4	qd.admetricspro.com	safehaven.com
4	fonts.googleapis.com	safehaven.com live.sekindo.com ajax.googleapis.com
3	match.adsrvr.org	2 redirects
3	fonts.gstatic.com	safehaven.com ajax.googleapis.com
3	www.google.de	safehaven.com
3	www.google.com	safehaven.com
3	connect.facebook.net	safehaven.com connect.facebook.net
3	d1o9e4un86hhpc.cloudfront.net	safehaven.com
2	eu-u.openx.net	1 redirects qd.admetricspro.com
2	pr-bh.ybp.yahoo.com	1 redirects safehaven.com
2	x.bidswitch.net	1 redirects safehaven.com
2	ads.pubmatic.com	live.sekindo.com qd.admetricspro.com
2	maxcdn.bootstrapcdn.com	safehaven.com
2	ib.adnxs.com	qd.admetricspro.com
2	www.google-analytics.com	1 redirects www.googletagmanager.com
1	pixel.quantserve.com	1 redirects
1	aol-match.dotomi.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	eus.rubiconproject.com	qd.admetricspro.com
1	acdn.adnxs.com	qd.admetricspro.com
1	cm.g.doubleclick.net	1 redirects
1	ajax.googleapis.com	tagan.adlightning.com
1	ads.adaptv.advertising.com	live.sekindo.com
1	csync.loopme.me	1 redirects
1	api.omappapi.com	a.optmstr.com
1	a.optmstr.com	tagan.adlightning.com
1	stats.g.doubleclick.net	safehaven.com
1	cdn.pushcrew.com	safehaven.com
1	ap.lijit.com	qd.admetricspro.com
1	hbopenbid.pubmatic.com	qd.admetricspro.com
1	teachingaids-d.openx.net	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	cdn.districtm.io	tagan.adlightning.com
1	www.googleadservices.com	www.googletagmanager.com
1	d32r1sh890xpii.cloudfront.net	safehaven.com
1	cdn.districtm.ca	safehaven.com
1	safehaven.com
1	safehaven.com.eu2.cas.ms	1 redirects
0	sync.adap.tv Failed	safehaven.com
0	web.hb.ad.cpe.dotomi.com Failed	qd.admetricspro.com
262	63

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
plus.google.com

Subject Issuer	Validity	Valid
safehaven.com Amazon	`2019-12-03` - `2021-01-03`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.adlightning.com Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
www.sekindo.com Go Daddy Secure Certificate Authority - G2	`2019-05-23` - `2020-06-18`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
districtm.io CloudFlare Inc ECC CA-2	`2020-02-25` - `2020-10-09`	7 months	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-03-24` - `2020-06-22`	3 months	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-04-15` - `2020-07-14`	3 months	crt.sh
*.pushcrew.com Go Daddy Secure Certificate Authority - G2	`2019-07-23` - `2021-07-31`	2 years	crt.sh
*.optmstr.com Go Daddy Secure Certificate Authority - G2	`2020-01-10` - `2022-01-24`	2 years	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-08-28`	6 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-04-15` - `2020-07-08`	3 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-02-13` - `2020-08-11`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-01-04` - `2020-07-02`	6 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh

This page contains 28 frames:

Primary Page: https://safehaven.com/
Frame ID: E3CEBB55758516F27086A15BFA71FC66
Requests: 130 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 5F219DA51AF693A64D125DA79409BE67
Requests: 1 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Frame ID: 2163127530157E02344B6B3DBBD3F682
Requests: 30 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 57FBDD4020F9AD73EF81C3C1A06065A4
Requests: 6 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: AA419ED2CE3A6D038EBF817636060628
Requests: 17 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Frame ID: 85653ECEA55E06E6780D0B1633DF0C70
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Frame ID: FED6F79F7F039F9857A873C9D23FB8C5
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Frame ID: A5AE58421DDA186D182D788756604ED9
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Frame ID: BF1761D8F4FFC6ECFC853ED603F94FB3
Requests: 13 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Frame ID: A07887D952648E31A38137BC8B6D2BA2
Requests: 13 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Frame ID: 55ADD2556E3739B8E0E5A23F3306164F
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200506/r20190131/zrt_lookup.html
Frame ID: E7A9A4078B1A3030D14B10344EB8590E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=9357229395&adk=309087674&adf=3173046727&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870705&bpp=19&bdt=355&idt=221&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=2&ga_vid=195935410.1588938871&ga_sid=1588938871&ga_hid=1998556362&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1068&ady=661&biw=1585&bih=1200&isw=300&ish=250&ifk=751659263&scr_x=0&scr_y=0&eid=21066085%2C618018086&oid=3&pvsid=2204820173202879&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&osd=1024&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.tp6s797vo89z&fsb=1&dtd=237
Frame ID: 34CB9302680D160C12258A34E3D70D03
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=1547377351&adk=1247324859&adf=3173046725&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870735&bpp=2&bdt=367&idt=230&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=488931700.1588938871&ga_sid=1588938871&ga_hid=106280977&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2295&biw=1585&bih=1200&isw=300&ish=250&ifk=364837978&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=1257253655219770&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.8yw6bvfha8my&btvi=1&fsb=1&dtd=234
Frame ID: 15DA68120A95BC231453AC5A2E9565FD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=8782514321&adk=1231975816&adf=3173046726&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870763&bpp=2&bdt=402&idt=215&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=1714019922.1588938871&ga_sid=1588938871&ga_hid=897519680&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1068&ady=943&biw=1585&bih=1200&isw=300&ish=250&ifk=750481399&scr_x=0&scr_y=0&eid=21066085%2C410075106%2C423550200&oid=3&pvsid=3427640782275365&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.mlpykdsfzij&fsb=1&dtd=220
Frame ID: 2683C23641F179A71A83A2F7FD6A8A1C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=1978622193&adk=2047003747&adf=3173046724&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870884&bpp=3&bdt=509&idt=175&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=1662889790.1588938871&ga_sid=1588938871&ga_hid=1474869969&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=241&ady=1206&biw=1585&bih=1200&isw=728&ish=90&ifk=1506950742&scr_x=0&scr_y=0&eid=21065724%2C21066085%2C26835106&oid=3&pvsid=1067164234270628&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.slarmlt0txp0&btvi=1&fsb=1&dtd=180
Frame ID: 99FB9E10A8BCBF77460FFAF6CDC7AFA2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=7090869147&adk=109494614&adf=3173046723&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870896&bpp=3&bdt=515&idt=184&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=869663279.1588938871&ga_sid=1588938871&ga_hid=900229472&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3125&biw=1585&bih=1200&isw=728&ish=90&ifk=4249146180&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=3931375124158074&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.idmbzktvfia1&btvi=1&fsb=1&dtd=188
Frame ID: A12943F6489EBD9F3A4739B11A3506E3
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 13275BB3139004DA95952BEB451D70A4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 7625D2889F58374A528E6214429C8FAE
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: B1EFFB6B698765016C191DC2474D8BA0
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 36DB3B2E7D1E20C22B3AC8A13C483DB9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: B71DF504D464E1FDA562C2E169AC7996
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 23F83B70B638FEF5F38C36B49F06527D
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 57A44639163FBAD064FADAC61B82E66D
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: B4069752C98C702A9485C0E53053F2FD
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Frame ID: 68AB943A08FD7FB12B151C2B3EE960AF
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 1229949E69AC83E053B40974D50A59A3
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 59DEE0527FBF0F0C4D2C098E529AC4A8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://safehaven.com.eu2.cas.ms/ HTTP 307
https://safehaven.com/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Amazon EC2 (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /$Amazon$/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers server /$Amazon$/i

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /adnxs\.(?:net|com)/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Page Statistics

262
Requests

99 %
HTTPS

45 %
IPv6

41
Domains

63
Subdomains

51
IPs

8
Countries

7991 kB
Transfer

13549 kB
Size

7
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/Safehaven_News?lang=en

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SafehavenNews/?notif_id=1519322109290495&notif_t=page_user_activity&ref=notif

Search URL Search Domain Scan URL

URL: https://plus.google.com/106909181079166580357

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://safehaven.com.eu2.cas.ms/ HTTP 307
https://safehaven.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 56

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;cfp=1;rndc=1588938867;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1Aabfec130-9122-11ea-ac54-12794b40da64;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559

Request Chain 57

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1Aabfeb898-9122-11ea-a6eb-121ea8d7377c;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559

Request Chain 58

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1Aac2ffcbe-9122-11ea-9142-12e650fea264;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559

Request Chain 59

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1Aac2d6d28-9122-11ea-a082-127f7115e3c4;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559

Request Chain 60

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=598fbd85d25f77c;misc=1588938868559; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=598fbd85d25f77c;misc=1588938868559

Request Chain 90

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=915566857&t=pageview&_s=1&dl=https%3A%2F%2Fsafehaven.com%2F&ul=en-us&de=UTF-8&dt=Safehaven.com%20%7C%20Preservation%20of%20Capital&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=949631334&gjid=594497371&cid=256372478.1588938869&tid=UA-2249023-27&_gid=1023495450.1588938869&_r=1&gtm=2ou4t0&z=62485155 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=256372478.1588938869&jid=949631334&_gid=1023495450.1588938869&gjid=594497371&_v=j82&z=62485155

Request Chain 133

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5eb54874de677&custom_data=5eb54874de677&gdpr=1&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54874de677&custom_data=5eb54874de677&gdpr=1&gdpr_consent=

Request Chain 134

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D HTTP 307
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=0e9072a4-0be4-4bf7-99b4-df71f6eba562

Request Chain 203

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=346013c6-918e-4265-9b47-01bfd4fdeeca&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=346013c6-918e-4265-9b47-01bfd4fdeeca HTTP 302
https://ups.analytics.yahoo.com/ups/55953/sync?uid=346013c6-918e-4265-9b47-01bfd4fdeeca&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=346013c6-918e-4265-9b47-01bfd4fdeeca&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

Request Chain 205

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1 HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

Request Chain 206

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XrVIdwAAAK3FCSTo HTTP 302
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XrVIdwAAAK3FCSTo&_test=XrVIdwAAAK3FCSTo

Request Chain 248

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1 HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1

Request Chain 250

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 251

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/adtech/UPad4de458-9122-11ea-b7d8-02b9a5a38c20?gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/56465/sync?uid=y-BUf4Al11lxnhdY.GXj4zZ2nKZ4neoCAfvmtr&_origin=0&nsync=0 HTTP 302
https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-BUf4Al11lxnhdY.GXj4zZ2nKZ4neoCAfvmtr&_origin=0&nsync=0&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

Request Chain 254

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=k-hokpK1PZ-L6G7FlOsnxJK_a5KL6G-Wnu7wMtll HTTP 302
https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=k-hokpK1PZ-L6G7FlOsnxJK_a5KL6G-Wnu7wMtll&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

262 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
safehaven.com/
Redirect Chain

https://safehaven.com.eu2.cas.ms/
https://safehaven.com/

92 KB
13 KB

697ms
331ms

Document
text/html

54.201.238.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.201.238.66 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-201-238-66.us-west-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash: d862cadadddc152101f2e1af6231c6372567e7ea1937d6dc53e15cf51809f851

Request headers

:method: GET
:authority: safehaven.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 08 May 2020 11:54:27 GMT
content-type: text/html; charset=UTF-8
content-length: 12998
set-cookie: AWSALB=LeP89AppCmcD8viQ1vG5E/78hfCH66o9JESPmIuMsmqCLD7jjk/y1DNIsuk0bER/freAEeSTqNrcSD/fxcK4AfSCMPZu/H1knBn0NNsuwaQCm/7QCLJg5vfJSlon; Expires=Fri, 15 May 2020 11:54:27 GMT; Path=/ AWSALBCORS=LeP89AppCmcD8viQ1vG5E/78hfCH66o9JESPmIuMsmqCLD7jjk/y1DNIsuk0bER/freAEeSTqNrcSD/fxcK4AfSCMPZu/H1knBn0NNsuwaQCm/7QCLJg5vfJSlon; Expires=Fri, 15 May 2020 11:54:27 GMT; Path=/; SameSite=None; Secure csrf_safehaven_cookie=86a7e968985697895e0e9b0623f07633; expires=Fri, 08-May-2020 13:54:27 GMT; Max-Age=7200; path=/ safehaven_ci=55214ffaa63994bdce8b8ecb5d51a17d403c72c6; path=/; HttpOnly
server: Apache/2.4.41 (Amazon) PHP/5.6.40
x-powered-by: PHP/5.6.40
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
vary: Accept-Encoding,User-Agent
content-encoding: gzip

Redirect headers

Date: Fri, 08 May 2020 11:54:26 GMT
Connection: keep-alive
Location: https://safehaven.com/
Strict-Transport-Security: max-age=31536000
Content-Length: 136
X-MCAS-Request-Id: 5f1142cc-76d0-4717-86e0-a5f0702627b5

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 81 KB
30 KB 77ms
21ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2249023-27

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ddf9604b128e46ababf4e91b95c2689540832c6b24bdfedd8220703d20861273

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30417
x-xss-protection: 0
last-modified: Fri, 08 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 May 2020 11:54:27 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 82ms
27ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-814550776

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c8b44595b56b3899377b8e6d50e2f5f314055225a82c5474dd12bae8a2911ebd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30412
x-xss-protection: 0
last-modified: Fri, 08 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 May 2020 11:54:27 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 64ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:500&display=swap

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a837fab08c038562b05eb2eb81c1c340c8cd2762d2c43d5e3bb26c2980fc9bfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 11:54:27 GMT
server: ESF
date: Fri, 08 May 2020 11:54:27 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 11:54:27 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids/ 33 KB
12 KB 137ms
39ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/op.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 42b3fc91a1ad52d699828c32fab5b6c562dd9b6e7f287bd300b589a9f010a60a

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: vvF6bEuHBPTp.JE4kH7JRYXw5MKJYiVY
content-encoding: gzip
etag: "c9355861af30ba2acaee28d29cbfb015"
age: 427
x-cache: Hit from cloudfront
status: 200
content-length: 12063
x-amz-meta-git_commit: 0d4dfcb
last-modified: Thu, 07 May 2020 23:03:16 GMT
server: AmazonS3
date: Fri, 08 May 2020 11:47:21 GMT
content-type: application/javascript
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: 07EYfUgoJ0uyQzqA6vHUm4Z3HLO0SoGqKJLqh6OWBpJ8yc2A-U82Sw==

GET
H2 200 layout.js Show response
qd.admetricspro.com/js/safehaven/ 14 KB
2 KB 583ms
530ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/layout.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 267de44d3e0da48ea910544cc6ae698dc28c977de6cb7baf62a4913765f49a2b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 03 Apr 2020 17:20:45 GMT
server: cloudflare
status: 200
etag: W/"3905-5a266233b698f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5902fc73aa9e18e5-FRA
cf-request-id: 0295bc1c46000018e58025f200000001
expires: Fri, 08 May 2020 12:00:26 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 46 KB
16 KB 79ms
24ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

203c53e92c4994351bfcb37003059ba3a9bd041580a8271e7881f03bbc061fcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "509 / 816 of 1000 / last-modified: 1588867830"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 15392
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:27 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/safehaven/ 218 KB
61 KB 204ms
151ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/cmp.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 27 Sep 2019 21:07:46 GMT
server: cloudflare
status: 200
etag: W/"367ba-5938f47194c80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5902fc73aaa018e5-FRA
cf-request-id: 0295bc1c46000018e580260200000001
expires: Fri, 08 May 2020 12:00:26 GMT

GET
H2 200 merge.142016.js Show response
cdn.districtm.ca/merge/ 96 KB
23 KB 70ms
20ms Script
application/x-javascript 2606:4700::6812:633c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.ca/merge/merge.142016.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:633c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d847475ca969f76b8f8421c4150f23fbe5bef200839b80481b845a6ccdd6e86f

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 151200
cf-polished: origSize=98705
status: 200
last-modified: Mon, 09 Sep 2019 19:18:19 GMT
x-amz-request-id: 9445A9EB2D8C95D0
x-amz-id-2: qd4YUTJ7ej/awokk1hdGiEuKwY43QuD55Jy+MEAYZiJPsVg16PAZcyXugM9DGW0KcY/AgIlzRao=
cf-bgj: minify
server: cloudflare
etag: W/"af89e858721db33fe8776b832f2f75a9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
x-amz-version-id: W3M7ZtQBM6rvV9.80JF8eLB1ASMBDZAU
cf-request-id: 0295bc1c43000005dcceadc200000001
cf-ray: 5902fc739e6305dc-FRA
expires: Fri, 08 May 2020 15:54:27 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/safehaven/ 294 KB
86 KB 213ms
160ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 26 Feb 2020 03:30:32 GMT
server: cloudflare
status: 200
etag: W/"49929-59f723a0fd39e-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5902fc73aaa318e5-FRA
cf-request-id: 0295bc1c46000018e580261200000001
expires: Fri, 08 May 2020 11:57:20 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/safehaven/ 16 KB
12 KB 201ms
149ms Script
application/javascript 2606:4700:3035::6812:2130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/safehaven/engine.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 24 Nov 2019 00:06:08 GMT
server: cloudflare
status: 200
etag: W/"41f6-5980c69fe949d-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5902fc73aaa518e5-FRA
cf-request-id: 0295bc1c46000018e580262200000001
expires: Fri, 08 May 2020 11:57:21 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-820290545

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

76e31e4a531b1b8d35570016e89fa8fdbf86f1ad8b47b5d487cd3b7528801b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30410
x-xss-protection: 0
last-modified: Fri, 08 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 May 2020 11:54:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-802310072

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d51666e314361b7739359e6e1a39bd50ef39c0fdc710171f3383df569fdc6dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30411
x-xss-protection: 0
last-modified: Fri, 08 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 May 2020 11:54:28 GMT

GET
H2 200 style.css
d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/ 72 KB
11 KB 117ms
52ms Stylesheet
text/css 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/style.css?v=27
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash: 0fac0bb93602e6f7d448fab3c2e880bf4fd57a7774dd930c4e58865beca4598b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:59:06 GMT
content-encoding: gzip
age: 600921
x-powered-by: PHP/5.6.40
x-cache: Hit from cloudfront
status: 200
content-length: 10330
last-modified: Fri, 01 May 2020 12:38:59 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
etag: "pub1588336739;gz"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
x-amz-cf-id: 6elKRcrSmWBlNzxeZ8liIh1H_9lEWYUd9Xp7VsoUi7bQMH_SlKcN8A==
expires: Sat, 01 May 2021 12:59:06 GMT

GET
H2 200 jquery-1.12.3.min.js Show response
d2p6ty67371ecn.cloudfront.net/a/js/third_party/ 95 KB
33 KB 83ms
17ms Script
text/javascript 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/js/third_party/jquery-1.12.3.min.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 69a3831c082fc105b56c53865cc797fa90b83d920fb2f9f6875b00ad83a18174

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 13:07:55 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 15:47:55 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 81992
etag: "17b9c-5a4981ad75a46-gzip"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 33794
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
x-amz-cf-id: HTpdTJX9pOm26y4NQ35iST2-Dy_vQwbd91l1Ztr75AdyMhfpCtWKrA==

GET
H2 200 cookieconsent.min.css
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 4 KB
1 KB 67ms
23ms Stylesheet
text/css 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 16433094
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295bc1c410000c2c2f3b25200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:18:36 GMT
server: cloudflare
etag: W/"5afd48ec-f62"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5902fc739e90c2c2-FRA
expires: Wed, 28 Apr 2021 11:54:27 GMT

GET
H2 200 cookieconsent.min.js Show response
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 19 KB
7 KB 66ms
22ms Script
application/javascript 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:27 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 24898003
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295bc1c410000c2c2f3b26200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:18:32 GMT
server: cloudflare
etag: W/"5afd48e8-4d5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5902fc739e91c2c2-FRA
expires: Wed, 28 Apr 2021 11:54:27 GMT

GET
H2 200 logo-no-light.png
d2p6ty67371ecn.cloudfront.net/a/img/ 18 KB
18 KB 17ms
16ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/logo-no-light.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:39:02 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600931
etag: "470b-5a495775215b8"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 18187
x-amz-cf-id: DFFrPGnLROwjcEzQIHgt1KmXP0dxRawim6bUX53y6u52EDrPd1lgRw==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 logo-light.png
d2p6ty67371ecn.cloudfront.net/a/img/ 15 KB
16 KB 16ms
16ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/logo-light.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: f005062f62e55ca808ee1eaf4920372d1173dfa35b1c52a64ee22de27cd8a458

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:57 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:07 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600931
etag: "3d01-5a49574111890"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 15617
x-amz-cf-id: -Fd4mWnDppBNspiIpjHdbU5uyC9GPF4iisyufPW3mTMEGoE3k9Rt3Q==
expires: Fri, 08 May 2020 12:58:57 GMT

GET
H2 200 chart_green.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 32 KB
5 KB 63ms
15ms Image
image/svg+xml 2600:9000:2093:3400:10:4f52:7800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart_green.svg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:3400:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/7.2.24 /
Resource Hash: 698d12a9d9db36a7923a575fa49645417817d415d534c73592669d568d986d79

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 22:21:45 GMT
content-encoding: gzip
age: 1431163
x-cache: Hit from cloudfront
status: 200
content-length: 4218
last-modified: Tue, 03 Sep 2019 08:27:04 GMT
server: Apache/2.4.41 (Amazon) PHP/7.2.24
etag: "80e2-591a1da78e7ac-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 dbf5a139061b80ff53ac8f18a1e0b49f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: JI59BhN3XqCcxLpkUKR78vKm6qe6WuhrC8CwRuYEbeXBz6Tvmmm0YQ==
expires: Wed, 21 Apr 2021 22:21:45 GMT

GET
H2 200 chart_red_flip.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 15 KB
2 KB 47ms
46ms Image
image/svg+xml 2600:9000:2093:3400:10:4f52:7800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart_red_flip.svg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:3400:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/7.2.24 /
Resource Hash: c54aa0d4f9dea350f780a74d277f1facff0094b5f23d62483ae9bb7354a29fe8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 04:58:04 GMT
content-encoding: gzip
age: 1320984
x-cache: Hit from cloudfront
status: 200
content-length: 1798
last-modified: Tue, 03 Sep 2019 08:27:04 GMT
server: Apache/2.4.41 (Amazon) PHP/7.2.24
etag: "3ca0-591a1da7a5eac-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 dbf5a139061b80ff53ac8f18a1e0b49f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: LbGGY0lZ9Q-M6ciAxHRe6RvBJc8MEi8kcIqLs7zvk_b-3XCUrHlhAQ==
expires: Fri, 23 Apr 2021 04:58:04 GMT

GET
H2 200 chart.svg
d1o9e4un86hhpc.cloudfront.net/a/img/common/header/ 27 KB
4 KB 16ms
15ms Image
image/svg+xml 2600:9000:2093:3400:10:4f52:7800:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1o9e4un86hhpc.cloudfront.net/a/img/common/header/chart.svg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:3400:10:4f52:7800:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/7.2.24 /
Resource Hash: c1cfce5a4dacb4a40ca0c6a300bbff43d6ea6a8570e5dc2419b8c5e28f57a9a3

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 16:54:49 GMT
content-encoding: gzip
age: 1450779
x-cache: Hit from cloudfront
status: 200
content-length: 4143
last-modified: Tue, 03 Sep 2019 08:27:04 GMT
server: Apache/2.4.41 (Amazon) PHP/7.2.24
etag: "6c58-591a1da77804c-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 dbf5a139061b80ff53ac8f18a1e0b49f.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: B6aaDbXvlUkbMm_RPo6Wywd65gqCK1-pajGJCPm-RNy0psxFM4zhGw==
expires: Wed, 21 Apr 2021 16:54:48 GMT

GET
H2 200 blend_45_2.png
d32r1sh890xpii.cloudfront.net/header_graphs/ 6 KB
7 KB 44ms
7ms Image
image/png 2600:9000:21f3:d600:17:eca0:da80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d32r1sh890xpii.cloudfront.net/header_graphs/blend_45_2.png?cb=1588938602
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:d600:17:eca0:da80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 39c537d92e962547f9c0a758e4a6e771868f03d77706c2dfef4c280917b94d91

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:05 GMT
via: 1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)
last-modified: Fri, 08 May 2020 11:54:04 GMT
server: AmazonS3
age: 23
etag: "10fb75a2d9844021f0835b30465fa7a4"
x-cache: Hit from cloudfront
x-amz-version-id: YbSG3jhUO0X4gomymFP98KuJ.hosTZSb
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-type: image/png
content-length: 6631
x-amz-cf-id: mRnhf183P6oQ0_HrQRBpUT5vQVladAuEo817SDqd5fzqm-49gBQ42Q==

GET
H2 200 d525cbbcfcc58cae512c785390df5573.jpg
d2t794khe5w43b.cloudfront.net/article/718x300/ 158 KB
158 KB 30ms
9ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/718x300/d525cbbcfcc58cae512c785390df5573.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2886cb37ae9565ff853f695f1dd901549ef29661d21f4a9633d544bf8dd7c757

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 01:15:07 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Thu, 07 May 2020 22:06:15 GMT
server: AmazonS3
age: 38362
etag: "a0edcbcb7e1d191a3f0521a45cbf1f34"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 161663
x-amz-cf-id: wncVzVVS_y5iZI5IceUtuWYyuKeU4FKTS2Hq-pcwWVSDOmynHRhuyA==

GET
H2 200 6621b228fc8ca701e71b6b6dce79ee45.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 65 KB
65 KB 8ms
7ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/6621b228fc8ca701e71b6b6dce79ee45.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6d40fc6a27a558f6f09b142ba587591cfe9d4f86ab0fd015a0c39ae9fb90e8eb

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 01:15:07 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Thu, 07 May 2020 21:53:38 GMT
server: AmazonS3
age: 38362
etag: "33bbc0ca370e6b0d264c2cb577496e2c"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 66622
x-amz-cf-id: q80SsnMBF4pu_JMaDxS-g7wdJz1lDFw4-DmCV_FsSZojVi1UdoQjZg==

GET
H2 200 06685a2a5b9c31966c9019d4bbe755e2.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 106 KB
106 KB 9ms
8ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/06685a2a5b9c31966c9019d4bbe755e2.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 40fddc2a37b32e799d931b5bf87c338cc2eaf4be9591afb587e0ccb565f4fd65

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:18:26 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Thu, 07 May 2020 17:25:15 GMT
server: AmazonS3
age: 45363
etag: "8f1b5455e9872a5243e7f8b9341ed1e5"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 108242
x-amz-cf-id: RNwiMb18T-ErLCegPrwAH1d9PQMTRB3pA6paXMGIRmj7qgDuSFoPNg==

GET
H2 200 ce90c17bd3f82f17513ec156d1ba9210.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 83 KB
84 KB 8ms
8ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/ce90c17bd3f82f17513ec156d1ba9210.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 95db8a9b223e23289fdaca9a64bceddf52771d09ab7fabf6f72fa450c414810e

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 01:15:07 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 22:43:36 GMT
server: AmazonS3
age: 38362
etag: "e56d9e5b0b408b0e577ff0e04fa76476"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 85501
x-amz-cf-id: -JJvSZofdETyPKaXVpIvI2Kb8F6iKi3XQp7IoHy2cQfq72kN01McRQ==

GET
H2 200 18ce4a9a9ea22f74b625a00aeca39e83.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 91 KB
91 KB 15ms
10ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/18ce4a9a9ea22f74b625a00aeca39e83.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a96de9b5cab3a965483ca1974e4c89f6e16b77ce6aa09ec9b58921a3da0778cd

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 01:21:16 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 22:46:19 GMT
server: AmazonS3
age: 37993
etag: "d45723af9b2303ea969d039a636798f0"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 92895
x-amz-cf-id: Pvpl2-9dOBoNJBGoNvN1l1dCmksqQAaFGS5g8hQMowQc3ilne9ab7w==

GET
H2 200 fddaed69a2bed88ad92c38982f93686e.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 183 KB
184 KB 22ms
17ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/fddaed69a2bed88ad92c38982f93686e.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b028c2df0b60ae6849af0ddee92ff49d080d5cf91041bae321397f5bb046d1e9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 20:50:23 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 14:21:32 GMT
server: AmazonS3
age: 54246
etag: "73a453c9a0128143f366b1e5e56572ea"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 187395
x-amz-cf-id: DcQvbIUhSJWSiiGEZgHE0DF1R4ck1qHXx4T8oiOpJ-DIochIEy5-Rg==

GET
H2 200 ccfa8ff892d2412b5b1ae6c85cf706a2.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 128 KB
129 KB 25ms
21ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/ccfa8ff892d2412b5b1ae6c85cf706a2.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8c17613217b11da7589afe53aa138606274ad5c49d5638d5275b5ab4bbd76dcb

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 15:35:11 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Wed, 06 May 2020 14:32:10 GMT
server: AmazonS3
age: 73158
etag: "d7cd76130dc2ef962b685abedf8ef9c7"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 131326
x-amz-cf-id: C9D2HZuxhItPZ1HUTETb-MpXqRNndeDP5uKY4EZjmYM11pIw0Fp6Ow==

GET
H2 200 30b468439cea58f3e4135f3fbb2e20d2.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 109 KB
110 KB 16ms
12ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/30b468439cea58f3e4135f3fbb2e20d2.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a02e6cb846a5e7a2d7f10a40c60be5d5f6bf9f432e994e688990712714cd4eb0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 08:48:34 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 22:47:38 GMT
server: AmazonS3
age: 11155
etag: "4c6d29b561bb462e16ef8238940f2ead"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 112086
x-amz-cf-id: iWppkX7pK6FjGOKOx7-LmbhWJ_xH424BakwbaEhjOfT9FwqokJogJA==

GET
H2 200 2467be954d2ff73b7199a69b51464cd1.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 98 KB
99 KB 17ms
13ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/2467be954d2ff73b7199a69b51464cd1.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 29bb72af92ce3a332ed2315043b17307ae458d3e3b7e24db3bb47417d6e433f8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 09:15:45 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 22:46:32 GMT
server: AmazonS3
age: 9524
etag: "18e1f4f94202668fce19bf47650863b1"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 100506
x-amz-cf-id: tprzob5-iGcygVtneupcqFyrtVTbURhEyirsejbGY4UHfnt2T20qXA==

GET
H2 200 5025bd44e126ebf179feab18da0eaa47.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 78 KB
78 KB 28ms
24ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/5025bd44e126ebf179feab18da0eaa47.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 968f52680af792b0d892af779cdfc6a197c35698450088340c6a471b2e056a7d

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 08:48:34 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 16:38:51 GMT
server: AmazonS3
age: 11155
etag: "840ef35851453999ff445bb7251a9167"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 79470
x-amz-cf-id: VuXQjnm8ijc0N4ohQ_VeHE5VfTDqIogWhYlfo3NYnzyb-5evg3dWnA==

GET
H2 200 6309ec9f3c9fc848f32290cb165930ec.png
d2t794khe5w43b.cloudfront.net/article/495x320/ 280 KB
281 KB 38ms
33ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/6309ec9f3c9fc848f32290cb165930ec.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 579d29f71b15657f86363fa09f655d4f41e3023e9601e46d81f56010eef88844

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 04:16:59 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Tue, 05 May 2020 15:01:19 GMT
server: AmazonS3
age: 27450
etag: "a46dbed618ed4de0683aff8615941684"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 286986
x-amz-cf-id: i_rSxvN127QE56i6lqfvCzla-pE1Vbb9oBoeWDapbAZe5iD4BLeNhw==

GET
H2 200 f51c4a5589c03415f84e2013ed34afe5.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 74 KB
74 KB 19ms
14ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/f51c4a5589c03415f84e2013ed34afe5.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a032bc143a0d78657b8ef39bd54084bfe9d5857f89cede4e17029bf6b7b08c91

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 08:48:34 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Mon, 04 May 2020 21:14:18 GMT
server: AmazonS3
age: 11155
etag: "28fd66f11a884598c0f05804eccb57eb"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 75274
x-amz-cf-id: VuNDczMnLqpVUkHHKPbDxahPwo0UhV1ptplnXGeZVfeZfW8vg4fyKg==

GET
H2 200 bae06b43a843f4d575bc458f3e8516d7.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 69 KB
69 KB 20ms
15ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/bae06b43a843f4d575bc458f3e8516d7.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6f7aa5dfd1c09d9e48906ac4a86bb8d2335685bd7dfaeff60005cfb7d4d257cc

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 09:58:58 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Mon, 04 May 2020 21:11:36 GMT
server: AmazonS3
age: 6931
etag: "309925db1294d77fe170e0e602c308ea"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 70279
x-amz-cf-id: 6rXB4l6TsVfqFCTI2Q8GCAsaHA1Mls79tCk83d57PNE0U3Lza-CavA==

GET
H2 200 dfd685fa44ac7fd67fc0e81c31bce7da.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 88 KB
88 KB 29ms
25ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/dfd685fa44ac7fd67fc0e81c31bce7da.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d9c80f88c3b68f5aa70d72e6cc3ee2b63c7304ae2d7d5a0699b2fde98d4e1100

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 09:15:45 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Mon, 04 May 2020 18:02:34 GMT
server: AmazonS3
age: 9524
etag: "2242d3872e81ce688b35032a4cabf0cf"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 89850
x-amz-cf-id: ff0VygyGNuQCRhRq1Xo26jaOO0A7K1sXVv6ItfFKtrnnC4xpdItq5A==

GET
H2 200 18554b728b50fbabca02c5555043c903.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 104 KB
104 KB 30ms
26ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/18554b728b50fbabca02c5555043c903.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f6a0f2ed3d7266da65abffc40108aff7ec33d6d63a020893de90235e66dc78f

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 09:33:59 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 20:55:49 GMT
server: AmazonS3
age: 8430
etag: "f33bb7c52c6a52dbb1616989d9df9da4"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 106310
x-amz-cf-id: cF1iykSmX7618_xGdGisfFOSyN1APmwyFWl4QMLx7J3UKURxwnS9RQ==

GET
H2 200 8f97c6eb6a891ccd9e1a41bf68d1b2be.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 147 KB
148 KB 26ms
22ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/8f97c6eb6a891ccd9e1a41bf68d1b2be.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 62e5d5f4a0db067e567962cfe7b9b938e4a0b6a7c5cc2c72f822caad1d5388f9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 13:14:28 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 20:12:18 GMT
server: AmazonS3
age: 81601
etag: "0678700f5cec00da4f71216a1492efe7"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 150844
x-amz-cf-id: xFIOap7i2lkhzRqN6i37g-yj_l5fiy6pm_lTm40oW3h0h5j-_TSP9Q==

GET
H2 200 c118366afd0d19c430611f527a871002.jpg
d2t794khe5w43b.cloudfront.net/article/495x320/ 103 KB
104 KB 27ms
23ms Image
application/octet-stream 2600:9000:21f3:b000:3:442:6dc0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2t794khe5w43b.cloudfront.net/article/495x320/c118366afd0d19c430611f527a871002.jpg
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:b000:3:442:6dc0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a492f8c0fdbb910dbabf2370b67bcd120f5c82f974104e30c9307f152c2025c1

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 09:59:02 GMT
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 15:34:28 GMT
server: AmazonS3
age: 6927
etag: "9d5d9b7aa09952711acb11cd66c6232f"
x-cache: Hit from cloudfront
content-type: application/octet-stream
status: 200
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 105958
x-amz-cf-id: _HWkPThamQBIBkbOGGa_jJOfI69z4wsRc0ajq-Io0UKEhRhiOwGDgA==

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ 25 KB
7 KB 120ms
38ms Script
text/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 208b62c8cf463bdee0fcd3f38c706d7f28d0174d4e3d66f72d3257a62b9b7979

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:27 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H2 200 envolope.png
d2p6ty67371ecn.cloudfront.net/a/img/newsletter/2/ 21 KB
21 KB 22ms
18ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/newsletter/2/envolope.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: bdaa0a5953cfaaf9abed9e2152ae1255928062363fc018c57575d5f39ee12e29

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:09 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600932
etag: "543c-5a49574283abe"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 21564
x-amz-cf-id: oCTfe30DC4WSeA25-LAy1LabQpbjyK2HVPfm8Da_os25g0fj3uYD1w==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 twitter.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 21ms
17ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/twitter.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: f9dd535864c28f0f4812ac3892f23cdd50a304d542d290a10518b31df09bc62c

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:59 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600932
etag: "3bd9-5a4957729cdfc"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 15321
x-amz-cf-id: 9M50IztAeO9IuhCHtMwD3pp9Z7Fed18iokxe34_aie_JbYF90z9s3g==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 facebook.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 20ms
17ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/facebook.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 70a78dd71a85c1895021f976541b5fdb7e1f345dbd0a17510b1a82ae354eec78

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:34 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600932
etag: "3b58-5a49575a292c3"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 15192
x-amz-cf-id: 1NLy9zMrGPhdFt1dORH43txqDygx1ohlV7oUqi-8yzED3byB8MEZXA==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 google-plus.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 28ms
24ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/google-plus.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: e78eb6051a41b3ff2fc7b969bfbe9bdd3092b705bb3fed550c85c8c3e7025293

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:32 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600932
etag: "3c67-5a495758e012a"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 15463
x-amz-cf-id: z5DOjWP-2Apt-rJmPKr_2_MKPewmVKpr9LrPYvpzVHwn_Dmpwx4iBw==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 rss.png
d2p6ty67371ecn.cloudfront.net/a/img/common/ 15 KB
15 KB 31ms
27ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/common/rss.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 9670ff323d7cf4d6cd9961af0cd668db30f323daf329e46f7bf809b1c57a84f9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:56 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:09 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600932
etag: "3c51-5a4957425aa76"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 15441
x-amz-cf-id: B8UEXzckrYZKmlzI1pGKB3tlDzwRYKUHhfCHFsQ-bUw9WUHeowcbpg==
expires: Fri, 08 May 2020 12:58:56 GMT

GET
H2 200 script.js Show response
d2p6ty67371ecn.cloudfront.net/min/f=a/js/third_party/jquery.cookie.js,a/js/third_party/jquery.lightbox_me.js,a/js/script.js,a/js/homepage/ 15 KB
5 KB 37ms
37ms Script
application/x-javascript 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2p6ty67371ecn.cloudfront.net/min/f=a/js/third_party/jquery.cookie.js,a/js/third_party/jquery.lightbox_me.js,a/js/script.js,a/js/homepage/script.js?v=27
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 / PHP/5.6.40
Resource Hash: 18cada9261c4f9c200316900d6ab365a430781e234591b7032028bdb2bad7192

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:59:07 GMT
content-encoding: gzip
age: 600921
x-powered-by: PHP/5.6.40
x-cache: Hit from cloudfront
status: 200
content-length: 4389
last-modified: Fri, 01 May 2020 12:39:00 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
etag: "pub1588336740;gz"
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
x-amz-cf-id: v94wC7XDrZ1PuAIeYkuFbB0s4P2X1euHrMFykATihtlk9QF1gDA7sA==
expires: Sat, 01 May 2021 12:59:07 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 9ms
5ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 21:54:13 GMT
server: Golfe2
age: 4553
date: Fri, 08 May 2020 10:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18433
expires: Fri, 08 May 2020 12:38:35 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 81 KB
30 KB 30ms
27ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-814550776&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

edd957f03cd7adec3305a38fa243637525c02f35c6447970cb4bf24a0c148fa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30424
x-xss-protection: 0
last-modified: Fri, 08 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 May 2020 11:54:28 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 28 KB
11 KB 88ms
32ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-814550776

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

65a1850028118c64febbde9b109da293910bfff6ee261caf0087d3d3364359ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 10877
x-xss-protection: 0
server: cafe
etag: 12200185889747903800
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:28 GMT

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ 36 KB
13 KB 38ms
34ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 03:15:55 GMT
content-encoding: gzip
age: 1413514
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: LDxe3JwepO8_EjNuO2CsBJGSAir8m6_G3xwQ5Ykql_yIWYUktcQYNw==

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ 95 KB
40 KB 46ms
43ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:06:58 GMT
content-encoding: gzip
age: 46051
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: tpPaL6hfa9gY2ZculKzIpy0GYavYZa9XyCSSSyhIUZmL3-uEv5T4EQ==

GET
H2 200 pubads_impl_2020043001.js Show response
securepubads.g.doubleclick.net/gpt/ 239 KB
86 KB 91ms
31ms Script
text/javascript 216.58.210.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

sffe /

Resource Hash

2531e515d47b88300e3c5e3a91d5d22a292bdfdb6cec2e6399090bd9545ba92c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 13:07:28 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87920
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:28 GMT

GET
H2 200 integrator.sync.js Show response
adservice.google.de/adsid/ 113 B
898 B 39ms
14ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 108
x-xss-protection: 0

GET
H2 204 index.html
cdn.districtm.io/ids/ Frame 5F21 0
0 65ms
22ms Document
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 204
date: Fri, 08 May 2020 11:54:28 GMT
set-cookie: __cfduid=dd5bbea39f8657534ae07b5f185c93a451588938868; expires=Sun, 07-Jun-20 11:54:28 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin
access-control-allow-methods: GET, HEAD, POST, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 5902fc786e150b3f-AMS
cf-request-id: 0295bc1f4200000b3fb9909200000001

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 101 KB
26 KB 109ms
43ms Script
application/javascript 52.222.191.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.191.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-80.ham50.r.cloudfront.net
Software: Server /
Resource Hash: 0875862efc0b3318a2104d27726d71f6f61d95a6e04ef6becb2793e66b2bc27a

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 20:13:12 GMT
content-encoding: gzip
server: Server
age: 56475
etag: ad48a5f558eb50f381edaa87211f6c91
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: pVgqppwDunBmmqwFDcftXSO5Vi8TQRR3_XV4HRPZJNipkA6an_gBGQ==
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
167 B 267ms
89ms XHR
application/json 134.209.131.220
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 134.209.131.220 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Fri, 08 May 2020 11:54:28 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://safehaven.com
content-length: 16
vary: Origin
content-type: application/json

GET
H2

200

ADTECH;apid=1Aabfec130-9122-11ea-ac54-12794b40da64;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;cfp=1;rndc=1588938867;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1Aabfec130-9122-11ea-ac54-12794b40da64;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=15...

945 B
1 KB

186ms
186ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1Aabfec130-9122-11ea-ac54-12794b40da64;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 6b97fd0db48d74d02455f6cd9b6568bd180c0b30024cae42bfd99ce99bfc9081

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051297/0/0/ADTECH;apid=1Aabfec130-9122-11ea-ac54-12794b40da64;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=55a92c3fceff878;misc=1588938868559
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1Aabfeb898-9122-11ea-a6eb-121ea8d7377c;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1Aabfeb898-9122-11ea-a6eb-121ea8d7377c;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=15...

945 B
1 KB

170ms
170ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1Aabfeb898-9122-11ea-a6eb-121ea8d7377c;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: ff19bbcaf99454d1a98cfd97278720fbd79c883fdc225a23b0a616fdff7e5cf3

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051300/0/0/ADTECH;apid=1Aabfeb898-9122-11ea-a6eb-121ea8d7377c;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5684acae3a19299;misc=1588938868559
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1Aac2ffcbe-9122-11ea-9142-12e650fea264;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1Aac2ffcbe-9122-11ea-9142-12e650fea264;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=15...

945 B
1 KB

437ms
433ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1Aac2ffcbe-9122-11ea-9142-12e650fea264;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: adf125603b9b4fe53eac1f9b8b6e34932b732e162230648cb27a65805b25b3a1

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051299/0/0/ADTECH;apid=1Aac2ffcbe-9122-11ea-9142-12e650fea264;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=57708540ba0b8f5;misc=1588938868559
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1Aac2d6d28-9122-11ea-a082-127f7115e3c4;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1Aac2d6d28-9122-11ea-a082-127f7115e3c4;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=15...

944 B
1 KB

423ms
423ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1Aac2d6d28-9122-11ea-a082-127f7115e3c4;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 264a11fdf4f64ded557368024f2b3aeb09624dcec58bd4bb79e62cc75431301b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 944
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051293/0/0/ADTECH;apid=1Aac2d6d28-9122-11ea-a082-127f7115e3c4;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=5816174dc47db29;misc=1588938868559
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=598fbd85d25f77c;misc=1588938868559 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=598fbd85d25f77c;misc=1588938868559;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=598fbd85d25f77c;misc=1588938868559

945 B
1 KB

177ms
177ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=598fbd85d25f77c;misc=1588938868559
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 0ea010d71907be056fbb2dd60bab3bfe4fd1a5cd641a0193873adf35b03349ac

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5051301/0/0/ADTECH;cfp=1;rndc=1588938868;v=2;cmd=bid;cors=yes;alias=598fbd85d25f77c;misc=1588938868559
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://safehaven.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 173 B
569 B 105ms
57ms XHR
application/json 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsafehaven.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=36e5c6f4-12da-47b3-9df3-4d3455a24fce%2Cba837890-dc93-41da-8faf-be9a9deaca5f%2C29450d68-9fe3-4ec4-9ad5-23840007399a%2C5929c4bf-9bfd-4aa2-9797-6929f0fe2a42%2C38e751b6-5c29-46e2-a552-e4c1d7ecce84&nocache=1588938868562&pubcid=7ae74cea-9a22-4298-b022-b50c28775525&schain=1.0%2C1!admetricspro.com%2C102%2C1%2C%2C%2C&aus=300x250%7C300x250%7C300x250%7C728x90%7C728x90&divIds=div-gpt-ad-1553475674669-0%2Cdiv-gpt-ad-1553475817787-0%2Cdiv-gpt-ad-1553475909622-0%2Cdiv-gpt-ad-1553475988342-0%2Cdiv-gpt-ad-1553476044183-0&auid=540800705%2C540800706%2C540800707%2C540800708%2C540800709&
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.185.0 /
Resource Hash: 9fd5f476fa289f67e804b9fca21fa2e1ae9810822de27a38c56da91c6b78d3ad

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
server: OXGW/16.185.0
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://safehaven.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST 24
web.hb.ad.cpe.dotomi.com/s2s/header/ 0
0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
114 B 211ms
173ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 08 May 2020 11:54:28 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://safehaven.com

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 217ms
118ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244360&size_id=15&p_pos=atf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=36e5c6f4-12da-47b3-9df3-4d3455a24fce&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9498585958561576
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: fde314f4cc8a99326eda2d7f1c197a14d5d6980fb26a11367283d4bc114e9e43

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=382
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 218ms
119ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244362&size_id=15&p_pos=btf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=ba837890-dc93-41da-8faf-be9a9deaca5f&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9557173886527179
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 171894a550f393e07317cfe9b84ebffee8df2066ae0f0ffd89254a1491b0589c

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=267
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 242ms
143ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244366&size_id=15&p_pos=btf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=29450d68-9fe3-4ec4-9ad5-23840007399a&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.417753270568773
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 1cb52a3455dcfa07ef31f21959e354a7af5105ce84414c3ad52d2ee6023afedb

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=437
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
2 KB 237ms
138ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244360&size_id=2&p_pos=atf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=5929c4bf-9bfd-4aa2-9797-6929f0fe2a42&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.1737261647960764
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: fc9cf76523d4d39854a29f001308a89ddd8bf418c0c6adfffeec81636ffca4a8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=241
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
2 KB 229ms
128ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=250874&zone_id=1244362&size_id=2&p_pos=btf&rp_schain=1.0,1!admetricspro.com,102,1,,,&rf=https%3A%2F%2Fsafehaven.com%2F&tk_flint=pbjs_lite_v3.8.0&x_source.tid=38e751b6-5c29-46e2-a552-e4c1d7ecce84&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.670279970916263
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 3acdeaeb18b807080e6c02ec46fab5ad4fa4418b83e93f6df70df7b1fb8028cc

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=177
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
701 B 64ms
23ms XHR
application/json 72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_3.8.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: b1a2d80ef2c75d1545c4373db1b6e5c654d67ac1c30af5ff71be02e542b09ed9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://safehaven.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 44

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
708 B 113ms
36ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:30 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.44:80
AN-X-Request-Uuid: febd274d-deda-45b7-885a-44d1011fa8f3
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
708 B 112ms
37ms XHR
application/json 185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:30 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.75:80
AN-X-Request-Uuid: 57788c7e-cb90-4b50-b2a1-77e189e5576f
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 131 KB
32 KB 22ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 31766
x-xss-protection: 0
pragma: public
x-fb-debug: ALvYGUAEu8Swpb6QALIGjZV3YQQR+2Ctn3DKMmDt//ZCv3eltvDrW3P0RvmPlVDOwnE7Og4xQmBbWFFm0HXL2w==
x-fb-trip-id: 1814657579
x-frame-options: DENY
date: Fri, 08 May 2020 11:54:28 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 81 KB
30 KB 33ms
30ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-820290545&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f7bdcb933969f77bef3dac4ee5e41653396b909ab675e532d27c92f3101a5d5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30422
x-xss-protection: 0
last-modified: Fri, 08 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 May 2020 11:54:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 81 KB
30 KB 26ms
24ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-802310072&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2249023-27

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

59c9876dfab909e1cfd023c09b8c5bd6582bdde070a6491a09becfcb3a3a9e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30423
x-xss-protection: 0
last-modified: Fri, 08 May 2020 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 08 May 2020 11:54:28 GMT

GET
H2 200 ee70c0a7d2f14ec08939692fc7857b11.js Show response
cdn.pushcrew.com/js/ 237 KB
68 KB 49ms
25ms Script
application/javascript 2606:4700:10::6814:3677
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pushcrew.com/js/ee70c0a7d2f14ec08939692fc7857b11.js
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:3677 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c79ada16090cc7e94af116173695bfd88da9efe580f89749e1160ba9d49c54c

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1691
status: 200
cf-request-id: 0295bc1f8d0000176ab989f200000001
access-control-allow-origin: *
last-modified: Thu, 09 Apr 2020 07:33:27 GMT
server: cloudflare
etag: W/"5e8ecfc7-3b3a9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
via: 1.1 google
cache-control: max-age=43200
cf-ray: 5902fc78eb52176a-FRA
expires: Fri, 08 May 2020 11:56:17 GMT

GET
H2 200 search.png
d2p6ty67371ecn.cloudfront.net/a/img/ 770 B
1 KB 27ms
26ms Image
image/png 2600:9000:2093:8800:c:5250:79c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d2p6ty67371ecn.cloudfront.net/a/img/search.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2093:8800:c:5250:79c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 (Amazon) PHP/5.6.40 /
Resource Hash: 2f1dccde57c713fe154c8da92f8d4b312373c2a055a0a9d822c6042b0176eb8d

Request headers

Referer: https://d2p6ty67371ecn.cloudfront.net/min/f=a/css/style.css,a/css/homepage/style.css?v=27
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 01 May 2020 12:58:58 GMT
via: 1.1 8c7d2e4b1dd1d9cc43ca7f060033ac41.cloudfront.net (CloudFront)
last-modified: Fri, 01 May 2020 12:38:08 GMT
server: Apache/2.4.41 (Amazon) PHP/5.6.40
age: 600930
etag: "302-5a495741b9834"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=604800
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 770
x-amz-cf-id: V_rFHte_TFp5JIpUaM5cmGCK2-yze54M4V3on0x1do2zC9bdJj0GFw==
expires: Fri, 08 May 2020 12:58:58 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
78 B 22ms
21ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 5902fc7a0a050b3f-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295bc204500000b3fb9917200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
662 B 96ms
30ms Script
text/html 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=HZ5EgXQHbyfxJkrkw5TCoioB4u74Il~450~div-gpt-ad-1553475674669-0&psa=0&zone=450&id=15024977&member_id=1908&size=300x250&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:30 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.235:80
AN-X-Request-Uuid: b63e265f-0b71-4955-a81d-ea360b194bfb
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
62 B 24ms
22ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 5902fc7a0a1c0b3f-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295bc204900000b3fb9919200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
661 B 91ms
29ms Script
text/html 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=KR272bYUg852kK6nGDRfzgUkR8a8b6~451~div-gpt-ad-1553475817787-0&psa=0&zone=451&id=15024978&member_id=1908&size=300x250&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:30 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.28:80
AN-X-Request-Uuid: ca14eba5-aa5e-445f-9935-e8355dac3501
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
62 B 24ms
23ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 5902fc7a1a210b3f-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295bc204a00000b3fb991a200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
662 B 92ms
31ms Script
text/html 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=zDVq67sdMZbSR4JIaimxakg21jBMTF~452~div-gpt-ad-1553475909622-0&psa=0&zone=452&id=15024979&member_id=1908&size=300x250&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:30 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.228:80
AN-X-Request-Uuid: 9bf6f1a5-494f-4901-8cf0-f9e276b374f9
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
62 B 23ms
22ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 5902fc7a1a260b3f-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295bc204a00000b3fb991b200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
662 B 91ms
30ms Script
text/html 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=fGoD4zjYxiNbEybF6JdiPw4MT3seO9~453~div-gpt-ad-1553475988342-0&psa=0&zone=453&id=15024980&member_id=1908&size=728x90&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:30 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.174:80
AN-X-Request-Uuid: 914762dd-96e2-47df-9962-d3d370803763
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
62 B 21ms
20ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dmx.districtm.io/b/v1
Requested by: Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

date: Fri, 08 May 2020 11:54:28 GMT
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
cf-ray: 5902fc7a1a280b3f-AMS
access-control-allow-headers: Content-Type, Origin
cf-request-id: 0295bc204b00000b3fb991c200000001

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
661 B 89ms
29ms Script
text/html 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?callback=districtmHeader.ssp.appnexus.handleAppNexusCallback&callback_uid=WR0PNxItL1xsClMDT9ssUNSRgfDHem~454~div-gpt-ad-1553476044183-0&psa=0&zone=454&id=15024981&member_id=1908&size=728x90&referrer=https://safehaven.com/

Requested by

Host: cdn.districtm.ca
URL: https://cdn.districtm.ca/merge/merge.142016.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:30 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.23:80
AN-X-Request-Uuid: 1d68ac5e-0e78-4505-9941-0027a1f79d2d
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 a
www.googletagmanager.com/ 0
130 B 14ms
13ms Image
image/gif 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=AW-820290545&cv=1&v=3&t=t&pid=259924253&rv=4t0&es=1&e=gtm.js&eid=17&tc=1&tr=1rep&ti=1rep&z=0

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 a
www.googletagmanager.com/ 0
56 B 14ms
14ms Image
image/gif 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=AW-820290545&cv=1&v=3&t=t&pid=259924253&rv=4t0&es=1&e=*&eid=18&tc=1&z=0

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2163 2 KB
1 KB 35ms
35ms Script
text/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: c73feb689d65c66e0eb6dfcf1425a9a3b5ef30545a0ef57b3c665fe7b2cbba53

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/javascript; charset=utf-8

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&aip=1&a=915566857&t=pageview&_s=1&dl=https%3A%2F%2Fsafehaven.com%2F&ul=en-us&de=UTF-8&dt=Safehaven.com%20%7C%20Preservation%20of%20Capital&sd=2...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=256372478.1588938869&jid=949631334&_gid=1023495450.1588938869&gjid=594497371&_v=j82&z=62485155

35 B
446 B

47ms
16ms

Image
image/gif

2a00:1450:400c:c08::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=256372478.1588938869&jid=949631334&_gid=1023495450.1588938869&gjid=594497371&_v=j82&z=62485155

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 08 May 2020 11:54:29 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 302
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2249023-27&cid=256372478.1588938869&jid=949631334&_gid=1023495450.1588938869&gjid=594497371&_v=j82&z=62485155
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 415
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 247445556002302 Show response
connect.facebook.net/signals/config/ 475 KB
119 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/247445556002302?v=2.9.18&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

173bf971478c26c62d39568f01aba75e836f04fe65b35d755803382abea7e5f5

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 122178
x-xss-protection: 0
pragma: public
x-fb-debug: LLZw7qP4zzJQjV7Hj3Tt4S888Hjx15bHbsu+HOp+QbT1x+qY/X5dHEgzCfIBlze4YZ0+CcSLIfF+LjiTD+sSNQ==
x-fb-trip-id: 1814657579
x-frame-options: DENY
date: Fri, 08 May 2020 11:54:28 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/814550776/ 2 KB
1 KB 41ms
20ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/814550776/?random=1588938868963&cv=9&fst=1588938868963&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b30637258f1f3b45f943ca4c2f76af2bf1f1623d01f6481d378416137fe7842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1027
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/802310072/ 2 KB
2 KB 36ms
17ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/802310072/?random=1588938868967&cv=9&fst=1588938868967&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3acfaf30ee15f611aca350369b3d9837f1068656d0731b37fc851ef42e597538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1026
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/820290545/ 2 KB
1 KB 36ms
18ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/820290545/?random=1588938868968&cv=9&fst=1588938868968&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb070f086a0c26ebfc69e0bb33174c73765f112e3fd90b2af727c3e4190db7a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1022
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
369 B 70ms
69ms XHR
text/javascript 52.222.191.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsafehaven.com%2F&pid=TsyVOnyBPXiRg&cb=0&ws=1600x1200&v=7.49.02&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-300x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-300x250-BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-300x250-BTF2%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-728x90-ATF%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F192633929%2Fsafehaven-728x90-BTF%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.191.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-80.ham50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:29 GMT
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: HAM50-C2
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 3asEBxJtoWkWUHrJ8CR16HtjNwm2eg0ztnkxQ4ZFkQc1cNT4rkIDYw==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 472ms
410ms XHR
application/javascript 52.222.191.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.191.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-80.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
last-modified: Thu, 09 Apr 2020 23:46:54 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C2
status: 200
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: public, max-age=86400
x-cache: Miss from cloudfront
x-amz-cf-id: WVusFHMyxA5LcshhYheiOVZ6sXP4SjpooPbp_miCb_n_Bkc70pY40w==
via: 1.1 0db8881d14f219a945f6f3898134012d.cloudfront.net (CloudFront)

GET
H2 200 api.min.js Show response
a.optmstr.com/app/js/ 199 KB
60 KB 94ms
30ms Script
application/javascript 23.111.11.100
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.optmstr.com/app/js/api.min.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.100 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c73e66343b58de4ecf1646d9910e95de94f4286795ce2a2c7ed7efacf6b60e63

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:29 GMT
content-encoding: gzip
last-modified: Thu, 07 May 2020 16:20:16 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 133571257D38D138
etag: W/"cf7fac43ccd9b89b61eb4521fe60a5f7"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: BDPjGzmDz6oJCL+16t2epF0rvzotI/visMoumJCc4JZdwy5O3MtuWSxPCg5EJKcRD+HA1U3ImUo=
expires: Mon, 03 May 2021 11:54:29 GMT

GET
H/1.1 200
OK iab_consent_sdk.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 2163 19 KB
6 KB 29ms
27ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 15:01:36 GMT
Server: nginx
ETag: W/"5e441350-4be0"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 11:54:28 GMT

GET
H/1.1 200
OK DetectGDPR2.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 2163 8 KB
3 KB 57ms
27ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR2.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:29 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 18:48:12 GMT
Server: nginx
ETag: W/"5e2ddeec-211f"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 11:54:29 GMT

GET
H/1.1 200
OK DetectGDPR.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 2163 7 KB
3 KB 82ms
29ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Jan 2020 11:58:13 GMT
Server: nginx
ETag: W/"5e2d7ed5-1d87"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 11:54:28 GMT

GET
H/1.1 200
OK hls.0.12.4_1.min.js Show response
live.sekindo.com/content/video/hls/ Frame 2163 247 KB
85 KB 99ms
47ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Last-Modified: Mon, 06 Jan 2020 15:31:55 GMT
Server: nginx
ETag: W/"5e1352eb-3dcb9"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 11:54:28 GMT

GET
H/1.1 200
OK prebidVid.2.44.3_4.min.js Show response
live.sekindo.com/content/prebid/ Frame 2163 272 KB
101 KB 102ms
49ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 2c167f4042d1338b33e2822f3b3dca3646bffcac14747d934c50794192dc3c2b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 May 2020 09:21:08 GMT
Server: nginx
ETag: W/"5eafde84-4415a"
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=31536000, public
Expires: Sat, 08 May 2021 11:54:28 GMT

GET
H/1.1 200
OK liveVideo.php Show response
live.sekindo.com/live/ Frame 2163 413 KB
117 KB 118ms
65ms Script
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=98755&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=400&y=291&vp_content=plembed121drxwqzitg&vp_template=5146&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,102,1&cbuster=1588938868&pubUrlAuto=https%3A%2F%2Fsafehaven.com%2F&videoType=flow&floatWidth=350&floatHeight=198&floatDirection=br&floatVerticalOffset=1&floatHorizontalOffset=1&floatCloseBtn=1&flowMode=undefined
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 5dd68f4f4c4774640e296023b641726007c8ac625b741a810dbaf147f26765f9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Server: nginx
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 42ms
23ms Stylesheet
text/css 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
status: 200
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 7050

GET
H2 200 /
www.google.com/pagead/1p-user-list/802310072/ 42 B
110 B 43ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/802310072/?random=1588938868967&cv=9&fst=1588935600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=740050828&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/802310072/ 42 B
564 B 41ms
18ms Image
image/gif 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/802310072/?random=1588938868967&cv=9&fst=1588935600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=740050828&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/820290545/ 42 B
110 B 43ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/820290545/?random=1588938868968&cv=9&fst=1588935600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=151554649&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/820290545/ 42 B
110 B 41ms
18ms Image
image/gif 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/820290545/?random=1588938868968&cv=9&fst=1588935600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=151554649&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/814550776/ 42 B
564 B 41ms
19ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/814550776/?random=1588938868963&cv=9&fst=1588935600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=2121192730&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/814550776/ 42 B
110 B 40ms
19ms Image
image/gif 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/814550776/?random=1588938868963&cv=9&fst=1588935600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa4t0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsafehaven.com%2F&tiba=Safehaven.com%20%7C%20Preservation%20of%20Capital&async=1&fmt=3&is_vtc=1&random=2121192730&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 651529765710614 Show response
connect.facebook.net/signals/config/ 475 KB
120 KB 65ms
64ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/651529765710614?v=2.9.18&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

370f89f6ebcec94f6a529911989dc8cd601a3cf2795b36cc3b5ba92fae8af47d

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id: 1814657579
pragma: public
x-fb-debug: cneAI4npTn41aJZGbOFWxs4UU50++FAksSfz5fnEj/xpqscT3wEjLIGjBb3ab2wBpfjhxE82Dl7W2afRhCrQGQ==
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: DENY
date: Fri, 08 May 2020 11:54:29 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
status: 200
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary: Accept-Encoding
x-xss-protection: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
325 B 20ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=247445556002302&ev=PageView&dl=https%3A%2F%2Fsafehaven.com%2F&rl=&if=false&ts=1588938869178&sw=1600&sh=1200&v=2.9.18&r=stable&ec=0&o=30&fbp=fb.1.1588938869177.277657589&it=1588938868949&coo=false&rqm=GET

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:29 GMT, Fri, 08 May 2020 11:54:29 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Fri, 08 May 2020 11:54:29 GMT

GET
H2 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 1192ms
1167ms Font
font/woff2 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin: https://safehaven.com

Response headers

date: Fri, 08 May 2020 11:54:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:36:18 GMT
status: 200
etag: "1544639778"
vary: Accept-Encoding
x-cache: HIT
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 77171

GET
H2 200 20987 Show response
api.omappapi.com/v2/embed/ 82 KB
10 KB 352ms
281ms XHR
application/json 13.225.87.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/20987
Requested by: Host: a.optmstr.com
URL: https://a.optmstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.87.9 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-9.fra2.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 813628535187fe19c6e20047ec1987cb69c53a0fdc33b3bec28d2876a683a6d9

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:29 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: FRA2-C2
x-cache-status: HIT
x-cache: Miss from cloudfront
status: 200
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 1720
x-user-agent: standard
server: Pagely Gateway/1.5.1
vary: Accept-Encoding, User-Agent
content-type: application/json;charset=utf-8
via: 1.1 f99b5b46e77cfe9c3413f99dc8a4088c.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account
access-control-allow-origin: *
x-amz-cf-id: BnOxRxZ41rr-xMJN1Qjh8LFECBOyzRCGnuc5YVWwHwXLQeY89SXiFw==

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=651529765710614&ev=PageView&dl=https%3A%2F%2Fsafehaven.com%2F&rl=&if=false&ts=1588938869307&sw=1600&sh=1200&v=2.9.18&r=stable&ec=0&o=30&fbp=fb.1.1588938869177.277657589&it=1588938868949&coo=false&rqm=GET

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:29 GMT, Fri, 08 May 2020 11:54:29 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Fri, 08 May 2020 11:54:29 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 2163 101 KB
26 KB 52ms
52ms Script
application/javascript 52.222.191.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.191.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-80.ham50.r.cloudfront.net
Software: Server /
Resource Hash: 0875862efc0b3318a2104d27726d71f6f61d95a6e04ef6becb2793e66b2bc27a

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 20:13:12 GMT
content-encoding: gzip
server: Server
age: 56476
etag: ad48a5f558eb50f381edaa87211f6c91
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: dbuG-jLLtjAxDdZ74_Bp35ZN6eD-wiKP3GRK68I1crsKqHinqJgmLA==
via: 1.1 fec18be10cd069f0dd74ab4667ba5e27.cloudfront.net (CloudFront)

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 2163 6 KB
3 KB 74ms
74ms XHR
application/javascript 52.222.191.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.191.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-191-80.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
last-modified: Thu, 09 Apr 2020 23:46:54 GMT
server: AmazonS3
x-amz-cf-pop: HAM50-C2
status: 200
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: public, max-age=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 0gs_MnmVKQ3kYjKC1in6RaPaF1Bh38RPYjujw-0xudVvEvFlJVp_vw==
via: 1.1 0db8881d14f219a945f6f3898134012d.cloudfront.net (CloudFront)

GET
H2 200 css
fonts.googleapis.com/ Frame 57FB 2 KB
672 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 11:54:29 GMT
server: ESF
date: Fri, 08 May 2020 11:54:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 11:54:29 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame AA41 2 KB
626 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 11:54:29 GMT
server: ESF
date: Fri, 08 May 2020 11:54:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 11:54:29 GMT

GET
H/1.1 200
OK user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8565 0
0 86ms
28ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:28:34 GMT
ETag: "1300708-2eae-5a33da96f833f"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 4169
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=110165
Expires: Sat, 09 May 2020 18:30:34 GMT
Date: Fri, 08 May 2020 11:54:29 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK placeHolder.png
live.sekindo.com/content/video/splayer/assets/ 23 KB
24 KB 32ms
26ms Image
image/png 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/content/video/splayer/assets/placeHolder.png
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:28 GMT
Last-Modified: Sun, 11 Jun 2017 08:03:58 GMT
Server: nginx
ETag: "593cf96e-5dbf"
Content-Type: image/png
Cache-Control: no-cache, private
Accept-Ranges: bytes
Content-Length: 23999
Expires: Fri, 08 May 2020 11:54:27 GMT

GET
H/1.1 200
OK logo_5146.png
video.sekindo.com/uploads/video/users/logo/19668/ Frame 57FB 18 KB
18 KB 395ms
298ms Image
image/png 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/video/users/logo/19668/logo_5146.png?cbuster=1563896491

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Tue, 23 Jul 2019 15:41:25 GMT
Server: Tengine
ETag: "5d372aa5-470b"
X-Cache-Status: MISS
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: max-age=604800, private
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 18187
Expires: Fri, 15 May 2020 11:54:29 GMT

GET
H/1.1 200
OK vid5eb520d45c646066411871.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 12 KB
12 KB 120ms
28ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.jpg?cbuster=1588928725

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

ebcbd416dce4983b194431a61a1b40209efab2f2a682ba19006edd2a941f20d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:42 GMT
Last-Modified: Fri, 08 May 2020 09:10:35 GMT
Server: Tengine
ETag: "5eb5220b-2fc7"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 12231
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733289db1548301905.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 26 KB
26 KB 133ms
39ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733289db1548301905.jpg?cbuster=1588884276

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

5c8b3abfc048dad503e3e5a62c1518c4c0e933389e46f8339990b12c4deb9213

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:42 GMT
Last-Modified: Thu, 07 May 2020 21:43:47 GMT
Server: Tengine
ETag: "5eb48113-6784"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 26500
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733ee9052239075304.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 9 KB
9 KB 126ms
26ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733ee9052239075304.jpg?cbuster=1588884290

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

39ac46b13bedb7f0fdf649e1b604d551d1070130f08b8bfe74583bde4cc4ebbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:42 GMT
Last-Modified: Thu, 07 May 2020 21:46:59 GMT
Server: Tengine
ETag: "5eb481d3-224e"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 8782
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733d9afab339860429.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 22 KB
22 KB 140ms
40ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733d9afab339860429.jpg?cbuster=1588884286

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

96a1afb1b91fa08558e5a5eb58c0497a7ae508c4d2134fda29fbb66df408168e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:42 GMT
Last-Modified: Thu, 07 May 2020 21:46:03 GMT
Server: Tengine
ETag: "5eb4819b-5760"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 22368
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733c0dbdc216040941.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 9 KB
10 KB 150ms
29ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733c0dbdc216040941.jpg?cbuster=1588884285

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

d72afc407a3d6289f8150ea724ffd9ef215084236cfb6c831a3d91f136cda7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Thu, 07 May 2020 21:45:50 GMT
Server: Tengine
ETag: "5eb4818e-2595"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 9621
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733abe02e232097995.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 22 KB
22 KB 32ms
31ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733abe02e232097995.jpg?cbuster=1588884283

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

96a1afb1b91fa08558e5a5eb58c0497a7ae508c4d2134fda29fbb66df408168e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Thu, 07 May 2020 21:45:23 GMT
Server: Tengine
ETag: "5eb48173-5760"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 22368
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb47338c1907736866527.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 20 KB
20 KB 32ms
31ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb47338c1907736866527.jpg?cbuster=1588884282

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

856ebd974805a315c6419b50ff68e30ca94f384415d85af8c56cbb5479f3faa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Thu, 07 May 2020 21:45:09 GMT
Server: Tengine
ETag: "5eb48165-4f50"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 20304
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb47337a1a7a278668266.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 10 KB
10 KB 29ms
29ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb47337a1a7a278668266.jpg?cbuster=1588884280

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

2e14464924e0301cda997640b9918eb65cca0c896a4610e0b35101975b013adf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Thu, 07 May 2020 21:44:51 GMT
Server: Tengine
ETag: "5eb48153-2762"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 10082
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb47335316e8519280491.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 13 KB
13 KB 30ms
30ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb47335316e8519280491.jpg?cbuster=1588884279

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

4477dd6cbad78ef9acc3c17095843a20dd110fe9adccea64a6db0b87086fdd81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Thu, 07 May 2020 21:44:37 GMT
Server: Tengine
ETag: "5eb48145-340d"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 13325
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5eb4733466ad8584484743.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame AA41 23 KB
24 KB 31ms
31ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb4733466ad8584484743.jpg?cbuster=1588884276

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

f43d2cf395827366eb0b0ae06b9cc2446cd50b8cb198ad918bd550591c9e9571

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Thu, 07 May 2020 21:43:52 GMT
Server: Tengine
ETag: "5eb48118-5d81"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 23937
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame 2163
Redirect Chain

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5eb54874de677&custom_data=5eb54874de677&gdpr=1&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54874de677&custom_data=5eb54874de677&gdpr=1&gdpr_consent=

43 B
380 B

23ms
23ms

Image
image/gif

18.195.193.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54874de677&custom_data=5eb54874de677&gdpr=1&gdpr_consent=
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.193.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-193-185.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 08 May 2020 11:54:29 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

status: 302
date: Fri, 08 May 2020 11:54:29 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5eb54874de677&custom_data=5eb54874de677&gdpr=1&gdpr_consent=
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame 2163
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=0e9072a4-0be4-4bf7-99b4-df71f6eba562

0
347 B

31ms
31ms

Image
text/html

63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=0e9072a4-0be4-4bf7-99b4-df71f6eba562
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: no-store
Content-Type: text/html; charset=utf-8

Redirect headers

status: 307
date: Fri, 08 May 2020 11:54:29 GMT
content-length: 0
location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=0e9072a4-0be4-4bf7-99b4-df71f6eba562

GET
H/1.1 200
OK vid5eb520d45c646066411871.jpg
video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/ Frame 57FB 12 KB
12 KB 109ms
27ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn13/video/users/converted/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.jpg?cbuster=1588928725

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

ebcbd416dce4983b194431a61a1b40209efab2f2a682ba19006edd2a941f20d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://amli.sekindo.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:42 GMT
Last-Modified: Fri, 08 May 2020 09:10:35 GMT
Server: Tengine
ETag: "5eb5220b-2fc7"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 12231
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ Frame 57FB 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 57FB 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2163 6 KB
2 KB 55ms
54ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=396&y=223&fpl=2&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&cbuster=1588938869577&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: a4115b4822d48c991a72ad7dbe73639cd6c944d88be5fa82d18232061a1051ac

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:28 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1275

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2163 6 KB
2 KB 60ms
59ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=1&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=350&y=197&fpl=2&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&cbuster=1588938869578&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 5bc933b959b44c9e7857cd2deb5582a422d5e00c775c8e2ddaf47f0ff00da464

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:29 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1277

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2163 6 KB
2 KB 54ms
54ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=396&y=223&fpl=2&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&cbuster=1588938869578&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: cfa4e01ee2a07488db230d93963d11698efc9547ab0e1d6704e835b2efa85617

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:29 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 1320

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 2163 0
214 B 108ms
27ms XHR
application/json 18.194.51.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.2.44.3_4.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.51.59 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-51-59.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://safehaven.com
Access-Control-Allow-Credentials: true
Server: adaptv/1.0
Connection: keep-alive
Content-Length: 0
Content-Type: application/json

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.5.18/ 16 KB
7 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:824::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 17:38:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1275338
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6490
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Apr 2021 17:38:51 GMT

GET
H2 200 mobile-detect.min.js Show response
cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/ 38 KB
15 KB 14ms
14ms Script
application/javascript 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.4.3/mobile-detect.min.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

363a80d367e6658e72d918cd33f9481ce7929199a9858122b0dcc61dffa62fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:29 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 7875393
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295bc23950000c2c2f3bbb200000001
served-in-seconds: 0.002
timing-allow-origin: *
last-modified: Sat, 08 Sep 2018 10:00:50 GMT
server: cloudflare
etag: W/"5b939dd2-9624"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5902fc7f5e1ec2c2-FRA
expires: Wed, 28 Apr 2021 11:54:29 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
80 B 15ms
14ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryMkz43TuQw2pq2tv9

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 08 May 2020 11:54:29 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
content-length: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 20 KB
5 KB 476ms
475ms XHR
text/plain 216.58.210.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1334791069031913&correlator=890017324993499&output=ldjh&impl=fifs&adsid=NT&eid=21065929&vrg=2020043001&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200508&iu_parts=192633929%2Csafehaven-300x250-ATF%2Csafehaven-300x250-BTF%2Csafehaven-300x250-BTF2%2Csafehaven-728x90-ATF%2Csafehaven-728x90-BTF&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=300x250%2C300x250%2C300x250%2C728x90%2C728x90&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1588938869&dt=1588938869714&dlt=1588938867723&idt=740&frm=20&biw=1585&bih=1200&oid=3&adxs=1068%2C1068%2C240%2C241%2C429&adys=661%2C943%2C2295%2C1206%2C3125&adks=814543115%2C3046793618%2C190242331%2C1732354106%2C2965735416&ucis=1%7C2%7C3%7C4%7C5&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsafehaven.com%2F&dssz=64&icsg=180388669440&mso=32&std=41&vis=1&dmc=8&scr_x=0&scr_y=0&psz=320x532%7C320x532%7C395x250%7C824x90%7C1585x90&msz=320x250%7C320x250%7C395x250%7C824x90%7C1585x90&ga_vid=256372478.1588938869&ga_sid=1588938870&ga_hid=915566857&fws=0%2C0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

3a82dd3a69c0367fe9a8840c5a1d82a217bf3cd39de013c5470b5af3f97dbcfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4931
x-xss-protection: 0
google-lineitem-id: 5012158941,5012537195,5012542490,5012545628,5012261260
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138265267020,138265545376,138265545085,138265545127,138265239347
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://safehaven.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 26ms
6ms Other
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 2163 2 B
429 B 65ms
65ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.0.0&vid_viewabilityState=0&vid_playbackMethod=auto&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn13%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo_5b4c8dbbc9a66557872002%2Fvid5eb520d45c646066411871.mp4&vid_content_id=788378&vid_content_desc=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_title=Siemens+CEO+on+Earnings%2C+Liquidity%2C+Pandemic+Strategy&vid_content_duration=412&debugInformation=&x=350&y=197&fpl=2&pubUrl=https%3A%2F%2Fsafehaven.com%2F&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&isApp=0&geoLati=50.884700775146484&geoLong=4.504899978637695&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&cbuster=1588938869772&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30352D30385F31347D7B7331313031303933367D7B4338357D7B536332466D5A576868646D56754C6D4E7662513D3D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583430307D7B593239317D7B66317D7B4C353134367DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F74.0.3729.169+Safari%2F537.36&playerVersion=3.0.0&fpl=-1&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C102%2C1&csuuid=5eb54874de677&debugInfo=11010936_&debugPlayerSession=&sta=11010936&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed121drxwqzitg&secondaryContent=&x=400&y=291&pubUrl=https%3A%2F%2Fsafehaven.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=1&impGap=2&flow_width=350&flow_height=198&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.884700775146484&geoLong=4.504899978637695&vpTemplate=5146&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:29 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://safehaven.com
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=utf-8
Content-Length: 22

GET
H/1.1 200
OK chunklist_640.m3u8 Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 2 KB
3 KB 106ms
27ms XHR
application/vnd.apple.mpegurl 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/chunklist_640.m3u8
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 064e739a77f7623ba98eb109804d6d70d0773ee7be25f8a7d72e580fff406aa4

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Fri, 08 May 2020 09:12:29 GMT
Server: Tengine
ETag: "5eb5227d-8cc"
Content-Type: application/vnd.apple.mpegurl
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:43 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 2252
X-Proxy-Cache: HIT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 57FB 11 KB
11 KB 30ms
6ms Font
font/woff2 2a00:1450:4001:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto&display=swap
Origin: https://safehaven.com

Response headers

date: Wed, 01 Apr 2020 18:22:23 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 3173526
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Thu, 01 Apr 2021 18:22:23 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
29 B 10ms
10ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryRnnMVBsjMsZIStJt

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 08 May 2020 11:54:29 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://safehaven.com
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK w_640_000.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 314 KB
315 KB 39ms
39ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_000.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 4af00ba1a8bb2dd1374c5d434a9e0869343c8ea57922fdae7a53df4cf8bf40e4

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Fri, 08 May 2020 09:12:04 GMT
Server: Tengine
ETag: "5eb52264-4e9fc"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:43 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 322044
X-Proxy-Cache: HIT

GET
BLOB 200
OK 677df660-2c60-4dac-9b2f-5df1b92d5c40
https://safehaven.com/ Frame 2163 63 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://safehaven.com/677df660-2c60-4dac-9b2f-5df1b92d5c40
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 64352
Content-Type: text/javascript

GET
H/1.1 200
OK w_640_001.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 333 KB
333 KB 27ms
27ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_001.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 9dcdc83bf21b50a7a30e8628dc033e2505b134c8cd0dcf24823aed6534669d12

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Fri, 08 May 2020 09:12:05 GMT
Server: Tengine
ETag: "5eb52265-5336c"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:43 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 340844
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame AA41 0
379 B 32ms
32ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=16&serverTime=1588938869&s=0&sta=11010936&x=350&y=197&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54874de677&contentFileId=788378&mediaPlayListId=4637&playerVer=3.0.0&contentMatchType=&isExcludeFromOpt=0&cbuster=1588938870037&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:29 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_002.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 317 KB
317 KB 30ms
29ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_002.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 761a8324e7e7cc5c30715cd8d5139110fe53182a94166456e6e5c121044cc1c5

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Fri, 08 May 2020 09:12:05 GMT
Server: Tengine
ETag: "5eb52265-4f210"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:43 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 324112
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_003.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 360 KB
361 KB 27ms
27ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_003.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: d4f8f618b5ea26d134f3a21ea4d754f43ee936d8517133b80dcb6e7dea6d618b

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:43 GMT
Last-Modified: Fri, 08 May 2020 09:12:05 GMT
Server: Tengine
ETag: "5eb52265-5a0d8"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:43 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 368856
X-Proxy-Cache: HIT

GET
H2 200 css
fonts.googleapis.com/ 5 KB
784 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:600,400

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

76c828df931848541d008f5df340db07e1fd29788cd50f9f86198c9c452fdc9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 May 2020 11:54:30 GMT
server: ESF
date: Fri, 08 May 2020 11:54:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 37 KB
7 KB 18ms
18ms Stylesheet
text/css 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 2900810
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 0295bc259e0000c2c2f3bda200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: W/"5afd4939-9226"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5902fc829e34c2c2-FRA
expires: Wed, 28 Apr 2021 11:54:30 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:600,400
Origin: https://safehaven.com

Response headers

date: Wed, 06 May 2020 00:50:17 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 212653
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Thu, 06 May 2021 00:50:17 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:600,400
Origin: https://safehaven.com

Response headers

date: Fri, 10 Apr 2020 08:39:52 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:44 GMT
server: sffe
age: 2430878
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Sat, 10 Apr 2021 08:39:52 GMT

GET
H2 200 fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ 75 KB
76 KB 38ms
21ms Font
application/octet-stream 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Origin: https://safehaven.com

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 8601045
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 77160
cf-request-id: 0295bc25e000000eafd6a9d200000001
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: "5afd4939-12d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5902fc830b2d0eaf-FRA
expires: Wed, 28 Apr 2021 11:54:30 GMT

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ Frame FED6 95 KB
40 KB 57ms
56ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:06:58 GMT
content-encoding: gzip
age: 46053
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: uEi8fI_npVwS8rFc4Lx47mlWV1QXG6Rqbn_apoBtIDkp406mzHitkw==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ Frame FED6 36 KB
13 KB 61ms
60ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 03:15:55 GMT
content-encoding: gzip
age: 1413516
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ow06pPPlZG2kgYUll20hdf9HB9IGGTbWmSLlW6aDiSfLhzw0nhv59g==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame FED6 107 KB
38 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39155
x-xss-protection: 0
server: cafe
etag: 18137084984814927362
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame FED6 74 KB
28 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28331
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ Frame A5AE 95 KB
40 KB 54ms
53ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:06:58 GMT
content-encoding: gzip
age: 46053
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: APx_M3DmK2XB0STHtBYbd8WSFU8MpydgXY-wbX-F6dmkvnidEH1lLQ==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ Frame A5AE 36 KB
13 KB 56ms
55ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 03:15:55 GMT
content-encoding: gzip
age: 1413516
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 8cYXPx3dhOGViAx-wvGC5WVoqrboq8pw80IcQIQzK4GrnSKmQonsXg==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A5AE 107 KB
38 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39155
x-xss-protection: 0
server: cafe
etag: 18137084984814927362
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame A5AE 74 KB
28 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28331
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ Frame BF17 95 KB
40 KB 50ms
49ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:06:58 GMT
content-encoding: gzip
age: 46053
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: rEuBbmXUvyE6qHW8NTdJDC6jPCQww56Yq8M41uQ2EU5W_v8Sp1SIHQ==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ Frame BF17 36 KB
13 KB 53ms
52ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 03:15:55 GMT
content-encoding: gzip
age: 1413516
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: WFnvoJB8AB8rwYxUE-gY1ZO3rn5Mx692G1JQlNCr1Xy9uTWeKau88Q==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame BF17 107 KB
38 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39155
x-xss-protection: 0
server: cafe
etag: 18137084984814927362
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame BF17 74 KB
28 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28331
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ Frame A078 95 KB
40 KB 45ms
31ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:06:58 GMT
content-encoding: gzip
age: 46053
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Vd2DOWm5nUuNbOfq5QqTR4uzXhJ4xzwXYFLLCt_6hCZoImNL0BuwpQ==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ Frame A078 36 KB
13 KB 45ms
31ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 03:15:55 GMT
content-encoding: gzip
age: 1413516
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: sCfGpiZ_j1sfVjBaHwGFmpas7f7n1j6f5OxudtOdxfYsRqxN4Aq2Eg==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A078 107 KB
38 KB 44ms
30ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39155
x-xss-protection: 0
server: cafe
etag: 18137084984814927362
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame A078 74 KB
28 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28331
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 bl-2a28c82-30fdb1af.js Show response
tagan.adlightning.com/math-aids/ Frame 55AD 95 KB
40 KB 48ms
34ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/bl-2a28c82-30fdb1af.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 07 May 2020 23:06:58 GMT
content-encoding: gzip
age: 46053
x-cache: Hit from cloudfront
status: 200
content-length: 40717
x-amz-meta-git_commit: 2a28c82
last-modified: Thu, 07 May 2020 23:03:03 GMT
server: AmazonS3
etag: "a1cfcb7a7a9eb92fc44067fa7040747c"
x-amz-version-id: KBxEgDVLhgkCX7nnqONQYUX36.Lhe3VZ
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 8UjMiUBEPYYQicDD4jMTREDyxLzwQNCtPkSdiLblEK3h-Hia8zOgRA==

GET
H2 200 b-0d4dfcb.js Show response
tagan.adlightning.com/math-aids/ Frame 55AD 36 KB
13 KB 45ms
32ms Script
application/javascript 52.222.182.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.222.182.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-108.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 03:15:55 GMT
content-encoding: gzip
age: 1413516
x-cache: Hit from cloudfront
status: 200
content-length: 12572
x-amz-meta-git_commit: 0d4dfcb
last-modified: Wed, 22 Apr 2020 03:14:44 GMT
server: AmazonS3
etag: "34462ea6330b72d722f58f107de6222c"
x-amz-version-id: TzIl1bIdgPnKW4fKc7hSFVBab94YVS9l
via: 1.1 8425e6875af3862b0f8a816b9812f408.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: JPQtCY3YE_qaWz5ohPYCgGUmylJ6ASNVnjWIV-XXrqxnzs7riNS6Sg==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 55AD 107 KB
38 KB 46ms
30ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 39155
x-xss-protection: 0
server: cafe
etag: 18137084984814927362
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 55AD 74 KB
28 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28331
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame FED6 0
0 60ms
60ms Fetch
image/gif 216.58.210.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss99La6pMDYbj9hohExlNMiLHCnwazYTr5BLWZ9FJTdK7cWYOtifSROiWN1cIBdRQUph6Iljyb6C6DW214UALA-cwnVyhSP-qK_2YNS5cNkZWMcVJYtAd0u00YQp3VCZLvq20gzp3tMm6e1RiKAkgwFWqtIRPh9ounCk3CB3T56lJPphZEXeQELcE9TTRPKQlMWc2dhXIulNKlzCSK2H0RZ6tXQQ2OHr-FneR5X6yCnslL5X55HYjbKcSh_w5n1jgDxy3OrixXTl9yzUMcxJvs&sai=AMfl-YSsQdDmtNAcQgFf6vaMTiTdR0UShiTAsxAlyS7db3aGN8M4DUN7Xy3AjsS3c1qcS-rAtVqdk2MwOOQZLmlifD3dzO_Atz6B8LH71tsvTw&sig=Cg0ArKJSzBoLk1lw6p4EEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
DATA 200
OK truncated
/ Frame FED6 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f62b8ba7ff68c1b348b28f19f72e5d85d24362bdfac47a12af5f8847923b4a44

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame A5AE 0
0 57ms
56ms Fetch
image/gif 216.58.210.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvkbRVr7s7anZH_8w3ihPWnUNk3BVFEYicYKeWx6NE1rFtiWPAtOwd86agpt7BfofNjEfgAsIQU6XginVg9md7Y94CdfSavb8KiDCIksQjNQ9Es8xu_G9ea5QbxDNxwopoM5Qv37A4yIC0z9BWj_UzyIgBPu3n4t0zP4abaReLUOl69jWURAr9DCvbsLWS9M0NOkDmzar41H-46AJwW1ps6WAZrYUVCd8C9s0mKaTZ7Z46FU4vOjSW5V853WstEmG08v40Lhmf1QdRRt7gbkag&sai=AMfl-YTTSda490rfFR320OwH8CGLCg_ltSmymgbc1n06HIvo5UbsrSOMfuXm4E_z3lNE_eN_DDDj21-5nTgpGb9GnfotiIRH6Rn3DSCGGuGRkw&sig=Cg0ArKJSzDR1hKQ2stKtEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
DATA 200
OK truncated
/ Frame A5AE 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81d335e65e261bdf0a46ce0eea224410d56ac117477cdf47953e1c9dd9702ac8

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame BF17 0
0 58ms
57ms Fetch
image/gif 216.58.210.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstLESET6pl_rnceL8jtPNH_c3ITaCbwrCxomCObD63-1Q7PgQegjMMiYXptKK62N9PAZgmkc2XHChyFEsF-SkJhN4YqvqxBxD3AscNV1-hyHIevi7w5687oYsuYrNyCgbPE-MaqUhop2dB_8grLRJktylaChKL4gCocJ7BpXOOZzWcljmDcM5rNsPPKnbQaY6NSydt4lkisgUb2GJD6HhW-sgJ4rZqagE61Oseuct8ChV8pP32rrzYkbHrfcyr3bVCzWmYFUXdNe65cSmkgAmpC&sai=AMfl-YSRZ73CdE_e0YpvBv0-lld4Sf1I1cL5pJhMtbqPtD6fsCL8P9Hp-yhQZnxAR4hoqeUp2rL1zvfFl99s4bY9vjZbnZC84sdy83l1ye6sJQ&sig=Cg0ArKJSzBm_KJbeBZerEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame BF17 221 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 424afe6282e8462db6d778789b536959f4d3d200dba4f914efbb93d68d267896

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame FED6 109 B
174 B 15ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame FED6 109 B
894 B 38ms
14ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/ Frame FED6 217 KB
82 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 83827
x-xss-protection: 0
server: cafe
etag: 14851109439880523126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200506/r20190131/ Frame E7A9 0
0 8ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200506/r20190131/zrt_lookup.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200506/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmfoplr5zIPy9CSVsH00JefnvnfwGyxdtdIIcyioUR4MA2MXfJ4aX23XLDt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 07 May 2020 02:45:55 GMT
expires: Thu, 21 May 2020 02:45:55 GMT
content-type: text/html; charset=UTF-8
etag: 4094386822458569044
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4444
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 119315
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame BF17 109 B
171 B 29ms
29ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame BF17 109 B
171 B 26ms
26ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/ Frame BF17 217 KB
82 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 83827
x-xss-protection: 0
server: cafe
etag: 14851109439880523126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame A5AE 109 B
171 B 16ms
14ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A5AE 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/ Frame A5AE 217 KB
82 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 83827
x-xss-protection: 0
server: cafe
etag: 14851109439880523126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame A078 0
0 59ms
58ms Fetch
image/gif 216.58.210.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssnwPyNEarPJGTP1GBkXUluhdYTrzS7Tnz157BpncwgYGJAvC4jhyyhhXR65HST_-yDjYIYuEJn3ayel-SoUl0SfvKEulyveLeFPhmMV13s_gXgSXcikDTcRVCVpiv4Ri1U0snBqML9QRCno2BWAZU9X4CjfmXPuEeODSq0ZRK982lH_Tv3EWS6mepHMBFWRE7XVEO59i2cACtiMak4OjuvyFj0h121GtvKV4KrQxDxXZk7L1swii8d88EILpSpvGfYPJ8HmN68vV1uqf3oog&sai=AMfl-YQfVKmlR5OdWmFMmVFq49MTiIAQXhiZoZkPT_HMn1VPGmyCjPUT_dirOVqQ_2f0UjJrbBSMpcAHCMiVfusXaUxl0NHY2KhmPE5sPDlM6Q&sig=Cg0ArKJSzGHMrR4XMpeKEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A078 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c48d65ba3188e65cf820360dc5e08e677d1a770d1cc848881c90d364268c102

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 55AD 0
0 59ms
59ms Fetch
image/gif 216.58.210.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuwtpQMaRdHTicMftGZyMSAOqIOrQWpk8earzRbdr_RHA2rydoJmMhDLzsW_Z9ijnbbKCfltFJDT_WCYzL5a0CcRujg9BOI7mXhL6iECGDaB4JTyFBaf42teRkNWucGiP4uYghHE3umwyfeJyfRlWgNs6DQ7oS_2PuSgkzkiHTJN-rNOvBgo6GuD3mRP9Trd6kaBfzlTE8dLY2cp49EYMmQGxCpF_rcRl174xCT97OVSM23jWAYqmPekMZ7YWrCkBPJSc2dObdhuV2JOCVR2g&sai=AMfl-YQweT6S0U6IOTb8ZD5-KU-_vJFLJ9j0mKxJuFTucNBBClnb7WW_GHz5XkBRCTsiUQkDRfdyWz2T3iwqNhZjY6kOGml_LCyXlKrBybVCnw&sig=Cg0ArKJSzPz6eVlsnLmMEAE&urlfix=1&adurl=

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 55AD 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e1049f1e8f14166773b8d4abe7b52e798244b813ddfa12f1448be0dc4d65467

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55953/ Frame 2163
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=346013c6-918e-4265-9b47-01bfd4fdeeca&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=346013c6-918e-4265-9b47-01bfd4fdeeca
https://ups.analytics.yahoo.com/ups/55953/sync?uid=346013c6-918e-4265-9b47-01bfd4fdeeca&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=346013c6-918e-4265-9b47-01bfd4fdeeca&apid=UPad4de458-9122-11ea...

0
977 B

100ms
50ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55953/sync?uid=346013c6-918e-4265-9b47-01bfd4fdeeca&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=346013c6-918e-4265-9b47-01bfd4fdeeca&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:31 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 08 May 2020 11:54:31 GMT
location: https://ups.analytics.yahoo.com/ups/55953/sync?uid=346013c6-918e-4265-9b47-01bfd4fdeeca&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=346013c6-918e-4265-9b47-01bfd4fdeeca&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 2163 43 B
794 B 133ms
42ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 2163
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1&verify=true
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

0
977 B

96ms
49ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:31 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 08 May 2020 11:54:31 GMT
location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDuMqvaTF4a-OLHIwN1XDIs&google_cver=1&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET

sync
sync.adap.tv/ Frame 2163
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?redir=https%3A%2F%2Fsync.adap.tv%2Fsync%3Ftype%3Dgif%26key%3Dtubemogul%26uid%3D%24%7BUSER_ID%7D&_test=XrVIdwAAAK3FCSTo
https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XrVIdwAAAK3FCSTo&_test=XrVIdwAAAK3FCSTo

0
0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame A078 109 B
171 B 16ms
16ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A078 109 B
171 B 15ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/ Frame A078 217 KB
82 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 83827
x-xss-protection: 0
server: cafe
etag: 14851109439880523126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 55AD 109 B
171 B 17ms
14ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 55AD 109 B
171 B 18ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=safehaven.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/ Frame 55AD 217 KB
82 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 83827
x-xss-protection: 0
server: cafe
etag: 14851109439880523126
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 34CB 0
0 313ms
313ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=9357229395&adk=309087674&adf=3173046727&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870705&bpp=19&bdt=355&idt=221&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=2&ga_vid=195935410.1588938871&ga_sid=1588938871&ga_hid=1998556362&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1068&ady=661&biw=1585&bih=1200&isw=300&ish=250&ifk=751659263&scr_x=0&scr_y=0&eid=21066085%2C618018086&oid=3&pvsid=2204820173202879&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&osd=1024&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.tp6s797vo89z&fsb=1&dtd=237

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=9357229395&adk=309087674&adf=3173046727&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870705&bpp=19&bdt=355&idt=221&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=2&ga_vid=195935410.1588938871&ga_sid=1588938871&ga_hid=1998556362&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1068&ady=661&biw=1585&bih=1200&isw=300&ish=250&ifk=751659263&scr_x=0&scr_y=0&eid=21066085%2C618018086&oid=3&pvsid=2204820173202879&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&osd=1024&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.tp6s797vo89z&fsb=1&dtd=237
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmfoplr5zIPy9CSVsH00JefnvnfwGyxdtdIIcyioUR4MA2MXfJ4aX23XLDt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 08 May 2020 11:54:31 GMT
server: cafe
content-length: 19034
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame FED6 73 KB
27 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 15DA 0
0 286ms
286ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=1547377351&adk=1247324859&adf=3173046725&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870735&bpp=2&bdt=367&idt=230&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=488931700.1588938871&ga_sid=1588938871&ga_hid=106280977&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2295&biw=1585&bih=1200&isw=300&ish=250&ifk=364837978&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=1257253655219770&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.8yw6bvfha8my&btvi=1&fsb=1&dtd=234

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=1547377351&adk=1247324859&adf=3173046725&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870735&bpp=2&bdt=367&idt=230&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=488931700.1588938871&ga_sid=1588938871&ga_hid=106280977&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=240&ady=2295&biw=1585&bih=1200&isw=300&ish=250&ifk=364837978&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=1257253655219770&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.8yw6bvfha8my&btvi=1&fsb=1&dtd=234
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmfoplr5zIPy9CSVsH00JefnvnfwGyxdtdIIcyioUR4MA2MXfJ4aX23XLDt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 08 May 2020 11:54:31 GMT
server: cafe
content-length: 19249
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame BF17 73 KB
27 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 2683 0
0 282ms
281ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=8782514321&adk=1231975816&adf=3173046726&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870763&bpp=2&bdt=402&idt=215&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=1714019922.1588938871&ga_sid=1588938871&ga_hid=897519680&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1068&ady=943&biw=1585&bih=1200&isw=300&ish=250&ifk=750481399&scr_x=0&scr_y=0&eid=21066085%2C410075106%2C423550200&oid=3&pvsid=3427640782275365&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.mlpykdsfzij&fsb=1&dtd=220

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8460394618887212&output=html&h=250&slotname=8782514321&adk=1231975816&adf=3173046726&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870763&bpp=2&bdt=402&idt=215&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=1714019922.1588938871&ga_sid=1588938871&ga_hid=897519680&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1068&ady=943&biw=1585&bih=1200&isw=300&ish=250&ifk=750481399&scr_x=0&scr_y=0&eid=21066085%2C410075106%2C423550200&oid=3&pvsid=3427640782275365&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.mlpykdsfzij&fsb=1&dtd=220
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmfoplr5zIPy9CSVsH00JefnvnfwGyxdtdIIcyioUR4MA2MXfJ4aX23XLDt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 08 May 2020 11:54:31 GMT
server: cafe
content-length: 19182
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame A5AE 73 KB
27 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:30 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 99FB 0
0 291ms
290ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=1978622193&adk=2047003747&adf=3173046724&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870884&bpp=3&bdt=509&idt=175&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=1662889790.1588938871&ga_sid=1588938871&ga_hid=1474869969&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=241&ady=1206&biw=1585&bih=1200&isw=728&ish=90&ifk=1506950742&scr_x=0&scr_y=0&eid=21065724%2C21066085%2C26835106&oid=3&pvsid=1067164234270628&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.slarmlt0txp0&btvi=1&fsb=1&dtd=180

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=1978622193&adk=2047003747&adf=3173046724&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870884&bpp=3&bdt=509&idt=175&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=1662889790.1588938871&ga_sid=1588938871&ga_hid=1474869969&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=241&ady=1206&biw=1585&bih=1200&isw=728&ish=90&ifk=1506950742&scr_x=0&scr_y=0&eid=21065724%2C21066085%2C26835106&oid=3&pvsid=1067164234270628&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.slarmlt0txp0&btvi=1&fsb=1&dtd=180
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmfoplr5zIPy9CSVsH00JefnvnfwGyxdtdIIcyioUR4MA2MXfJ4aX23XLDt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 08 May 2020 11:54:31 GMT
server: cafe
content-length: 22635
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame A078 73 KB
27 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:31 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame A129 0
0 273ms
272ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=7090869147&adk=109494614&adf=3173046723&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870896&bpp=3&bdt=515&idt=184&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=869663279.1588938871&ga_sid=1588938871&ga_hid=900229472&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3125&biw=1585&bih=1200&isw=728&ish=90&ifk=4249146180&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=3931375124158074&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.idmbzktvfia1&btvi=1&fsb=1&dtd=188

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8460394618887212&output=html&h=90&slotname=7090869147&adk=109494614&adf=3173046723&w=728&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fsafehaven.com%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1588938870896&bpp=3&bdt=515&idt=184&shv=r20200506&cbv=r20190131&ptt=9&saldr=aa&correlator=8476047108399&frm=23&ife=4&pv=1&ga_vid=869663279.1588938871&ga_sid=1588938871&ga_hid=900229472&ga_fc=0&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3125&biw=1585&bih=1200&isw=728&ish=90&ifk=4249146180&scr_x=0&scr_y=0&eid=21066085&oid=3&pvsid=3931375124158074&pem=311&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8212&bc=31&ifi=1&uci=1.idmbzktvfia1&btvi=1&fsb=1&dtd=188
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmfoplr5zIPy9CSVsH00JefnvnfwGyxdtdIIcyioUR4MA2MXfJ4aX23XLDt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 08 May 2020 11:54:31 GMT
server: cafe
content-length: 199
x-xss-protection: 0
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 55AD 73 KB
27 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1588787389460423"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27856
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:31 GMT

GET
H/1.1 200
OK w_640_004.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 351 KB
352 KB 29ms
28ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_004.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 0bffe3a273c7f7839ba27081fcf7b2f241db645c7e93f20a1260b89eee76ac00

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:44 GMT
Last-Modified: Fri, 08 May 2020 09:12:06 GMT
Server: Tengine
ETag: "5eb52266-57d98"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:44 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 359832
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_005.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 337 KB
338 KB 49ms
49ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_005.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: eae511396b0f23a63d0595139d59e1859ba49c47dbe160bd56a8f055e4ed8acf

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:44 GMT
Last-Modified: Fri, 08 May 2020 09:12:06 GMT
Server: Tengine
ETag: "5eb52266-5450c"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:44 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 345356
X-Proxy-Cache: HIT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame FED6 7 KB
6 KB 161ms
90ms XHR
application/json 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200506&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1175c4d0d738e9cbd46658e8f2d4fb60c731a58651f55336ad0eb553f169a57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5565
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 55AD 7 KB
6 KB 103ms
90ms XHR
application/json 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200506&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ff48319e02c46da6af2b530199aa0c74f62479971d470ab2a987384b3f824951

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5586
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame BF17 7 KB
5 KB 99ms
90ms XHR
application/json 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200506&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95ceed499962dbd18f915f95c866dcd2cfa722ca5732405824a4f9ac4806ea9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5513
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A5AE 7 KB
5 KB 21ms
18ms XHR
application/json 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200506&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52027456915703083916e16ee759a3b718ba91e2d71354ecad6635419b1a3a32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5537
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame FED6 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:31 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 55AD 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:31 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame BF17 14 KB
5 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:31 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame AA41 0
379 B 76ms
75ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=36&serverTime=1588938869&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54874de677&contentFileId=0&mediaPlayListId=0&cbuster=1588938871792&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Requested by: Host: safehaven.com
URL: https://safehaven.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:31 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 1327 0
0 18ms
4ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:47:16 GMT
expires: Sat, 08 May 2021 11:47:16 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 435
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A5AE 14 KB
5 KB 27ms
12ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:31 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 7625 0
0 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:47:16 GMT
expires: Sat, 08 May 2021 11:47:16 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 435
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame B1EF 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:47:16 GMT
expires: Sat, 08 May 2021 11:47:16 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 436
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 36DB 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:47:16 GMT
expires: Sat, 08 May 2021 11:47:16 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 436
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame FED6 42 B
178 B 41ms
38ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsulDKvlxllEUp6pEXceLo4zRvHL832p5uaa3uqPznnfEgA4b4IqJrMGbiU-nJRAt8fob2ChZAia_bqkcQycpz8eINzY-GeYjPCkc6hm7Uc&sig=Cg0ArKJSzIW7jcaNLBoWEAE&adk=814543115&tt=-1&bs=1585%2C1200&mtos=1160,1160,1160,1160,1160&tos=1160,0,0,0,0&p=661,1068,911,1368&mcvt=1160&rs=0&ht=0&tfs=518&tls=1589&mc=1&lte=0&bas=0&bac=0&met=ie&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1588938870358&dlt&rpt=492&isd=0&msd=0&ext&xdi=0&ps=1585%2C3645&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-11-11-11-0-0-0&tvt=1581&is=300%2C250&iframe_loc=https%3A%2F%2Fsafehaven.com%2F&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200506

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A078 7 KB
5 KB 19ms
17ms XHR
application/json 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200506&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200506/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

07bc87f134d4d702c225873a6a48c4eb1d88d80c96b5da95799adb98300536ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5532
x-xss-protection: 0

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame A5AE 42 B
110 B 80ms
79ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuDc2Utwly6WfZnyaJazSFhv_IupZkVSTV8BnANj0svQudlIHTgoBed9pXVoZlTgHN5Fp1CBkxT13PS5ffApg6IHP7aOU4kRKNiEO9ApJs&sig=Cg0ArKJSzFDSm5bwm99-EAE&adk=3046793618&tt=-1&bs=1585%2C1200&mtos=1084,1084,1084,1084,1084&tos=1084,0,0,0,0&p=943,1068,1193,1368&mcvt=1084&rs=0&ht=0&tfs=460&tls=1620&mc=1&lte=0&bas=0&bac=0&met=ie&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1588938870366&dlt&rpt=497&isd=0&msd=0&ext&xdi=0&ps=1585%2C3645&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-11-11-11-0-0-0&tvt=1612&is=300%2C250&iframe_loc=https%3A%2F%2Fsafehaven.com%2F&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200506

Requested by

Host: safehaven.com
URL: https://safehaven.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A078 14 KB
5 KB 65ms
65ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:32 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame B71D 0
0 6ms
5ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/b-0d4dfcb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:47:16 GMT
expires: Sat, 08 May 2021 11:47:16 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 436
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
5 KB 18ms
17ms XHR
application/json 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020043001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020043001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5151bb59f706422870c5e03f83630b3cfbd7225b0f7f50a3a15d5cec3b70c731

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 08 May 2020 11:54:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 5495
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 08 May 2020 11:54:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5456
x-xss-protection: 0
expires: Fri, 08 May 2020 11:54:32 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 23F8 0
0 8ms
7ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 08 May 2020 11:47:16 GMT
expires: Sat, 08 May 2021 11:47:16 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 436
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 57A4 0
0 128ms
27ms Document
text/html 72.247.225.17
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.17 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-17.deploy.static.akamaitechnologies.com
Software: nginx/1.9.13 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.9.13
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Sat, 08 May 2021 11:54:32 GMT
Date: Fri, 08 May 2020 11:54:32 GMT
Connection: keep-alive

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame B406 0
0 117ms
20ms Document
text/html 104.109.78.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.78.125 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Thu, 23 Apr 2020 20:31:59 GMT
Content-Encoding: gzip
Content-Length: 9125
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=36170
Expires: Fri, 08 May 2020 21:57:22 GMT
Date: Fri, 08 May 2020 11:54:32 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

pd
eu-u.openx.net/w/1.0/ Frame 68AB
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1

0
0

30ms
29ms

Document
text/html

34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.185.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://safehaven.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=c074d209-441d-0740-2054-59ffac34288b|1588938872
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=c074d209-441d-0740-2054-59ffac34288b|1588938872; Version=1; Expires=Sat, 08-May-2021 11:54:32 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1588938872|mOgikimWiygu; Version=1; Expires=Sat, 23-May-2020 11:54:32 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.185.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 08 May 2020 11:54:32 GMT
content-type: text/html
content-length: 373
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=c074d209-441d-0740-2054-59ffac34288b|1588938872; Version=1; Expires=Sat, 08-May-2021 11:54:32 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.185.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=1
date: Fri, 08 May 2020 11:54:32 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 1229 0
0 82ms
82ms Document
text/html 72.247.225.32
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.247.225.32 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-32.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; pi=159196:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Last-Modified: Tue, 14 Apr 2020 10:27:52 GMT
ETag: "13006b6-a4bb-5a33da6f1a023"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 15243
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=115336
Expires: Sat, 09 May 2020 19:56:48 GMT
Date: Fri, 08 May 2020 11:54:32 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 59DE
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

221ms
27ms

Document
text/html

205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/safehaven/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://safehaven.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://safehaven.com/

Response headers

Date: Fri, 08 May 2020 11:54:33 GMT
Connection: Keep-Alive
Cache-Control: max-age=31924
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx0000000000000175761a8-005eb473ad-351f149-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1588938873.dop045.pa1.t,1588938873.cds021.pa1.shn,1588938873.dop045.pa1.t,1588938873.cds030.pa1.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/56465/
Redirect Chain

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=
https://ups.analytics.yahoo.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20
https://pr-bh.ybp.yahoo.com/sync/adtech/UPad4de458-9122-11ea-b7d8-02b9a5a38c20?gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/56465/sync?uid=y-BUf4Al11lxnhdY.GXj4zZ2nKZ4neoCAfvmtr&_origin=0&nsync=0
https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-BUf4Al11lxnhdY.GXj4zZ2nKZ4neoCAfvmtr&_origin=0&nsync=0&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

0
1 KB

73ms
73ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-BUf4Al11lxnhdY.GXj4zZ2nKZ4neoCAfvmtr&_origin=0&nsync=0&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:33 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 08 May 2020 11:54:33 GMT
location: https://ups.analytics.yahoo.com/ups/56465/sync?uid=y-BUf4Al11lxnhdY.GXj4zZ2nKZ4neoCAfvmtr&_origin=0&nsync=0&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 109ms
22ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1Aabfeb898-9122-11ea-a6eb-121ea8d7377c&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 08 May 2020 11:54:32 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 81ms
80ms Image
image/gif 52.49.118.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.118.177 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-49-118-177.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:32 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=k-hokpK1PZ-L6G7FlOsnxJK_a5KL6G-Wnu7wMtll
https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=k-hokpK1PZ-L6G7FlOsnxJK_a5KL6G-Wnu7wMtll&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

0
1 KB

28ms
23ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=k-hokpK1PZ-L6G7FlOsnxJK_a5KL6G-Wnu7wMtll&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.106 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:54:33 GMT
Server: ATS/7.1.2.106
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 08 May 2020 11:54:33 GMT
location: https://ups.analytics.yahoo.com/ups/55965/sync?_origin=0&gdpr=1&uid=k-hokpK1PZ-L6G7FlOsnxJK_a5KL6G-Wnu7wMtll&apid=UPad4de458-9122-11ea-b7d8-02b9a5a38c20
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 a
www.googletagmanager.com/ 0
56 B 23ms
15ms Image
image/gif 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=AW-820290545&cv=1&v=3&t=t&pid=259924253&rv=4t0&es=1&e=gtm.load&eid=34&u=C&tc=1&z=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:33 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
status: 204
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 55AD 0
60 B 98ms
93ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200506&jk=3931375124158074&bg=!JySlJDxYc9EZYwcWZwgCAAACAVIAAAHHmQF7Y29i0Oh-c2ORmJjs-yzUiiXaboaum2bwFqCI3A0T9Ejo5bXrbS85wOjiRt-xDbgOHgt8-1_yZTHmMQKOJ1s4kJ54Vjxoj-Ly38LfVmETBvH3oNcWL4onrC1Q-00DPBIEOS4JyFT2vCWwtLXWAXm6PHJ2IgYkuMhFDmT1MIBHVGwhar7Kevvc15GBrqwOHhk6-_3SQ7Xmuds95dpJ-CHkNdUkrjTVXb2oUPRZmQLkvak0EhB5Fi8pv4mrizrQDhIZAFpvjOxKY0EuWytw6vUcTAqKPElqjPJWqvijE51DPUmHRNwUN0oP53tpfNWWiZSGlJAX2t30fpheNa8LVl1L3gymHLEmPx7HevVg6QjJZi_k6wIWiZci4TnQsnCUjGpJDmTcIigjwkeKPtuxAYsNZLUasV8YhoZSszJa355JaAb88f9jTucH_cxmsT5fLxjVjjB7m9PpCRSJiMgReAComgg42ukUq77OMPoAwQ2-ZD_FxAwtgnjpNv6UOQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5AE 0
58 B 79ms
78ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200506&jk=3427640782275365&bg=!OzilOCBYtNk__bpg0RoCAAACt1IAAABumQF7hWLeCS64IpWIYWBE0gD-VIYFXS58Y_XFiDWOngOs2ytl9LMo_QJHZr_WLc7JwOkJ-37_CcjWse4tKQQsZqxVGDxJn4_3g98TM-AhKvO4PoXBVscCroT3m3sbSnpo0_stEZKsSpRhlxoiAvwcmvE2g49DdWrZvfxz6e_Q4DjHsoWpei9-PXKbXM1OPikedYxibvHjcBMi0GaSGvdqlZhiEYQservM6S-DkCUpILCo5O9S3ci8svqyQzSgQSCOez2-GRxhbuehiIsiMjIDdSASBYcMXa0y8zaFhf6CU1AGXGu0PVYa7AR1UQne-sATRIYN0Grp5pTaiCmGmE8jngG2ic9DKFTKc7C18WRHVrfwpP0CrfetB7bUzMgH48T-RIuKi3bfm_-5RYrLc9Fz3qV_rdQtOaSUXp4wa-qllQVguLz4tls1OakA2mY89Oj69bnlSbT8iUUAMWusB4E9oeB05wa9CHAjZtNQfjkEe7SIqW2sCRebj28aV8Aymg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BF17 0
58 B 69ms
69ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200506&jk=1257253655219770&bg=!qKulq7NYrnlKIX1qNxQCAAADG1IAAAB0mQF796ye26AV-uVUYj7kMcs0OfEuGGUpoWrClCSBDajrX5QL9lA1AgAQaru5BSwEh_HvKfJc6LFLG_S4QkqQ5WqxnQvGUBBEPKpJ-xaauiu-_jvSpZJKU0iDOFB3sJ2YxHq1dv-QTsw4CeaapzrTMfHKODynWAzycONjLamasFNpWvDxJxjaV83RN8fYM-r7oG_pR5e48V18TMwJnSdpPWmkRcvAy7GpmDNRBBB1JnUQBrtuBYTf8gmFNe3l4MnSD2QsUsBLjowesG7bbQkuAlNGdxoO3YfDz4MpJT8fBxbYAAfoMYQK27khetmPAUf_dz9__tmYn0wCKjU4-5E3XOu6qUq-oBNZeGi3jc7nZsElZ8dcXI9-AGUA7dqH65_MO_3NNg80-kXWZ602ojLmIFpkhNSXF4uLqUgpbBuTjzsCN0hoBdVCMltrd6W0lbgqj-5cREiL1js1_zpX06TWV3pe57WXLcbd2D1byGofKcJWJ-iR4dAp9ika8qRroA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FED6 0
58 B 90ms
90ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200506&jk=2204820173202879&bg=!DA-lDxdYL0wJB0eHkB8CAAAD3VIAAADImQF7AHwVjQoPxO14JIcaxXojXt7xvL5H_yWY-eHb43ZUpKElijqTHN5QqtCYdt9WC_FR_DFmQYbAvcFbLsnNxmK_VtiJSwgbkzYPiKloB7pQkHqHULBbcHtBCC_YHV1z0m_beDXRVadwOxBN4Zn110EjYUZCTMqaX10u7OR5K3ZgKGdzX97rqUS91OjYo3jwMHAj8Fgj-59TT32jEJ_im5X4dpu-5w6yXUTrkUGj3EHHNW1MezcrZKAA6WnmiQWoE9GGkc5IBt_j6lnq_v5h2Ro2t8ZanUEQoK2IXBqdZNgQsxsBP4p9MDXOLZHYF1vjNL_pL8nCga6BXbgR-bjODewPzu9Ncqyh4yBz2eo7EgftOBsl3GH1zeLkqlpS7QWUrofhOpA9lw3UxiLjxvvFqiFNrAOB6oNa3Y5q7kiX7N3elKX4Kj2wq0tnoSUagE4aqptEg5Ky8CJo-wLRwMakEChdO89bpHcQRIGkQdep2bmMmb7HmfJ9ZvWssS1lpw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A078 0
58 B 178ms
97ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200506&jk=1067164234270628&bg=!wsGlwdlYADhQkDODG3ECAAACu1IAAAC8mQF7UNTqE3keP19Jrj7qg6OfoQV8UycI5AUP4rn5Bso5EgNH2zgUUoGZ4QWCWbYy2YfxUaTLk_xa7_95_msqnqBPaTqpvrwOrwbhtbEZ5L8v7qNte2da4d16R3S91BqtsLXGLRYpwJI-TtZ07zYScjyzXaIW0Q8JCYxQ4FqAL6krRdZVu6-ErtujV-yR88IRqJhwXtMNz_OVSNxspwdzapaC7qm19LYG_0AceAj8fywycszluJR3-09GFRlPbMNW_GFsJJ8whAse9dM6vuzP2PngvGsUTJVLOS_tobc_pHzENx1k5RmP11FddQiSnUwUFG2gq8e85cgALWHdagg8NmJUwucz9hEbg4qyBRB8MBTRBYd7x-OEuuXLwiWYh9aFiBAv4HwygcDmnAT1CJBuQ4slfZDX8pqjeTQu96BlgeDB4np5BCB48KLT-h6mQQuqsdivVC0cEPdhPsGywAQ8T6I6c5CS62U1PFDRqKufvJ-hjXbffy1eziQACyGSdQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 88ms
87ms Image
image/gif 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020043001&jk=1334791069031913&bg=!0NOl08tYAJ34IqBBYEcCAAABolIAAABWmQF1vR2Nlwiyji1FABh9puwePBxRdAnyNTGtRe6sxQorREJrVpLPPC-q0rRr10yVhJqPA7HJ_cHW9oe-ILU9dPMMXtcznveotWo79yY-48XX37-AQTqc4mqPedi1gEaE8coWCT8k0h2GIHpXqOI5YjFH6TdxIBUdUqJwTJoyqdtyP_hK52ALXE4m2tASXkfnEiTKoywKJGuZOqPKFqP13YYW3xduRnzTF9uKiTXRp1r0zf7Nv8EB6JX7d_rdv0FKhvlulI2mhLgjjK0DGNTbIF_V0aJOwOe7r0h5UBVsp0FB9_QkxzZ0bFKFK6zpn-GAWJkvU0BmRcRh1X8D76QsbBnsW9b5vQMtIn4NrxQSxeOvMF6hTMyM7zpYVBRkKwW1P0lpAq0X2XjYhw9J2BbAEFWfdtbBackRUHkJ58bEO7Ixnoc96-R9S6xXs2KwGN0qp_JFszc5t9tbaqE3CQY3yw3rs177WgrqDcN7UIhyppZB8NnX0ojmEw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 May 2020 11:54:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame AA41 0
379 B 30ms
29ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1588938869&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54874de677&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1588938874791&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:34 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_006.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 339 KB
340 KB 41ms
40ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_006.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 1cab0468a17863ff221f656527f6fa55d6d9190ab05f27d6603e082fae16bb50

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:50 GMT
Last-Modified: Fri, 08 May 2020 09:12:06 GMT
Server: Tengine
ETag: "5eb52266-54d20"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:50 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 347424
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame AA41 0
379 B 39ms
39ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1588938869&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54874de677&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1588938879542&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:39 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame AA41 0
379 B 36ms
36ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1588938869&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54874de677&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1588938879792&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:39 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_007.ts Show response
video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/ Frame 2163 344 KB
345 KB 41ms
40ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn13/video/users/hls/24485/video_5b4c8dbbc9a66557872002/vid5eb520d45c646066411871.mp4/w_640_007.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 68a006112d2811872b3b6b47e68c378280700a45c61bb3951deb632044b61f4f

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 08 May 2020 11:53:56 GMT
Last-Modified: Fri, 08 May 2020 09:12:07 GMT
Server: Tengine
ETag: "5eb52267-560f4"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Expires: Fri, 15 May 2020 11:53:56 GMT
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 352500
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ Frame AA41 0
379 B 35ms
32ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1588938869&s=98755&sta=0&x=400&y=291&vid_passDomain=safehaven.com&subId=safehaven.com&debugInformation=&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&csuuid=5eb54874de677&contentFileId=0&mediaPlayListId=0&dur=500&cbuster=1588938884791&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx / PHP/7.3.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://safehaven.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 08 May 2020 11:54:44 GMT
Content-Encoding: gzip
Server: nginx
Age: 0
X-Powered-By: PHP/7.3.17
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Type: text/html; charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: web.hb.ad.cpe.dotomi.com
URL: https://web.hb.ad.cpe.dotomi.com/s2s/header/24

Domain: sync.adap.tv
URL: https://sync.adap.tv/sync?type=gif&key=tubemogul&uid=XrVIdwAAAK3FCSTo&_test=XrVIdwAAAK3FCSTo

Verdicts & Comments Add Verdict or Comment

213 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 09:22:22	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-19 18:43:54	Name: IDE Value: AHWqTUmfoplr5zIPy9CSVsH00JefnvnfwGyxdtdIIcyioUR4MA2MXfJ4aX23XLDt
.safehaven.com/	1970-01-20 02:53:30	Name: __gads Value: ID=8021d4006e13677b:T=1588938869:S=ALNI_Mb3fLmeIhTGM2aUZOaE2LkQBOZRCg
.pubmatic.com/	1970-01-19 09:23:45	Name: pi Value: 159196:2
.ads.pubmatic.com/	1970-01-19 09:23:45	Name: KCCH Value: YES
.pubmatic.com/	1970-01-19 11:31:54	Name: KTPCACOOKIE Value: YES
.safehaven.com/	1970-01-19 11:31:54	Name: _fbp Value: fb.1.1588938869695.1822553194

24 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-300x250-ATF div-gpt-ad-1553475674669-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-300x250-BTF div-gpt-ad-1553475817787-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-300x250-BTF2 div-gpt-ad-1553475909622-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-728x90-ATF div-gpt-ad-1553475988342-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/layout.js(Line 288) Message: OpenX Slot defined for /192633929/safehaven-728x90-BTF div-gpt-ad-1553476044183-0
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/cmp.js(Line 3) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/safehaven/cmp.js(Line 3) Message: GDPR is not applicable, skipping initialization of CMP
console-api	log	(Line 3) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	(Line 3) Message: Initial Ad Load
console-api	log	(Line 3) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	(Line 3) Message: Amazon bids returned, count=5
console-api	log	(Line 3) Message: [object Object],[object Object],[object Object],[object Object],[object Object]
console-api	log	(Line 3) Message: pbjs bids returned
console-api	log	(Line 3) Message: gPBJSTimeoutTimer cleared
console-api	log	(Line 3) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	(Line 3) Message: sendAdserverRequest()
console-api	log	(Line 3) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: pbjs.getBidResponses:
console-api	log	(Line 3) Message: [object Object]
console-api	log	(Line 3) Message: gThisRefreshSlots=
console-api	log	(Line 3) Message: [object Object],[object Object],[object Object],[object Object],[object Object]
console-api	log	(Line 3) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	(Line 3) Message: console.groupEnd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.optmstr.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
aol-match.dotomi.com
ap.lijit.com
api.omappapi.com
c.amazon-adsystem.com
cdn.districtm.ca
cdn.districtm.io
cdn.pushcrew.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
connect.facebook.net
csync.loopme.me
d1o9e4un86hhpc.cloudfront.net
d2p6ty67371ecn.cloudfront.net
d2t794khe5w43b.cloudfront.net
d32r1sh890xpii.cloudfront.net
dmx.districtm.io
e.serverbid.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hbopenbid.pubmatic.com
ib.adnxs.com
live.sekindo.com
match.adsrvr.org
maxcdn.bootstrapcdn.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
qd.admetricspro.com
safehaven.com
safehaven.com.eu2.cas.ms
secure.adnxs.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
stats.g.doubleclick.net
sync.adap.tv
sync.serverbid.com
tagan.adlightning.com
teachingaids-d.openx.net
tpc.googlesyndication.com
ups.analytics.yahoo.com
video.sekindo.com
web.hb.ad.cpe.dotomi.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
sync.adap.tv
web.hb.ad.cpe.dotomi.com
104.109.78.125
104.16.68.69
13.225.87.9
134.209.131.220
138.201.34.178
172.217.18.162
172.217.22.98
18.194.51.59
18.195.193.185
185.33.221.13
185.64.189.112
2001:4de0:ac19::1:b:2a
205.185.216.10
206.189.254.17
216.58.210.2
23.111.11.100
2600:9000:2093:3400:10:4f52:7800:21
2600:9000:2093:8800:c:5250:79c0:21
2600:9000:21f3:b000:3:442:6dc0:21
2600:9000:21f3:d600:17:eca0:da80:21
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:10::6814:3677
2606:4700:3035::6812:2130
2606:4700::6810:85e5
2606:4700::6812:633c
2a00:1288:110:c305::8000
2a00:1450:4001:801::2001
2a00:1450:4001:808::2002
2a00:1450:4001:809::2008
2a00:1450:4001:809::200e
2a00:1450:4001:814::2003
2a00:1450:4001:814::200a
2a00:1450:4001:819::2004
2a00:1450:4001:81b::2002
2a00:1450:4001:81f::2003
2a00:1450:4001:824::200a
2a00:1450:400c:c08::9b
2a02:fa8:8806:16::1400
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.126.56.137
34.95.120.147
35.157.249.39
37.252.173.22
45.83.41.102
52.155.181.183
52.222.182.108
52.222.191.80
52.49.118.177
54.201.238.66
63.250.56.23
69.173.144.141
72.247.225.17
72.247.225.32
72.251.249.14
91.228.74.149
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
03f1965f652a75d06042e823a86b8b1a6502b78bafcf54169d6ea31db16bf441
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
064e739a77f7623ba98eb109804d6d70d0773ee7be25f8a7d72e580fff406aa4
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
07bc87f134d4d702c225873a6a48c4eb1d88d80c96b5da95799adb98300536ae
0875862efc0b3318a2104d27726d71f6f61d95a6e04ef6becb2793e66b2bc27a
0bffe3a273c7f7839ba27081fcf7b2f241db645c7e93f20a1260b89eee76ac00
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0ea010d71907be056fbb2dd60bab3bfe4fd1a5cd641a0193873adf35b03349ac
0fac0bb93602e6f7d448fab3c2e880bf4fd57a7774dd930c4e58865beca4598b
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
171894a550f393e07317cfe9b84ebffee8df2066ae0f0ffd89254a1491b0589c
173bf971478c26c62d39568f01aba75e836f04fe65b35d755803382abea7e5f5
18cada9261c4f9c200316900d6ab365a430781e234591b7032028bdb2bad7192
1cab0468a17863ff221f656527f6fa55d6d9190ab05f27d6603e082fae16bb50
1cb52a3455dcfa07ef31f21959e354a7af5105ce84414c3ad52d2ee6023afedb
203c53e92c4994351bfcb37003059ba3a9bd041580a8271e7881f03bbc061fcf
208b62c8cf463bdee0fcd3f38c706d7f28d0174d4e3d66f72d3257a62b9b7979
2531e515d47b88300e3c5e3a91d5d22a292bdfdb6cec2e6399090bd9545ba92c
264a11fdf4f64ded557368024f2b3aeb09624dcec58bd4bb79e62cc75431301b
267de44d3e0da48ea910544cc6ae698dc28c977de6cb7baf62a4913765f49a2b
26a445e5f69c9ee7552b52be4bf7293fd39ff7827562bc2d2a26aca7a2055142
2886cb37ae9565ff853f695f1dd901549ef29661d21f4a9633d544bf8dd7c757
29bb72af92ce3a332ed2315043b17307ae458d3e3b7e24db3bb47417d6e433f8
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c167f4042d1338b33e2822f3b3dca3646bffcac14747d934c50794192dc3c2b
2e14464924e0301cda997640b9918eb65cca0c896a4610e0b35101975b013adf
2f1dccde57c713fe154c8da92f8d4b312373c2a055a0a9d822c6042b0176eb8d
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
363a80d367e6658e72d918cd33f9481ce7929199a9858122b0dcc61dffa62fde
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
370f89f6ebcec94f6a529911989dc8cd601a3cf2795b36cc3b5ba92fae8af47d
39ac46b13bedb7f0fdf649e1b604d551d1070130f08b8bfe74583bde4cc4ebbd
39c537d92e962547f9c0a758e4a6e771868f03d77706c2dfef4c280917b94d91
3a82dd3a69c0367fe9a8840c5a1d82a217bf3cd39de013c5470b5af3f97dbcfd
3acdeaeb18b807080e6c02ec46fab5ad4fa4418b83e93f6df70df7b1fb8028cc
3acfaf30ee15f611aca350369b3d9837f1068656d0731b37fc851ef42e597538
3e1049f1e8f14166773b8d4abe7b52e798244b813ddfa12f1448be0dc4d65467
4008c399421c2f1282faf06b2631a925629c9fb9bdfa56b972bb8754d829be47
40fddc2a37b32e799d931b5bf87c338cc2eaf4be9591afb587e0ccb565f4fd65
424afe6282e8462db6d778789b536959f4d3d200dba4f914efbb93d68d267896
42b3fc91a1ad52d699828c32fab5b6c562dd9b6e7f287bd300b589a9f010a60a
4477dd6cbad78ef9acc3c17095843a20dd110fe9adccea64a6db0b87086fdd81
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4af00ba1a8bb2dd1374c5d434a9e0869343c8ea57922fdae7a53df4cf8bf40e4
4b30637258f1f3b45f943ca4c2f76af2bf1f1623d01f6481d378416137fe7842
4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f6a0f2ed3d7266da65abffc40108aff7ec33d6d63a020893de90235e66dc78f
5151bb59f706422870c5e03f83630b3cfbd7225b0f7f50a3a15d5cec3b70c731
52027456915703083916e16ee759a3b718ba91e2d71354ecad6635419b1a3a32
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
55e4d1770f37b9819d263396045786cf66706c25ef6c391ccabcc93a78c1f7b0
579d29f71b15657f86363fa09f655d4f41e3023e9601e46d81f56010eef88844
59c9876dfab909e1cfd023c09b8c5bd6582bdde070a6491a09becfcb3a3a9e89
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5bc933b959b44c9e7857cd2deb5582a422d5e00c775c8e2ddaf47f0ff00da464
5c48d65ba3188e65cf820360dc5e08e677d1a770d1cc848881c90d364268c102
5c8b3abfc048dad503e3e5a62c1518c4c0e933389e46f8339990b12c4deb9213
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5dd68f4f4c4774640e296023b641726007c8ac625b741a810dbaf147f26765f9
5fcfe016fdfa44faab867329d353024c109f4456d71b83a6bd07af118f0e9994
62e5d5f4a0db067e567962cfe7b9b938e4a0b6a7c5cc2c72f822caad1d5388f9
65a1850028118c64febbde9b109da293910bfff6ee261caf0087d3d3364359ba
68a006112d2811872b3b6b47e68c378280700a45c61bb3951deb632044b61f4f
698d12a9d9db36a7923a575fa49645417817d415d534c73592669d568d986d79
69a3831c082fc105b56c53865cc797fa90b83d920fb2f9f6875b00ad83a18174
6b97fd0db48d74d02455f6cd9b6568bd180c0b30024cae42bfd99ce99bfc9081
6d40fc6a27a558f6f09b142ba587591cfe9d4f86ab0fd015a0c39ae9fb90e8eb
6f7aa5dfd1c09d9e48906ac4a86bb8d2335685bd7dfaeff60005cfb7d4d257cc
70a78dd71a85c1895021f976541b5fdb7e1f345dbd0a17510b1a82ae354eec78
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e
761a8324e7e7cc5c30715cd8d5139110fe53182a94166456e6e5c121044cc1c5
76c828df931848541d008f5df340db07e1fd29788cd50f9f86198c9c452fdc9f
76e31e4a531b1b8d35570016e89fa8fdbf86f1ad8b47b5d487cd3b7528801b89
78635c958f3dc562b11ee005d4d129be4272ca39f5b4e9bd7216fdb457568747
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7c79ada16090cc7e94af116173695bfd88da9efe580f89749e1160ba9d49c54c
7d0492c66125b1c2bdc419641e41542857e7d90e323d355ee0b8bb268da121fb
813628535187fe19c6e20047ec1987cb69c53a0fdc33b3bec28d2876a683a6d9
81d335e65e261bdf0a46ce0eea224410d56ac117477cdf47953e1c9dd9702ac8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
856ebd974805a315c6419b50ff68e30ca94f384415d85af8c56cbb5479f3faa8
8c17613217b11da7589afe53aa138606274ad5c49d5638d5275b5ab4bbd76dcb
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
95ceed499962dbd18f915f95c866dcd2cfa722ca5732405824a4f9ac4806ea9c
95db8a9b223e23289fdaca9a64bceddf52771d09ab7fabf6f72fa450c414810e
9670ff323d7cf4d6cd9961af0cd668db30f323daf329e46f7bf809b1c57a84f9
968f52680af792b0d892af779cdfc6a197c35698450088340c6a471b2e056a7d
96a1afb1b91fa08558e5a5eb58c0497a7ae508c4d2134fda29fbb66df408168e
993ebc45d9927d420801f05819222e8cc1aa523187e4c0b290df02b23ce18093
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9dcdc83bf21b50a7a30e8628dc033e2505b134c8cd0dcf24823aed6534669d12
9f40f7297122393e1425eec62e78a75c3211f7ad3f6b09a356aa317fcedc2cf3
9fd5f476fa289f67e804b9fca21fa2e1ae9810822de27a38c56da91c6b78d3ad
a02e6cb846a5e7a2d7f10a40c60be5d5f6bf9f432e994e688990712714cd4eb0
a032bc143a0d78657b8ef39bd54084bfe9d5857f89cede4e17029bf6b7b08c91
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a4115b4822d48c991a72ad7dbe73639cd6c944d88be5fa82d18232061a1051ac
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a492f8c0fdbb910dbabf2370b67bcd120f5c82f974104e30c9307f152c2025c1
a837fab08c038562b05eb2eb81c1c340c8cd2762d2c43d5e3bb26c2980fc9bfb
a96de9b5cab3a965483ca1974e4c89f6e16b77ce6aa09ec9b58921a3da0778cd
aaf45a172ec90c76bcecd61c68d998c2256fe9b1700371e80011d1161c5ab629
ace61d80f3fe90bbb02ab328d9705b57a9c8a95d3a0bf6b4cd510d4dacd033df
adf125603b9b4fe53eac1f9b8b6e34932b732e162230648cb27a65805b25b3a1
af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674
b028c2df0b60ae6849af0ddee92ff49d080d5cf91041bae321397f5bb046d1e9
b1a2d80ef2c75d1545c4373db1b6e5c654d67ac1c30af5ff71be02e542b09ed9
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bb070f086a0c26ebfc69e0bb33174c73765f112e3fd90b2af727c3e4190db7a5
bcf391dd0b006a87698ac0894d71039d610480913d24fcdaa1f2fdeeeda943e3
bdaa0a5953cfaaf9abed9e2152ae1255928062363fc018c57575d5f39ee12e29
c1cfce5a4dacb4a40ca0c6a300bbff43d6ea6a8570e5dc2419b8c5e28f57a9a3
c54aa0d4f9dea350f780a74d277f1facff0094b5f23d62483ae9bb7354a29fe8
c73e66343b58de4ecf1646d9910e95de94f4286795ce2a2c7ed7efacf6b60e63
c73feb689d65c66e0eb6dfcf1425a9a3b5ef30545a0ef57b3c665fe7b2cbba53
c8b44595b56b3899377b8e6d50e2f5f314055225a82c5474dd12bae8a2911ebd
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
cfa4e01ee2a07488db230d93963d11698efc9547ab0e1d6704e835b2efa85617
d1175c4d0d738e9cbd46658e8f2d4fb60c731a58651f55336ad0eb553f169a57
d4f8f618b5ea26d134f3a21ea4d754f43ee936d8517133b80dcb6e7dea6d618b
d51666e314361b7739359e6e1a39bd50ef39c0fdc710171f3383df569fdc6dfc
d72afc407a3d6289f8150ea724ffd9ef215084236cfb6c831a3d91f136cda7ab
d847475ca969f76b8f8421c4150f23fbe5bef200839b80481b845a6ccdd6e86f
d862cadadddc152101f2e1af6231c6372567e7ea1937d6dc53e15cf51809f851
d8d4cd94814ce2f48eca1be92f88ed035ad47544d56d18b5b19f12ada7b33f08
d9c80f88c3b68f5aa70d72e6cc3ee2b63c7304ae2d7d5a0699b2fde98d4e1100
ddf9604b128e46ababf4e91b95c2689540832c6b24bdfedd8220703d20861273
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e78eb6051a41b3ff2fc7b969bfbe9bdd3092b705bb3fed550c85c8c3e7025293
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
eae511396b0f23a63d0595139d59e1859ba49c47dbe160bd56a8f055e4ed8acf
ebcbd416dce4983b194431a61a1b40209efab2f2a682ba19006edd2a941f20d5
edd957f03cd7adec3305a38fa243637525c02f35c6447970cb4bf24a0c148fa7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f005062f62e55ca808ee1eaf4920372d1173dfa35b1c52a64ee22de27cd8a458
f43d2cf395827366eb0b0ae06b9cc2446cd50b8cb198ad918bd550591c9e9571
f62b8ba7ff68c1b348b28f19f72e5d85d24362bdfac47a12af5f8847923b4a44
f7bdcb933969f77bef3dac4ee5e41653396b909ab675e532d27c92f3101a5d5c
f9dd535864c28f0f4812ac3892f23cdd50a304d542d290a10518b31df09bc62c
fc9cf76523d4d39854a29f001308a89ddd8bf418c0c6adfffeec81636ffca4a8
fde314f4cc8a99326eda2d7f1c197a14d5d6980fb26a11367283d4bc114e9e43
ff19bbcaf99454d1a98cfd97278720fbd79c883fdc225a23b0a616fdff7e5cf3
ff48319e02c46da6af2b530199aa0c74f62479971d470ab2a987384b3f824951

safehaven.com Open in urlscan Pro 54.201.238.66 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

262 Requests

99 %HTTPS

45 %IPv6

41 Domains

63 Subdomains

51 IPs

8 Countries

7991 kBTransfer

13549 kBSize

7 Cookies

3 Outgoing links

Page URL History

Redirected requests

262 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

safehaven.com Open in urlscan Pro
54.201.238.66 Public Scan

Screenshot
Live screenshot

Full Image

262
Requests

99 %
HTTPS

45 %
IPv6

41
Domains

63
Subdomains

51
IPs

8
Countries

7991 kB
Transfer

13549 kB
Size

7
Cookies

262 HTTP transactions
7 data transactions