www.afr.com Open in urlscan Pro
2a04:4e42::645 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Submission: On November 05 via api (November 5th 2022, 1:51:59 am UTC) from IT — Scanned from IT

Summary HTTP 217 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 70 IPs in 9 countries across 52 domains to perform 217 HTTP transactions. The main IP is 2a04:4e42::645, located in United States and belongs to FASTLY, US. The main domain is www.afr.com. The Cisco Umbrella rank of the primary domain is 189547.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on August 18th 2022. Valid for: a year.

This is the only time www.afr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	2a04:4e42::645 2a04:4e42::645	54113 (FASTLY) (FASTLY)
1	2a02:26f0:350... 2a02:26f0:3500:889::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:239... 2600:9000:2394:4a00:10:2964:9d00:21	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42:600... 2a04:4e42:600::645	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1 9	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	144.21.37.35 144.21.37.35	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
2	23.35.237.151 23.35.237.151	16625 (AKAMAI-AS) (AKAMAI-AS)
5	13.210.238.169 13.210.238.169	16509 (AMAZON-02) (AMAZON-02)
1	184.24.5.146 184.24.5.146	16625 (AKAMAI-AS) (AKAMAI-AS)
2 4	172.217.23.102 172.217.23.102	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::396	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	13.225.78.63 13.225.78.63	16509 (AMAZON-02) (AMAZON-02)
2	2a02:26f0:780... 2a02:26f0:780::5f65:3671	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a00:1288:80:... 2a00:1288:80:807::1	203220 () ()
1	146.75.116.157 146.75.116.157	54113 (FASTLY) (FASTLY)
1	2a02:26f0:780... 2a02:26f0:780::5f65:367a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	136.243.44.4 136.243.44.4	24940 (HETZNER-AS) (HETZNER-AS)
1 3	54.220.37.196 54.220.37.196	16509 (AMAZON-02) (AMAZON-02)
6	2600:9000:224... 2600:9000:2240:fa00:2:42d9:3100:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223c:2200:7:3896:c640:93a1	16509 (AMAZON-02) (AMAZON-02)
4	13.224.189.92 13.224.189.92	16509 (AMAZON-02) (AMAZON-02)
4	2001:4860:480... 2001:4860:4802:36::178	15169 (GOOGLE) (GOOGLE)
12	34.249.157.182 34.249.157.182	16509 (AMAZON-02) (AMAZON-02)
2	44.195.168.154 44.195.168.154	14618 (AMAZON-AES) (AMAZON-AES)
1	13.225.85.39 13.225.85.39	16509 (AMAZON-02) (AMAZON-02)
4 4	142.250.185.134 142.250.185.134	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
6	3.104.213.201 3.104.213.201	16509 (AMAZON-02) (AMAZON-02)
1	34.240.95.84 34.240.95.84	16509 (AMAZON-02) (AMAZON-02)
1	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:80b::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
1	18.66.2.12 18.66.2.12	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	13.224.189.10 13.224.189.10	16509 (AMAZON-02) (AMAZON-02)
6	13.224.189.123 13.224.189.123	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	34.253.119.106 34.253.119.106	16509 (AMAZON-02) (AMAZON-02)
1	15.236.176.210 15.236.176.210	16509 (AMAZON-02) (AMAZON-02)
2	34.250.104.41 34.250.104.41	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c07::9b	15169 (GOOGLE) (GOOGLE)
1 3	2600:9000:21f... 2600:9000:21f3:0:1e:a43d:b640:93a1	16509 (AMAZON-02) (AMAZON-02)
15	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
1	13.225.78.105 13.225.78.105	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	63.34.81.234 63.34.81.234	16509 (AMAZON-02) (AMAZON-02)
2	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
3 3	185.89.210.212 185.89.210.212	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::13	56396 (AMOBEE) (AMOBEE)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	88.221.168.201 88.221.168.201	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:21f... 2600:9000:21f3:f800:1d:667e:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1 1	151.101.194.49 151.101.194.49	54113 (FASTLY) (FASTLY)
2 2	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
1	54.204.132.72 54.204.132.72	14618 (AMAZON-AES) (AMAZON-AES)
1 1	34.199.0.186 34.199.0.186	14618 (AMAZON-AES) (AMAZON-AES)
2 2	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	3.125.70.222 3.125.70.222	16509 (AMAZON-02) (AMAZON-02)
13	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
1 1	212.82.100.182 212.82.100.182	34010 (YAHOO-IRD) (YAHOO-IRD)
2	3.104.232.90 3.104.232.90	16509 (AMAZON-02) (AMAZON-02)
3	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:20e... 2600:9000:20eb:c000:18:1fcd:351:7bc1	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1	34.204.152.211 34.204.152.211	14618 (AMAZON-AES) (AMAZON-AES)
3	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
2 2	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1 1	54.85.225.242 54.85.225.242	14618 (AMAZON-AES) (AMAZON-AES)
1	52.210.36.224 52.210.36.224	16509 (AMAZON-02) (AMAZON-02)
1	2607:ae80:5::149 2607:ae80:5::149	26558 (FREEWHEEL) (FREEWHEEL)
1	34.149.151.54 34.149.151.54	() ()
217	70

43 2a04:4e42::645 (United States)

ASN54113 (FASTLY, US)

www.afr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.ffx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.afr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:889::13b8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2394:4a00:10:2964:9d00:21 (United States)

ASN16509 (AMAZON-02, US)

d2uhnetoehh304.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::645 (United States)

ASN54113 (FASTLY, US)

api.afr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:828::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

news.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.21.37.35 (Amsterdam, Netherlands)

ASN31898 (ORACLE-BMC-31898, US)

fairfaxmedia.gscontxt.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.35.237.151 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-151.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.210.238.169 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-210-238-169.ap-southeast-2.compute.amazonaws.com

i.ffx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.24.5.146 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-24-5-146.deploy.static.akamaitechnologies.com

a304207300.cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.23.102 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f102.1e100.net

12281244.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
12393262.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-63.fra2.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:780::5f65:3671 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:80:807::1 (United Kingdom)

ASN203220 ()

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:780::5f65:367a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 136.243.44.4 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.4.44.243.136.clients.your-server.de

static-au.plista.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.220.37.196 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-220-37-196.eu-west-1.compute.amazonaws.com

secure-au.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure-dcr.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2240:fa00:2:42d9:3100:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:2200:7:3896:c640:93a1 (United States)

ASN16509 (AMAZON-02, US)

adc-js.nine.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.224.189.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-92.fra2.r.cloudfront.net

au-script.dotmetrics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 34.249.157.182 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.195.168.154 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-195-168-154.compute-1.amazonaws.com

10510523.collect.igodigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
nova.collect.igodigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.85.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-85-39.fra2.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.134 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.104.213.201 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-104-213-201.ap-southeast-2.compute.amazonaws.com

l.ffx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.240.95.84 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-95-84.eu-west-1.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.2.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-2-12.txl50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-10.fra2.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.224.189.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-123.fra2.r.cloudfront.net

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.119.106 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-119-106.eu-west-1.compute.amazonaws.com

fairfaxau.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.236.176.210 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

fairfaxau.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.250.104.41 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-104-41.eu-west-1.compute.amazonaws.com

nd.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:21f3:0:1e:a43d:b640:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

7875bd8cec82421e2902fdac676555a6.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-105.fra2.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.34.81.234 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-34-81-234.eu-west-1.compute.amazonaws.com

p1.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.212 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::13 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

d.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.168.201 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-168-201.deploy.static.akamaitechnologies.com

image5.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:f800:1d:667e:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

raazljxs9wqcwkjjgoxcckgqcctat1667613111.nuid.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

rtd.tubemogul.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.49 (United States) 2 redirects

ASN54113 (FASTLY, US)

rtd-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.204.132.72 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-132-72.compute-1.amazonaws.com

logx.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.199.0.186 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-199-0-186.compute-1.amazonaws.com

sync.adap.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.19.126 (Shahr, Iran, Islamic Republic Of) 2 redirects

ASN13335 (CLOUDFLARENET, US)

ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.125.70.222 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.182 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)
PTR: spcms.pbp.vip.ir2.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.104.232.90 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-104-232-90.ap-southeast-2.compute.amazonaws.com

adc.nine.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.209.240 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:c000:18:1fcd:351:7bc1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.204.152.211 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-152-211.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.245.213 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

dmpsync.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.85.225.242 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-225-242.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.36.224 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-36-224.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:ae80:5::149 (United States)

ASN26558 (FREEWHEEL, US)

dmp.v.fwmrm.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.149.151.54 (None, )

ASN- ()

p.afr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	google.com 1 redirects apis.google.com — Cisco Umbrella Rank: 172 news.google.com — Cisco Umbrella Rank: 6417 adservice.google.com — Cisco Umbrella Rank: 134 www.google.com — Cisco Umbrella Rank: 17 play.google.com — Cisco Umbrella Rank: 67	94 KB
31	afr.com www.afr.com — Cisco Umbrella Rank: 189547 api.afr.com — Cisco Umbrella Rank: 448299 p.afr.com	939 KB
26	ffx.io static.ffx.io — Cisco Umbrella Rank: 166102 i.ffx.io — Cisco Umbrella Rank: 154463 l.ffx.io — Cisco Umbrella Rank: 576238	100 KB
15	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	398 B
15	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 285 fairfaxau.demdex.net nd.demdex.net — Cisco Umbrella Rank: 176336	20 KB
15	doubleclick.net 7 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 264 12281244.fls.doubleclick.net — Cisco Umbrella Rank: 445665 googleads.g.doubleclick.net — Cisco Umbrella Rank: 66 12393262.fls.doubleclick.net — Cisco Umbrella Rank: 511757 ad.doubleclick.net — Cisco Umbrella Rank: 208 stats.g.doubleclick.net — Cisco Umbrella Rank: 166 cm.g.doubleclick.net — Cisco Umbrella Rank: 320	161 KB
13	imrworldwide.com 2 redirects secure-au.imrworldwide.com — Cisco Umbrella Rank: 59160 cdn-gl.imrworldwide.com — Cisco Umbrella Rank: 2094 secure-gl.imrworldwide.com — Cisco Umbrella Rank: 2078 secure-dcr.imrworldwide.com — Cisco Umbrella Rank: 2118 raazljxs9wqcwkjjgoxcckgqcctat1667613111.nuid.imrworldwide.com	87 KB
8	googlesyndication.com 7875bd8cec82421e2902fdac676555a6.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 131 tpc.googlesyndication.com — Cisco Umbrella Rank: 167	42 KB
6	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 3906	1 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	130 KB
4	yahoo.com 1 redirects sp.analytics.yahoo.com — Cisco Umbrella Rank: 1612 cms.analytics.yahoo.com — Cisco Umbrella Rank: 1577 ups.analytics.yahoo.com — Cisco Umbrella Rank: 407	2 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 815 www.linkedin.com — Cisco Umbrella Rank: 745 px4.ads.linkedin.com — Cisco Umbrella Rank: 7246	3 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 97	21 KB
4	dotmetrics.net au-script.dotmetrics.net — Cisco Umbrella Rank: 59751	39 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	280 KB
3	qualtrics.com zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com siteintercept.qualtrics.com — Cisco Umbrella Rank: 1467	24 KB
3	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 313	3 KB
3	google.it www.google.it — Cisco Umbrella Rank: 14967 adservice.google.it — Cisco Umbrella Rank: 41380	1 KB
3	nine.com.au adc-js.nine.com.au — Cisco Umbrella Rank: 192950 adc.nine.com.au — Cisco Umbrella Rank: 189579	24 KB
3	yimg.com s.yimg.com — Cisco Umbrella Rank: 617	13 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 889 script.hotjar.com — Cisco Umbrella Rank: 1168 vars.hotjar.com — Cisco Umbrella Rank: 1210	71 KB
3	moatads.com z.moatads.com — Cisco Umbrella Rank: 598 mb.moatads.com — Cisco Umbrella Rank: 892	87 KB
3	optimizely.com cdn.optimizely.com — Cisco Umbrella Rank: 844 a304207300.cdn.optimizely.com — Cisco Umbrella Rank: 295473 logx.optimizely.com — Cisco Umbrella Rank: 1616	91 KB
2	krxd.net 1 redirects usermatch.krxd.net — Cisco Umbrella Rank: 1882 beacon.krxd.net — Cisco Umbrella Rank: 774	530 B
2	3lift.com 2 redirects dmpsync.3lift.com — Cisco Umbrella Rank: 28479	761 B
2	casalemedia.com 2 redirects ssum.casalemedia.com — Cisco Umbrella Rank: 2021	2 KB
2	everesttech.net 2 redirects rtd-tm.everesttech.net — Cisco Umbrella Rank: 4110	651 B
2	pubmatic.com 2 redirects image5.pubmatic.com — Cisco Umbrella Rank: 91678	696 B
2	parsely.com cdn.parsely.com — Cisco Umbrella Rank: 3718 p1.parsely.com — Cisco Umbrella Rank: 3021	26 KB
2	igodigital.com 10510523.collect.igodigital.com — Cisco Umbrella Rank: 364062 nova.collect.igodigital.com — Cisco Umbrella Rank: 5802	3 KB
2	plista.com static-au.plista.com	17 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1420	5 KB
1	fwmrm.net dmp.v.fwmrm.net — Cisco Umbrella Rank: 17869	361 B
1	chartbeat.net ping.chartbeat.net — Cisco Umbrella Rank: 1349	201 B
1	advertising.com 1 redirects pixel.advertising.com — Cisco Umbrella Rank: 1774	331 B
1	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 1610	15 KB
1	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 1386	418 B
1	adap.tv 1 redirects sync.adap.tv — Cisco Umbrella Rank: 38310	361 B
1	tubemogul.com 1 redirects rtd.tubemogul.com — Cisco Umbrella Rank: 9853	267 B
1	rubiconproject.com token.rubiconproject.com — Cisco Umbrella Rank: 1059	214 B
1	turn.com 1 redirects d.turn.com — Cisco Umbrella Rank: 1546	402 B
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2868	256 B
1	omtrdc.net fairfaxau.sc.omtrdc.net	264 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 864	724 B
1	t.co t.co — Cisco Umbrella Rank: 507	377 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1975	157 B
1	bizographics.com sjs.bizographics.com — Cisco Umbrella Rank: 52421	690 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 950	15 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1879	8 KB
1	gscontxt.net fairfaxmedia.gscontxt.net — Cisco Umbrella Rank: 396190	2 KB
1	cloudfront.net d2uhnetoehh304.cloudfront.net	30 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 121	158 KB
217	52

	Domain	Requested by
20	www.afr.com	www.afr.com
15	www.facebook.com	www.afr.com
15	static.ffx.io	www.afr.com
13	play.google.com	www.gstatic.com
12	dpm.demdex.net	www.afr.com
10	api.afr.com	www.afr.com
9	news.google.com	1 redirects www.afr.com news.google.com www.gstatic.com
6	cdn.linkedin.oribi.io	snap.licdn.com
6	l.ffx.io	www.afr.com
6	cdn-gl.imrworldwide.com	www.afr.com cdn-gl.imrworldwide.com
5	adservice.google.com	www.afr.com 12281244.fls.doubleclick.net 12393262.fls.doubleclick.net securepubads.g.doubleclick.net
5	i.ffx.io	d2uhnetoehh304.cloudfront.net
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	www.gstatic.com	news.google.com www.gstatic.com
4	ad.doubleclick.net	4 redirects
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.afr.com
4	au-script.dotmetrics.net	www.afr.com au-script.dotmetrics.net
4	connect.facebook.net	www.afr.com connect.facebook.net
4	securepubads.g.doubleclick.net	www.afr.com securepubads.g.doubleclick.net
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	ib.adnxs.com	3 redirects
3	secure-gl.imrworldwide.com	1 redirects secure-au.imrworldwide.com www.afr.com
3	www.google.com	www.afr.com tpc.googlesyndication.com
3	s.yimg.com	www.afr.com s.yimg.com
2	dmpsync.3lift.com	2 redirects
2	siteintercept.qualtrics.com	zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com siteintercept.qualtrics.com
2	adc.nine.com.au	adc-js.nine.com.au
2	ssum.casalemedia.com	2 redirects
2	rtd-tm.everesttech.net	2 redirects
2	secure-dcr.imrworldwide.com	www.afr.com
2	image5.pubmatic.com	2 redirects
2	sp.analytics.yahoo.com	www.afr.com
2	nd.demdex.net	www.afr.com
2	px.ads.linkedin.com	2 redirects
2	www.google.it	www.afr.com
2	static-au.plista.com	www.afr.com static-au.plista.com
2	12393262.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	snap.licdn.com	www.afr.com snap.licdn.com
2	12281244.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	z.moatads.com	www.afr.com z.moatads.com
1	p.afr.com
1	dmp.v.fwmrm.net
1	beacon.krxd.net
1	usermatch.krxd.net	1 redirects
1	ping.chartbeat.net
1	ups.analytics.yahoo.com
1	pixel.advertising.com	1 redirects
1	static.chartbeat.com	www.afr.com
1	zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com	www.afr.com
1	cms.analytics.yahoo.com	1 redirects
1	ps.eyeota.net	1 redirects
1	sync.adap.tv	1 redirects
1	logx.optimizely.com	cdn.optimizely.com
1	rtd.tubemogul.com	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	raazljxs9wqcwkjjgoxcckgqcctat1667613111.nuid.imrworldwide.com	www.afr.com
1	token.rubiconproject.com	www.afr.com
1	d.turn.com	1 redirects
1	p1.parsely.com	www.afr.com
1	nova.collect.igodigital.com	www.afr.com
1	fonts.gstatic.com	news.google.com
1	vc.hotjar.io	script.hotjar.com
1	7875bd8cec82421e2902fdac676555a6.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.it	securepubads.g.doubleclick.net
1	stats.g.doubleclick.net	www.google-analytics.com
1	fairfaxau.sc.omtrdc.net	www.afr.com
1	fairfaxau.demdex.net	www.afr.com
1	px4.ads.linkedin.com	www.afr.com
1	www.linkedin.com	1 redirects
1	vars.hotjar.com	static.hotjar.com
1	analytics.twitter.com	www.afr.com
1	t.co	www.afr.com
1	script.hotjar.com	static.hotjar.com
1	alb.reddit.com	www.afr.com
1	mb.moatads.com	z.moatads.com
1	cdn.parsely.com	www.googletagmanager.com
1	10510523.collect.igodigital.com	www.googletagmanager.com
1	adc-js.nine.com.au	www.afr.com
1	secure-au.imrworldwide.com	1 redirects
1	sjs.bizographics.com	www.afr.com
1	static.ads-twitter.com	www.googletagmanager.com
1	static.hotjar.com	www.afr.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	www.redditstatic.com	www.googletagmanager.com
1	a304207300.cdn.optimizely.com	cdn.optimizely.com
1	fairfaxmedia.gscontxt.net	www.afr.com
1	apis.google.com	www.afr.com
1	d2uhnetoehh304.cloudfront.net	www.afr.com
1	www.googletagmanager.com	www.afr.com
1	cdn.optimizely.com	www.afr.com
217	90

This site contains links to these domains. Also see Links.

Domain
subscribe.afr.com
twitter.com
www.instagram.com
www.linkedin.com
www.facebook.com
www.corporatesubscriptions.com.au
www.nineforbrands.com.au
www.smh.com.au
www.theage.com.au
www.brisbanetimes.com.au
www.watoday.com.au
www.domain.com.au
www.drive.com.au
login.nine.com.au
professional.licensing-publishing.nine.com.au

Subject Issuer	Validity	Valid
nine.com.au COMODO RSA Organization Validation Secure Server CA	`2022-08-18` - `2023-08-18`	a year	crt.sh
cdn.optimizely.com DigiCert SHA2 Secure Server CA	`2021-12-24` - `2022-12-24`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.news.google.com GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.gscontxt.net DigiCert TLS RSA SHA256 2020 CA1	`2021-12-08` - `2022-12-08`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-11-27` - `2022-11-29`	a year	crt.sh
*.9pub.io Amazon	`2022-11-02` - `2023-12-01`	a year	crt.sh
*.cdn.optimizely.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-03` - `2023-06-07`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
www.redditstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-03` - `2022-12-30`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-08-14` - `2022-11-12`	3 months	crt.sh
*.hotjar.com Amazon	`2022-10-25` - `2023-11-23`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-10-17` - `2022-12-07`	2 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2022-09-08` - `2023-09-08`	a year	crt.sh
*.plista.com Thawte RSA CA 2018	`2022-04-04` - `2023-04-04`	a year	crt.sh
*.imrworldwide.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-04` - `2023-02-03`	a year	crt.sh
*.api.nine.com.au Amazon	`2022-07-16` - `2023-08-14`	a year	crt.sh
*.dotmetrics.net Amazon	`2022-09-23` - `2023-10-21`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
*.collect.igodigital.com Amazon	`2022-01-13` - `2023-02-11`	a year	crt.sh
*.parsely.com Amazon	`2022-06-05` - `2023-07-04`	a year	crt.sh
*.ninetech.dev Amazon	`2022-09-02` - `2023-10-01`	a year	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-05`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-03` - `2022-12-30`	6 months	crt.sh
www.google.com GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.google.it GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
linkedin.oribi.io Amazon	`2022-07-07` - `2023-08-06`	a year	crt.sh
*.sc.omtrdc.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-02-17` - `2023-03-07`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.hotjar.io Amazon	`2022-07-18` - `2023-08-16`	a year	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-08-09` - `2023-02-01`	6 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.nuid.imrworldwide.com Amazon	`2022-05-12` - `2023-06-10`	a year	crt.sh
logx.optimizely.com Amazon	`2022-07-24` - `2023-08-22`	a year	crt.sh
*.qualtrics.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2022-05-06` - `2023-06-03`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2021-12-01` - `2022-12-30`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-10-17` - `2023-01-09`	3 months	crt.sh
*.v.fwmrm.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-29` - `2022-12-30`	a year	crt.sh
px.nineanalytics.io GTS CA 1D4	`2022-10-31` - `2023-01-29`	3 months	crt.sh

This page contains 19 frames:

Primary Page: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Frame ID: 4FB2646E799DEB592587DA79A10F14F4
Requests: 149 HTTP requests in this frame

Frame: https://a304207300.cdn.optimizely.com/client_storage/a304207300.html
Frame ID: F16C39432FF1EF879AC60FAE7B7AF6F4
Requests: 1 HTTP requests in this frame

Frame: https://12281244.fls.doubleclick.net/activityi;dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Frame ID: 13D75883056FF22AFAB0D0AB054665AF
Requests: 2 HTTP requests in this frame

Frame: https://12393262.fls.doubleclick.net/activityi;dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6953109447522.248
Frame ID: 5CA36C79D3357881C4C8D61F0372070E
Requests: 2 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/z/src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=520148896139.343
Frame ID: D59D48CA690FB15A0C7AA0968E6FDDE8
Requests: 1 HTTP requests in this frame

Frame: https://z.moatads.com/hd09824092/iframe.html
Frame ID: 0BE50808BDDEB48754F012885D8F89EE
Requests: 1 HTTP requests in this frame

Frame: https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com
Frame ID: 1B08C7D333BF28E065CFB6B355EE1B58
Requests: 16 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-c6ca1c87e308a39aabb76b56ba54398b.html
Frame ID: 85800D4FF005F327F804F948123418C0
Requests: 1 HTTP requests in this frame

Frame: https://fairfaxau.demdex.net/dest5.html?d_nsid=0
Frame ID: 05B2B690E56770C38FBC5D48B6EE3A20
Requests: 11 HTTP requests in this frame

Frame: https://secure-gl.imrworldwide.com/storageframe.html
Frame ID: 99B67778280DBD126AFBDC7B3B459A89
Requests: 1 HTTP requests in this frame

Frame: https://7875bd8cec82421e2902fdac676555a6.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html
Frame ID: 190450A41F3FD20DD64DF8E2C5DA6330
Requests: 1 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 7ED67EB5D468A2EE6903CE158871CD66
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: A6A34DE01B3689728D5360848EB97D86
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 3C97A45A439E15CDDEF167F9F794787A
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: DE74FE291A53D31D68993E880A412CF3
Requests: 1 HTTP requests in this frame

Frame: https://adc.nine.com.au/?appNexusUid=2946786175838601581
Frame ID: 433717354F7601FAE4114822EA284E60
Requests: 1 HTTP requests in this frame

Frame: https://nd.demdex.net/dest5.html?d_nsid=0
Frame ID: E428260136FEFED95517801EC78431D6
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 0EDEF5C2DB7A75EE8787A3D4663C48B7
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 6366343BC95712D125700876983D8940
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Qantas CEO Alan Joyce books $4m incentive despite protest voteThe Australian Financial ReviewClose menuSearchExpandExpandExpandExpandExpandExpandExpandExpandExpandExpandExpandThe Australian Financial ReviewTwitterInstagramLinkedInFacebook

Detected technologies

Google Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/platform\.js

Chartbeat (Analytics) Expand

Overall confidence: 100%
Detected patterns

chartbeat\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

optimizely\.com.*\.js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

217
Requests

92 %
HTTPS

42 %
IPv6

52
Domains

90
Subdomains

70
IPs

9
Countries

2506 kB
Transfer

7781 kB
Size

68
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://subscribe.afr.com/?promote_channel=HI_HL_GNL&utm_source=afr.com&utm_medium=HouseInventory&utm_campaign=General&utm_content=HDR
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://subscribe.afr.com/?promote_channel=HI_PW_GNL
Title: Save 50% Now

Search URL Search Domain Scan URL

URL: https://twitter.com/FinancialReview
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.instagram.com/financialreview/
Title: Instagram

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/company/1628885
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/financialreview
Title: Facebook

Search URL Search Domain Scan URL

URL: https://subscribe.afr.com/?promote_channel=HI_FL_GNL&utm_source=afr.com&utm_medium=HouseInventory&utm_campaign=General&utm_content=FTR
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://www.corporatesubscriptions.com.au/?utm_source=afr_sub_lp&utm_medium=link&utm_campaign=corporate_subscriptions
Title: Corporate subscriptions

Search URL Search Domain Scan URL

URL: https://subscribe.afr.com/student-offer?promote_channel=HI_FL_STU&utm_source=FooterLink&utm_medium=HouseInventory&utm_campaign=Student
Title: Student subscriptions

Search URL Search Domain Scan URL

URL: https://www.nineforbrands.com.au/about/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.nineforbrands.com.au/media-kits/financial-review/
Title: Advertise

Search URL Search Domain Scan URL

URL: https://www.smh.com.au/
Title: The Sydney Morning Herald

Search URL Search Domain Scan URL

URL: https://www.theage.com.au/
Title: The Age

Search URL Search Domain Scan URL

URL: https://www.brisbanetimes.com.au/
Title: Brisbane Times

Search URL Search Domain Scan URL

URL: https://www.watoday.com.au/
Title: WAtoday

Search URL Search Domain Scan URL

URL: https://www.domain.com.au/
Title: Domain

Search URL Search Domain Scan URL

URL: https://www.drive.com.au/
Title: Drive

Search URL Search Domain Scan URL

URL: https://login.nine.com.au/privacy?client_id=afr
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://login.nine.com.au/terms?client_id=afr
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://professional.licensing-publishing.nine.com.au/C.aspx?VP3=CMS3&VF=Home
Title: Reprints & Permissions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 41

https://12281244.fls.doubleclick.net/activityi;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja HTTP 302
https://12281244.fls.doubleclick.net/activityi;dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Request Chain 48

https://12393262.fls.doubleclick.net/activityi;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6953109447522.248 HTTP 302
https://12393262.fls.doubleclick.net/activityi;dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6953109447522.248

Request Chain 52

https://secure-au.imrworldwide.com/v60.js HTTP 301
https://cdn-gl.imrworldwide.com/v60.js

Request Chain 63

https://ad.doubleclick.net/ddm/activity/src=6633783;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=520148896139.343 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=520148896139.343 HTTP 302
https://adservice.google.com/ddm/fls/z/src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=520148896139.343

Request Chain 80

https://news.google.com/swg/_/ui/v1/serviceiframe?_=463225&publicationId=afr.com HTTP 301
https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com

Request Chain 88

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D9724%252C3519914%26time%3D1667613111120%26url%3Dhttps%253A%252F%252Fwww.afr.com%252Fcompanies%252Ftransport%252Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&liSync=true&e_ipv6=AQLZ0xAoJLNBlwAAAYRFfLXr_TNxNqRb2n718QjcYULg4Vl60QoMAeNdkGPj-lOK49dyeA

Request Chain 113

https://ad.doubleclick.net/activity;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=1587715341.1667613111 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CLK6gPn2lfsCFY6MsgodYSUMJA;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=1587715341.1667613111 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CLK6gPn2lfsCFY6MsgodYSUMJA;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=*

Request Chain 136

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP 302
https://dpm.demdex.net/ibs:dpid=358&dpuuid=2946786175838601581

Request Chain 138

https://secure-gl.imrworldwide.com/cgi-bin/m?rnd=1667613111624&ci=f2&js=1&cg=0&ts=v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CE%24%3D!!t*8Wi_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-YHLM1%2B7Cex1YkaWe08ceLJHXkgPshLKyuz%2F4uhjkxPYPVB8OEV7WXRwEOC0dEk1CVCWz&rs=1-epp8RG4580cdYQ%3D%3D&sc=1&os=1-pA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&pcode=fairfaxheader492510264302&rx=495631879488&callback=MoatNadoAllJsonpRequest_19213284&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&sr=1600x1200&id=lstrg-07cb6dd6e20cd2a228e43f5cbb95d9d6 HTTP 302
https://secure-gl.imrworldwide.com/cgi-bin/m?rnd=1667613111624&ci=f2&js=1&cg=0&ts=v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CE%24%3D!!t*8Wi_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-YHLM1%2B7Cex1YkaWe08ceLJHXkgPshLKyuz%2F4uhjkxPYPVB8OEV7WXRwEOC0dEk1CVCWz&rs=1-epp8RG4580cdYQ%3D%3D&sc=1&os=1-pA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&pcode=fairfaxheader492510264302&rx=495631879488&callback=MoatNadoAllJsonpRequest_19213284&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&sr=1600x1200&id=lstrg-07cb6dd6e20cd2a228e43f5cbb95d9d6&ja=1

Request Chain 139

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjM2NTYzMjkvdC8y/url/https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D470%26dpuuid%3D%24!%7BTURN_UUID%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=470&dpuuid=7417747602365040016

Request Chain 148

https://image5.pubmatic.com/AdServer/usersync/usersync.html?predirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=466%26dpuuid=PM_UID&userIdMacro=PM_UID HTTP 302
https://dpm.demdex.net/ibs:dpid=466&dpuuid=%s

Request Chain 151

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MTM5NDE1NTUwMDM3NTY1ODI2MDQxMTk0MTY2MDgwOTUzOTQwOTc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENDgBugVyaEmCqn10jcesWg&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 154

https://rtd.tubemogul.com/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D HTTP 302
https://rtd-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D HTTP 302
https://rtd-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D&_test=Y2XBuAAAJ58t6gBa HTTP 302
https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y2XBuAAAJ58t6gBa

Request Chain 156

https://sync.adap.tv/demdex_user_sync HTTP 302
https://dpm.demdex.net/ibs:dpid=832&dpuuid=EUX6895644594180765557

Request Chain 158

https://ssum.casalemedia.com/usermatchredir?s=183607&cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__ HTTP 302
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__&s=183607&C=1 HTTP 302
https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y2XBt2xNv71ka0P8NDCCgAAA%26664

Request Chain 159

https://ps.eyeota.net/match?bid=6j5b2cv&uid=13941555003756582604119416608095394097&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Request Chain 162

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=13941555003756582604119416608095394097&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-b9HzexlE2pEYqraZzWYn_EjcVPtWEe9grLM-~A

Request Chain 188

https://ib.adnxs.com/getuid?https://adc.nine.com.au?appNexusUid=$UID HTTP 302
https://adc.nine.com.au/?appNexusUid=2946786175838601581

Request Chain 200

https://pixel.advertising.com/ups/28/sync?uid=13692555445124439504139511981616357387&_origin=1&redir=true HTTP 301
https://ups.analytics.yahoo.com/ups/28/sync?uid=13692555445124439504139511981616357387&_origin=1&redir=true

Request Chain 203

https://image5.pubmatic.com/AdServer/usersync/usersync.html?predirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=19566%26dpuuid=PM_UID&userIdMacro=PM_UID HTTP 302
https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s

Request Chain 205

https://dmpsync.3lift.com/getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://dmpsync.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://dpm.demdex.net/ibs:dpid=72352&dpuuid=3843851073705992210805&gdpr=0&gdpr_consent=

Request Chain 206

https://usermatch.krxd.net/um/v2?partner=adobe&id=13692555445124439504139511981616357387 HTTP 302
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=13692555445124439504139511981616357387

217 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja Show response
www.afr.com/companies/transport/ 179 KB
37 KB 330ms
283ms Document
text/html 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

22f872dc74c8877572311708159df69b6e85a646d0a773a697918f5e9e7ec805

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
accept-ranges: bytes
age: 0
cache-control: public, max-age=30
content-encoding: gzip
content-length: 37733
content-type: text/html; charset=utf-8
date: Sat, 05 Nov 2022 01:51:50 GMT
etag: W/"2cbb6-6KLDb4FNwQWG2nQBio081d4GcTg"
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
strict-transport-security: max-age=31536000
uber-trace-id: 7b1c5bbcddcc34ed:7b1c5bbcddcc34ed:0:0
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT
x-cache-hits: 2, 1
x-frame-options: sameorigin
x-served-by: cache-syd10143-SYD, cache-mxp6946-MXP
x-varnish-grace: none(fetch fresh)
x-xss-protection: 1; mode=block

GET
H2 200 polyfillsGlobal.e1623105753154fb06f7.legacy.js Show response
www.afr.com/assets/ 1 KB
767 B 16ms
15ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/polyfillsGlobal.e1623105753154fb06f7.legacy.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

290cafc1d0e290a6ed09095eec3d831770f273b85298c704df503e9d5a0f2dd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 240756
uber-trace-id: 6163610e2a1d9d2b:6163610e2a1d9d2b:0:0
x-cache: HIT, HIT
content-length: 538
x-served-by: cache-syd10123-SYD, cache-mxp6946-MXP
last-modified: Wed, 02 Nov 2022 06:29:58 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"4be-18437083e70"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 48, 2

GET
H2 200 europa.a7e61b848b00ee0cc80e.legacy.js Show response
www.afr.com/assets/ 42 KB
12 KB 16ms
16ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/europa.a7e61b848b00ee0cc80e.legacy.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

410d88728abf5cc4c86ffe9d6ca4fad8d1bf5c82b718869f5a2c50a6cd35ae64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 240778
uber-trace-id: d4f4430ed18987cd:d4f4430ed18987cd:0:0
x-cache: HIT, HIT
content-length: 12439
x-served-by: cache-syd10182-SYD, cache-mxp6946-MXP
last-modified: Wed, 02 Nov 2022 06:29:58 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"a79f-18437083e70"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 35, 2

GET
H2 200 13780390039.js Show response
cdn.optimizely.com/js/ 292 KB
89 KB 200ms
129ms Script
text/javascript 2a02:26f0:3500:889::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/13780390039.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:889::13b8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a8a6d62b3d32f3dcbd0868ded7f2e882d76fcee2d581415398adc61aa3b27807

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: I5rlhE8_hYrzUROC_vTO5nVcTa4ggMzx
content-encoding: gzip
date: Sat, 05 Nov 2022 01:51:50 GMT
strict-transport-security: max-age=15768000
x-amz-request-id: 3R637XV05V2BF08A
x-amz-server-side-encryption: AES256
x-amz-meta-revision: 3230
x-amz-replication-status: COMPLETED
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="25";dur=0,cdnip;desc="2a02:26f0:3500:889::13b8";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0
content-length: 90445
x-amz-id-2: SLp5v13efLteiRdA2hJAJKTmYEXUFv4BTfHd/acZjv6gXPKbrVZ2Kv2KR2r6iYRhQqHrboj8f6A=
last-modified: Wed, 05 Oct 2022 03:55:13 GMT
server: AmazonS3
etag: "d33ace8ccad8220947ce9a0c7c027925"
vary: Accept-Encoding
access-control-max-age: 86400
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 3d04c913526cf7025a2924051fcc8d34be0d0adf
static.ffx.io/images/$width_140%2C$height_140/t_crop_fill%2Cq_auto:best%2Cfl_any_format/ 8 KB
9 KB 73ms
34ms Image
image/png 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$width_140%2C$height_140/t_crop_fill%2Cq_auto:best%2Cfl_any_format/3d04c913526cf7025a2924051fcc8d34be0d0adf
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e259ce5f9c5928acd8a4814950b7085ce5519c2ca9fc97cc1131fbcb434160cc

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 924894
edge-cache-tag: 387435081334299528811599256101346320330,232319851822536097488195099314647301223,5f5f4219172da4ec8104790896b11172
cache-tag: 387435081334299528811599256101346320330,232319851822536097488195099314647301223,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-length: 8551
x-served-by: cache-mxp6966-MXP, cache-mxp6946-MXP
x-cld-skey: 387435081334299528811599256101346320330 232319851822536097488195099314647301223 5f5f4219172da4ec8104790896b11172
last-modified: Fri, 26 Mar 2021 03:02:58 GMT
server: cloudinary
x-timer: S1667613110.207153,VS0,VE1
etag: "a4097f8cd8b1ac2c6ed2f3c733ebd465"
vary: User-Agent
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 531fb332986693abb0d1f581638d0efb96382c4d
static.ffx.io/images/$zoom_0.135%2C$multiply_4%2C$ratio_1%2C$width_378%2C$x_191%2C$y_6/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/ 9 KB
10 KB 540ms
501ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.135%2C$multiply_4%2C$ratio_1%2C$width_378%2C$x_191%2C$y_6/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/531fb332986693abb0d1f581638d0efb96382c4d
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 87caefb9fb06a896d9a415f36342907f9a1563c46b338207697768578b453552

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 0
edge-cache-tag: 275354198640189517247426660787220998281,181030365117998226036994021353183426273,5f5f4219172da4ec8104790896b11172
cache-tag: 275354198640189517247426660787220998281,181030365117998226036994021353183426273,5f5f4219172da4ec8104790896b11172
x-cache: MISS, MISS
content-disposition: inline; filename="531fb332986693abb0d1f581638d0efb96382c4d.webp"
content-length: 9570
x-cld-skey: 275354198640189517247426660787220998281 181030365117998226036994021353183426273 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6923-MXP, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 05:27:49 GMT
server: cloudinary
x-timer: S1667613110.207290,VS0,VE486
etag: "b58c82f3f26fc4b45d9e17e7d1846a47"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0

GET
H2 200 vendorsReactRedux_client.f60fbcbb803f16bccc3c.chunk.js Show response
www.afr.com/assets/ 162 KB
51 KB 25ms
22ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/vendorsReactRedux_client.f60fbcbb803f16bccc3c.chunk.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

bae6f4ba8c378551c65ab6d766b94bf331b017b9d275790a141297bab8c21764

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87132
uber-trace-id: b88f30daa438f86d:b88f30daa438f86d:0:0
x-cache: HIT, HIT
content-length: 52416
x-served-by: cache-syd10161-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"28962-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 87, 2

GET
H2 200 vendorsHtmlparser2_client.422a7b277ce227c8be6f.chunk.js Show response
www.afr.com/assets/ 126 KB
40 KB 24ms
22ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/vendorsHtmlparser2_client.422a7b277ce227c8be6f.chunk.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

690ce2319c300a1b3b8f1a3264640fe917963d53a48f09b61677b0cb8a31025d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87122
uber-trace-id: db8378dd229601c9:db8378dd229601c9:0:0
x-cache: HIT, HIT
content-length: 40342
x-served-by: cache-syd10162-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"1f866-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none(fetch fresh)
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 119, 2

GET
H2 200 vendors_client.40f5ee1884f9182a7bb7.chunk.js Show response
www.afr.com/assets/ 1006 KB
287 KB 38ms
36ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

da052f369234699bc3db2d7484b1c2d8d546c7ed0d423145ec5a6318ce1e2118

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87040
uber-trace-id: ba701156a6af0c81:ba701156a6af0c81:0:0
x-cache: HIT, HIT
content-length: 293614
x-served-by: cache-syd10129-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"fb8fc-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none(fetch fresh)
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 102, 1

GET
H2 200 client.769f15100d9d7649fe39.js Show response
www.afr.com/assets/ 672 KB
166 KB 39ms
37ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/client.769f15100d9d7649fe39.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

81cbdc276e9a2b8607a20c3020a73465538c4f3119de40f72563be6b91bfb432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87132
uber-trace-id: 15d2175177e321ff:15d2175177e321ff:0:0
x-cache: HIT, HIT
content-length: 169664
x-served-by: cache-syd10168-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"a80d4-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 147, 1

GET
H2 200 StandardArticleTemplate.12ae1a73d3155653ec92.chunk.js Show response
www.afr.com/assets/ 104 KB
27 KB 37ms
35ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/StandardArticleTemplate.12ae1a73d3155653ec92.chunk.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

104a311a40dcc24006744eb0b31bd26a1bb3f7c1c805f013320336ac49de0911

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87111
uber-trace-id: fc302f0baacc9fcd:fc302f0baacc9fcd:0:0
x-cache: HIT, HIT
content-length: 27067
x-served-by: cache-syd10127-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"1a069-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 79, 2

GET
H2 200 client.769f15100d9d7649fe39.css
www.afr.com/assets/ 170 KB
28 KB 17ms
15ms Stylesheet
text/css 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/client.769f15100d9d7649fe39.css

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1111bb046c4dad330cde53241f07a128d28de0d4da7fea8e9aa26d0d8f4914e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87122
uber-trace-id: 8beabf1b3d96ad71:8beabf1b3d96ad71:0:0
x-cache: HIT, HIT
content-length: 27939
x-served-by: cache-syd10142-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"2a738-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 12, 2

GET
H2 200 StandardArticleTemplate.12ae1a73d3155653ec92.chunk.css
www.afr.com/assets/ 62 KB
10 KB 21ms
18ms Stylesheet
text/css 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/StandardArticleTemplate.12ae1a73d3155653ec92.chunk.css

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f6d9b08f6f1c48ccfc8f6ad4a587093ef81cdb753f6299b758ea62a2c2b749fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87143
uber-trace-id: 33541950d84b7313:33541950d84b7313:0:0
x-cache: HIT, HIT
content-length: 10466
x-served-by: cache-syd10165-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"f84e-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 99, 2

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 505 KB
158 KB 145ms
63ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

32865971bb6a23bcf03abe6002f701b47214f0b3b82f0e4ac60deeb6607b9e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 161315
x-xss-protection: 0
last-modified: Sat, 05 Nov 2022 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 05 Nov 2022 01:51:50 GMT

GET
H2 200 sp.js Show response
d2uhnetoehh304.cloudfront.net/2.11.0-patched/ 97 KB
30 KB 143ms
42ms Script
application/javascript 2600:9000:2394:4a00:10:2964:9d00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2uhnetoehh304.cloudfront.net/2.11.0-patched/sp.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2394:4a00:10:2964:9d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a3c78596628f7e53c40bbfd0e9eed225181c4c2933a6e051e8fa46c30b221d1f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 18 Dec 2021 18:27:30 GMT
content-encoding: gzip
via: 1.1 3bdef981159de9c713020c64476ba0e4.cloudfront.net (CloudFront)
last-modified: Mon, 05 Jul 2021 01:09:01 GMT
server: AmazonS3
x-amz-cf-pop: AMS1-P2
age: 27761061
etag: W/"80b7ca5bd7a7e17f33545663b8f8423f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000
x-amz-cf-id: reEgHNOzNDA1JH2uTeH3hQUExLmat4JFIQedGJy8TErPIQMlyZJidg==

GET
H2 200 9a774230.svg
www.afr.com/assets/ 3 KB
666 B 36ms
35ms Image
image/svg+xml 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.afr.com/assets/9a774230.svg

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

bcf86c48df6f76b921cce4d3b354c52312027494dbac002cf58ff39ca8593ff5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
date: Sat, 05 Nov 2022 01:51:50 GMT
age: 20079248
uber-trace-id: 3726581a696669d6:3726581a696669d6:0:0
x-cache: HIT, HIT
content-length: 460
x-served-by: cache-syd10137-SYD, cache-mxp6946-MXP
last-modified: Thu, 17 Mar 2022 03:49:49 GMT
etag: W/"bf5-17f95fef748"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-varnish-grace: none
accept-ranges: bytes
x-cache-hits: 15084, 2

GET
H2 200 suecanano-regular-webfont.woff2
www.afr.com/fonts/ 18 KB
18 KB 39ms
38ms Font
font/woff2 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/fonts/suecanano-regular-webfont.woff2

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a44fb6a26732b7892f2802aee69fb0413ecd26b508b5c79720a48c485f4889ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
date: Sat, 05 Nov 2022 01:51:50 GMT
age: 39532
uber-trace-id: 7bdd7113a5bb3c2b:7bdd7113a5bb3c2b:0:0
x-cache: HIT, HIT
content-length: 18020
x-served-by: cache-syd10175-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:07:00 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"4664-184402d4720"
x-frame-options: sameorigin
content-type: font/woff2
cache-control: public, max-age=86400
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 29, 2

GET
H2 200 suecahd-regular-webfont.woff2
www.afr.com/fonts/ 22 KB
23 KB 39ms
38ms Font
font/woff2 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/fonts/suecahd-regular-webfont.woff2

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

338140f080782dd9fc999b9c240cde15f599e7ffd10b3fd3d9085717d38ad8d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
date: Sat, 05 Nov 2022 01:51:50 GMT
age: 39469
uber-trace-id: 7d229d26fe8c14f:7d229d26fe8c14f:0:0
x-cache: HIT, HIT
content-length: 22968
x-served-by: cache-syd10178-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:06:59 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"59b8-184402d4338"
x-frame-options: sameorigin
content-type: font/woff2
cache-control: public, max-age=86400
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 66, 2

GET
H2 200 suecahd-regularitalic-webfont.woff2
www.afr.com/fonts/ 24 KB
24 KB 38ms
38ms Font
font/woff2 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/fonts/suecahd-regularitalic-webfont.woff2

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

fa84adaa52138db2f2ca946b1e3ce31105a39a9a1f1b5fb25ad456241c2d0e73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
date: Sat, 05 Nov 2022 01:51:50 GMT
age: 36005
uber-trace-id: efbf65ae70dc96a1:efbf65ae70dc96a1:0:0
x-cache: HIT, HIT
content-length: 24396
x-served-by: cache-syd10148-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:07:00 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"5f4c-184402d4720"
x-frame-options: sameorigin
content-type: font/woff2
cache-control: public, max-age=86400
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 43, 2

GET
H2 200 suecanano-semibold-webfont.woff2
www.afr.com/fonts/ 17 KB
18 KB 38ms
38ms Font
font/woff2 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/fonts/suecanano-semibold-webfont.woff2

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

85b23ef2b5d148948a0e393c8af051177f818b7fb18cda003998916666caabee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
date: Sat, 05 Nov 2022 01:51:50 GMT
age: 30050
uber-trace-id: b38cf70ef5f870a1:b38cf70ef5f870a1:0:0
x-cache: HIT, HIT
content-length: 17904
x-served-by: cache-syd10138-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:07:00 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"45f0-184402d4720"
x-frame-options: sameorigin
content-type: font/woff2
cache-control: public, max-age=86400
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 61, 65

GET
H2 200 suecahd-bold-webfont.woff2
www.afr.com/fonts/ 22 KB
22 KB 27ms
27ms Font
font/woff2 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/fonts/suecahd-bold-webfont.woff2

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2f1b3c20947609880fa669248919d46ad2b26b995cd8f7e2f3d764dff3e47bdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin

Request headers

Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Origin: https://www.afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
via: 1.1 varnish, 1.1 varnish
date: Sat, 05 Nov 2022 01:51:50 GMT
age: 39147
uber-trace-id: 4397bc315a16caf1:4397bc315a16caf1:0:0
x-cache: HIT, HIT
content-length: 22596
x-served-by: cache-syd10154-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:06:59 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"5844-184402d4338"
x-frame-options: sameorigin
content-type: font/woff2
cache-control: public, max-age=86400
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 97, 2

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 79 KB
27 KB 142ms
35ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/assets/europa.a7e61b848b00ee0cc80e.legacy.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

050d11df639f898653841637b53b863839a8f4ec169889d09102a205f98a5ebd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27352
x-xss-protection: 0
server: sffe
etag: "1384 / 912 of 1000 / last-modified: 1667599556"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 05 Nov 2022 01:51:50 GMT

GET
H2 200 dcd5fb21afcf1573e4b43a6036ca193b.sprite.svg Show response
www.afr.com/assets/svg/ 104 KB
38 KB 15ms
15ms XHR
image/svg+xml 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/svg/dcd5fb21afcf1573e4b43a6036ca193b.sprite.svg

Requested by

Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d40a30b3514e8d68293acf23fc30ce5c3706dc12e35d01398b0d371c94838a50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
date: Sat, 05 Nov 2022 01:51:50 GMT
age: 694878
uber-trace-id: f1dcda3e67b0d005:f1dcda3e67b0d005:0:0
x-cache: HIT, HIT
content-length: 38984
x-served-by: cache-syd10122-SYD, cache-mxp6946-MXP
last-modified: Fri, 28 Oct 2022 00:19:53 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"1a054-1841bf5a028"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 147, 2

GET
H2 200 0.0616a337932656ce206b.chunk.js Show response
www.afr.com/assets/ 235 KB
65 KB 17ms
16ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/0.0616a337932656ce206b.chunk.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/assets/client.769f15100d9d7649fe39.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cb57d1571f5f6066db04f2b96665052692382aa5eee2a8e77286ea2cc9d317b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87127
uber-trace-id: d6e3ea1b505ef543:d6e3ea1b505ef543:0:0
x-cache: HIT, HIT
content-length: 66174
x-served-by: cache-syd10150-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"3acf0-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 272, 1

GET
H2 200 71.3f0f4ac914a429db8cf2.chunk.css
www.afr.com/assets/ 3 KB
1 KB 17ms
17ms Stylesheet
text/css 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/71.3f0f4ac914a429db8cf2.chunk.css

Requested by

Host: www.afr.com
URL: https://www.afr.com/assets/client.769f15100d9d7649fe39.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d0e041b0ff4b76f99250a2beebd04d625207e604627703f3420045fc0478736d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87039
uber-trace-id: c889feca6c86ae22:c889feca6c86ae22:0:0
x-cache: HIT, HIT
content-length: 1192
x-served-by: cache-syd10179-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"cb7-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 232, 1

GET
H2 200 71.3f0f4ac914a429db8cf2.chunk.js Show response
www.afr.com/assets/ 162 KB
50 KB 18ms
18ms Script
application/javascript 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.afr.com/assets/71.3f0f4ac914a429db8cf2.chunk.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/assets/client.769f15100d9d7649fe39.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8d3daa16486c1201d63e7faca59f6a74fdc6f70d69454efe14fd3ebeed5d44ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
age: 87039
uber-trace-id: 6fae3f0b88353d2e:6fae3f0b88353d2e:0:0
x-cache: HIT, HIT
content-length: 50772
x-served-by: cache-syd10175-SYD, cache-mxp6946-MXP
last-modified: Fri, 04 Nov 2022 01:08:01 GMT
accept-ch: sec-ch-ua-model, sec-ch-ua-platform-version
etag: W/"28981-184402e3568"
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31557600
x-varnish-grace: none
permissions-policy: ch-ua-model=*, ch-ua-platform-version=*
accept-ranges: bytes
x-cache-hits: 239, 1

GET
H2 404 p5bvnc Show response
api.afr.com/api/content/v0/assets/ 41 B
271 B 775ms
724ms XHR
application/json 2a04:4e42:600::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/api/content/v0/assets/p5bvnc
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6ab6abd4d172d87657a928d55d0664ab2ef68e3c4ef0b9d189926bebabfde225

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10178-SYD, cache-mxp6971-MXP
date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 0
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: *
x-varnish-grace: none(fetch fresh)
accept-ranges: bytes
content-length: 61
x-cache-hits: 0, 0

GET
H2 404 p5bv7t Show response
api.afr.com/api/content/v0/assets/ 41 B
127 B 1071ms
1020ms XHR
application/json 2a04:4e42:600::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/api/content/v0/assets/p5bv7t
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6ab6abd4d172d87657a928d55d0664ab2ef68e3c4ef0b9d189926bebabfde225

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10138-SYD, cache-mxp6971-MXP
date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 0
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: *
x-varnish-grace: none(fetch fresh)
accept-ranges: bytes
content-length: 61
x-cache-hits: 0, 0

GET
H2 200 graphql Show response
api.afr.com/ 196 B
367 B 272ms
261ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20memberDetailsAndSubscriptions%20%7B%20memberDetails%20%7B%20error%20%7B%20message%20type%20%7B%20class%20%7D%20%7D%20member%20%7B%20profile%20%7B%20displayName%20email%20roles%20%7B%20accountId%20role%20%7D%20shortID%20type%20%7D%20%7D%20%7D%20memberSubscriptionDetails%20%7B%20error%20%7B%20message%20type%20%7B%20class%20%7D%20%7D%20subscription%20%7B%20entitlements%20plans%20%7D%20%7D%20%7D%20&operationName=memberDetailsAndSubscriptions&variables=%7B%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 714892f1fc598fef48b0331e7af69cdac69bfb2cec684d199b8650da4a278c75

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10131-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
vary: Origin, Accept-Encoding
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: private, max-age=0
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 196
x-cache-hits: 0, 0

GET
H2 200 graphql Show response
api.afr.com/ 165 B
259 B 281ms
272ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20Account%20%7B%20account%20%7B%20autoplay%20error%20%7B%20message%20type%20%7D%20location%20%7B%20postCode%20state%20suburb%20%7D%20onboarding%20%7B%20newsfeed%20tags%20%7D%20%7D%20%7D%20&operationName=Account&variables=%7B%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 07a7e43a30c29cd24df54879f4fc788b60a76962f3b3c5623717c19762240225

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10161-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
vary: Origin, Accept-Encoding
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: private, max-age=0
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 165
x-cache-hits: 0, 0

GET
H2 200 graphql Show response
api.afr.com/ 104 B
169 B 280ms
273ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20isAssetInSavedList(%24assetID%3A%20String!%2C%20%24brand%3A%20Brand!)%20%7B%20isAssetInSavedList(input%3A%20%7BassetID%3A%20%24assetID%2C%20brand%3A%20%24brand%7D)%20%7B%20isSaved%20error%20%7B%20message%20%7D%20%7D%20%7D%20&operationName=isAssetInSavedList&variables=%7B%22assetID%22%3A%22p5bvja%22%2C%22brand%22%3A%22afr%22%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 54b3121637851046e882df8591a9f2c4472adc2f0c39290cd583e9fccf1aace0

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10171-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:50 GMT
via: 1.1 varnish, 1.1 varnish
vary: Origin, Accept-Encoding
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: private, max-age=0
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 104
x-cache-hits: 0, 0

GET
H2 200 platform.js Show response
apis.google.com/js/ 54 KB
21 KB 110ms
35ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/assets/client.769f15100d9d7649fe39.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af788498d8b2bfa626b3a8af1d0a9d17e457ab7f6877e696eb6e0358ae566b16

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:51:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20986
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "17bf89514fddb71a"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Nov 2022 01:51:50 GMT

GET
H2 200 swg.js Show response
news.google.com/swg/js/v1/ 151 KB
47 KB 95ms
28ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/assets/client.769f15100d9d7649fe39.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98d219b71719a22544b086bde1ec538fd7678bdd8f11266db494bd619e59b08c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47451
x-xss-protection: 0
last-modified: Fri, 04 Nov 2022 22:30:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Sat, 05 Nov 2022 02:40:07 GMT

GET
H2 200 graphql Show response
api.afr.com/ 907 B
551 B 733ms
731ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20PaywallRuleQuery(%24context%3A%20PaywallRuleRequestContext!%2C%20%24story%3A%20PaywallRuleRequestStory!)%20%7B%20paywallRule(context%3A%20%24context%2C%20story%3A%20%24story)%20%7B%20error%20%7B%20message%20type%20%7B%20class%20%7D%20%7D%20rule%20%7B%20...RuleFragment%20%7D%20%7D%20%7D%20fragment%20RuleFragment%20on%20PaywallRuleData%20%7B%20meter%20%7B%20global%20%7D%20prompt%20%7B%20...PromptFragment%20%7D%20promptType%20swgPrompt%20%7B%20...SwgPromptFragment%20%7D%20%7D%20fragment%20PromptFragment%20on%20Prompt%20%7B%20callToAction%20countRemaining%20message%20style%20subscriptionURL%20title%20%7D%20fragment%20SwgPromptFragment%20on%20SWGPrompt%20%7B%20message%20subscriptionURL%20title%20%7D%20&operationName=PaywallRuleQuery&variables=%7B%22context%22%3A%7B%22alreadyMetered%22%3Afalse%2C%22currentMeterCount%22%3A0%2C%22referrer%22%3A%22%22%2C%22bypassURL%22%3A%22https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja%22%7D%2C%22story%22%3A%7B%22brand%22%3A%22AFR%22%2C%22categories%22%3A%5B%22Companies%22%2C%22Transport%22%5D%2C%22sponsored%22%3Afalse%2C%22tags%22%3A%5B%22Aviation%22%2C%22Qantas%20Airways%20Limited%22%2C%22Alan%20Joseph%20Joyce%22%2C%22Richard%20James%20Barr%20Goyder%22%2C%22AGM%20season%22%5D%2C%22type%22%3A%22ARTICLE%22%7D%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7456219e58132f5fb71f133c52b6871b53694402fb16f7f60586ac56711a9be7

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10161-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding, Origin
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: private, max-age=0
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 470
x-cache-hits: 0, 0

GET
H/1.1 200
OK channels.cgi Show response
fairfaxmedia.gscontxt.net/main/ 2 KB
2 KB 455ms
40ms Script
application/javascript 144.21.37.35
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://fairfaxmedia.gscontxt.net/main/channels.cgi?url=https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/europa.a7e61b848b00ee0cc80e.legacy.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 144.21.37.35 Amsterdam, Netherlands, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: /
Resource Hash: a7ba354697d9dcbd1116c8a8b5473f9bf6ce9b680d15c0ff29aa7143cf66f45a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Length: 2252
Content-Type: application/javascript

GET
H2 200 moatheader.js Show response
z.moatads.com/fairfaxheader492510264302/ 242 KB
84 KB 106ms
24ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/fairfaxheader492510264302/moatheader.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/europa.a7e61b848b00ee0cc80e.legacy.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: b1864744d73d4e0543e8b54d5fa0f9e2917bde5142e7f540572b05e0db62fba8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
last-modified: Wed, 02 Nov 2022 15:04:41 GMT
server: AmazonS3
x-amz-request-id: 4CPNA32P55GT2H6A
etag: "400a59cd35fee8d53cf021b6bde3e027"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=49102
accept-ranges: bytes
content-length: 85912
x-amz-id-2: 85Yf7VqzwlWO2GKHrVFt3hBxBF2+OEz4RoB/CXQ6xV6Lvs02xkRRhbJqaX/JboQbIZcnhGeTblE=

GET
H2 200 graphql Show response
api.afr.com/ 46 KB
9 KB 258ms
258ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20PageContentByPageType(%24brand%3A%20Brand!%2C%20%24pageType%3A%20PageType!%2C%20%24render%3A%20Render!)%20%7B%20pageContentByPageType(brand%3A%20%24brand%2C%20pageType%3A%20%24pageType%2C%20render%3A%20%24render)%20%7B%20contentUnits%20%7B%20assets%20%7B%20...AssetFragment%20sponsor%20%7B%20name%20%7D%20%7D%20config%20%7B%20heading%20headingLink%20%7D%20name%20%7D%20%7D%20%7D%20fragment%20AssetFragment%20on%20Asset%20%7B%20asset%20%7B%20about%20byline%20duration%20headlines%20%7B%20headline%20%7D%20live%20%7D%20assetType%20dates%20%7B%20firstPublished%20modified%20published%20%7D%20id%20featuredImages%20%7B%20landscape16x9%20%7B%20...ImageFragment%20%7D%20landscape3x2%20%7B%20...ImageFragment%20%7D%20portrait2x3%20%7B%20...ImageFragment%20%7D%20square1x1%20%7B%20...ImageFragment%20%7D%20%7D%20label%20tags%20%7B%20primary%3A%20primaryTag%20%7B%20...AssetTag%20%7D%20secondary%20%7B%20...AssetTag%20%7D%20%7D%20urls%20%7B%20...AssetURLs%20%7D%20%7D%20fragment%20AssetTag%20on%20AssetTagDetails%20%7B%20company%20%7B%20exchangeCode%20stockCode%20%7D%20context%20displayName%20id%20name%20shortID%20slug%20urls%20%7B%20canonical%20%7B%20brand%20path%20%7D%20published%20%7B%20afr%20%7B%20path%20%7D%20%7D%20%7D%20%7D%20fragment%20AssetURLs%20on%20AssetURLs%20%7B%20canonical%20%7B%20brand%20path%20%7D%20published%20%7B%20afr%20%7B%20path%20%7D%20%7D%20%7D%20fragment%20ImageFragment%20on%20Image%20%7B%20data%20%7B%20altText%20aspect%20autocrop%20caption%20cropWidth%20id%20offsetX%20offsetY%20zoom%20%7D%20%7D%20&operationName=PageContentByPageType&variables=%7B%22brand%22%3A%22AFR%22%2C%22pageType%22%3A%22article%22%2C%22render%22%3A%22WEB%22%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: f1b15bac6b0ac8792055088c7b5b402397063759313079f052f1abe039baee02

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10165-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 3
vary: Accept-Encoding, Origin
x-cache: HIT, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: public, max-age=30
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 9203
x-cache-hits: 7, 0

POST
H/1.1 200
OK tp2 Show response
i.ffx.io/com.snowplowanalytics.snowplow/ 2 B
435 B 1184ms
297ms XHR
text/plain 13.210.238.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ffx.io/com.snowplowanalytics.snowplow/tp2
Requested by: Host: d2uhnetoehh304.cloudfront.net
URL: https://d2uhnetoehh304.cloudfront.net/2.11.0-patched/sp.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.210.238.169 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-210-238-169.ap-southeast-2.compute.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Date: Sat, 05 Nov 2022 01:51:52 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: https://www.afr.com
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2

OPTIONS
H/1.1 200
OK tp2
i.ffx.io/com.snowplowanalytics.snowplow/ Frame 0
0 1254ms
298ms Preflight 13.210.238.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ffx.io/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.210.238.169 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-210-238-169.ap-southeast-2.compute.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://www.afr.com
Connection: keep-alive
Content-Length: 0
Date: Sat, 05 Nov 2022 01:51:51 GMT
Server: akka-http/10.0.9

GET
H2 200 pubads_impl_2022110101.js Show response
securepubads.g.doubleclick.net/gpt/ 380 KB
128 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce331bf5c6c5e330f399d37e697146dd66cbc23038c122adba0b3cd3b1fe2781

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 23:04:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10011
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 130882
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 08:35:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 04 Nov 2023 23:04:59 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 127 B
102 B 86ms
34ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.afr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

97244fdc464b19592f897622016af89b6d6923ee004b9d225d12010a09224578

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77
x-xss-protection: 0
expires: Sat, 05 Nov 2022 01:51:50 GMT

GET
H2 200 a304207300.html Show response
a304207300.cdn.optimizely.com/client_storage/ Frame F16C 3 KB
2 KB 612ms
421ms Document
text/html 184.24.5.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://a304207300.cdn.optimizely.com/client_storage/a304207300.html

Requested by

Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/13780390039.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.24.5.146 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-24-5-146.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

8b72c10e7cef9d58e030a96817fa2c3e896fa60311541d575d7d27c3c1b693bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=120
content-encoding: gzip
content-length: 994
content-type: text/html; charset=utf-8
date: Sat, 05 Nov 2022 01:51:51 GMT
etag: "24e9a7a7a886aa2c205f9363fa9e6e4d"
last-modified: Fri, 04 Nov 2022 22:55:55 GMT
server: AmazonS3
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="23";dur=0,cdnip;desc="184.24.5.146";dur=0,cdnmap;desc="a4728.x.akamaiedge.net";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-amz-id-2: 7b/8jVfdol8RIrJ/8//3i1E2L1vIuyu0LDr1CpcCxHewzpJvBd+T0O1gaMgCjPjDQzGEaJS0a0o=
x-amz-meta-pci_enabled: False
x-amz-replication-status: COMPLETED
x-amz-request-id: QJR7M5WSKNMS7C3Z
x-amz-server-side-encryption: AES256
x-amz-version-id: j.LNh4uTyJvhBdGqG7ZjnSGEcw8PBy04

GET
H3

200

activityi;dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqan... Show response
12281244.fls.doubleclick.net/ Frame 13D7
Redirect Chain

https://12281244.fls.doubleclick.net/activityi;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2F...
https://12281244.fls.doubleclick.net/activityi;dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww....

478 B
310 B

97ms
41ms

Document
text/html

172.217.23.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12281244.fls.doubleclick.net/activityi;dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f102.1e100.net

Software

cafe /

Resource Hash

a05c8438580b24666efb2d734df0e4d4543cfb5c38bad5f2ebc90d5f98d2fd79

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: br
content-length: 285
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12281244.fls.doubleclick.net/activityi;dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 164ms
15ms Script
application/javascript 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 0cdeaf8a5f6202e7647efd02bd6640bd176506a30513bf6275ea77cb8c2a59db

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Wed, 02 Nov 2022 15:46:36 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "72562224e3d15fb8bd8332a0cb359a4c"
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7395

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/AW-1006500043/ 2 KB
2 KB 187ms
41ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/AW-1006500043/?random=1667613110769&cv=11&fst=1667613110769&bg=ffffff&guid=ON&async=1&gtm=2wgb20&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&tiba=Qantas%20CEO%20Alan%20Joyce%20books%20%244m%20incentive%20despite%20protest%20vote&auid=1587715341.1667613111&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7db1145a7ec687b72f47d21b1e33e89cdebcedad75b5f37585470c3a3936001d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 948
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 103 KB
28 KB 172ms
32ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f896040524443394b8b1ba4fbd1de94be74378ab901e53b3b40c1323d1735143

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 05 Nov 2022 01:51:50 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27337
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: PoIViAaMbWYFMde3ByN73t4zaa97+rCENN5qyX04MM/R2u4VjbRARGAFZzQlBrziY6AjgXn+UTf6RdXTX2BMvw==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 hotjar-182799.js Show response
static.hotjar.com/c/ 5 KB
3 KB 197ms
58ms Script
application/javascript 13.225.78.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-182799.js?sv=6

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-63.fra2.r.cloudfront.net

Software

Resource Hash

108f3ee093be28b330bb270cec80a53d8edbb2fa55bd27b02770cc38c5580729

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 882f747f39885162595630c95dd0012c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
etag: W/64d1af8da03dbe2abff70613e859bbb5
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: ys-W0L7ZhxWqZfUuq7G4UC8iRSVtvZwvOKZ_OA_QE_mVMZSfVS51ZA==

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 997 B
639 B 164ms
25ms Script
application/x-javascript 2a02:26f0:780::5f65:3671
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:780::5f65:3671 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d2667aa38599ee0de5244f5ea6aa603484f9cbaf6fea5bfe67d9d15cc7daa731

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
last-modified: Tue, 01 Nov 2022 19:12:50 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=37136
accept-ranges: bytes
content-length: 471

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 354ms
116ms Script
application/javascript 2a00:1288:80:807::1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:50:41 GMT
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding: gzip
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
x-amz-request-id: 3BD12WWRX1HQV7XR
age: 71
x-amz-server-side-encryption: AES256
x-amz-id-2: fyj5vEcmDg1Z7GEaNFnGG10SNrJ5xoXPiN7PozO69dJ00G7KYWJrj3nxbP/roO0Kpja/WlgEtrg=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3

200

activityi;dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord... Show response
12393262.fls.doubleclick.net/ Frame 5CA3
Redirect Chain

https://12393262.fls.doubleclick.net/activityi;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;...
https://12393262.fls.doubleclick.net/activityi;dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdp...

451 B
283 B

115ms
47ms

Document
text/html

172.217.23.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12393262.fls.doubleclick.net/activityi;dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6953109447522.248?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f102.1e100.net

Software

cafe /

Resource Hash

2d5eb494a1667c93f703bf1ad8b2621bebd954d90e15b086757fb47131230f37

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: br
content-length: 258
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://12393262.fls.doubleclick.net/activityi;dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6953109447522.248?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 201ms
24ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 18:55:37 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100147-IAD, cache-fra-eddf8230125-FRA

GET
H2 200 insight.min.js Show response
sjs.bizographics.com/ 997 B
690 B 151ms
26ms Script
application/x-javascript 2a02:26f0:780::5f65:367a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:780::5f65:367a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d2667aa38599ee0de5244f5ea6aa603484f9cbaf6fea5bfe67d9d15cc7daa731

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 634
date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
last-modified: Tue, 01 Nov 2022 19:12:50 GMT
x-cdn: AKAM
x-edgeconnect-midmile-rtt: 0
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=74659
accept-ranges: bytes
content-length: 471

GET
H2 200 async.js Show response
static-au.plista.com/ 63 KB
17 KB 181ms
57ms Script
application/javascript 136.243.44.4
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static-au.plista.com/async.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

136.243.44.4 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.4.44.243.136.clients.your-server.de

Software

nginx /

Resource Hash

8cec4b0f3f90243f3acb7dfa8740e904bfab43a6c95d546731a119719b4eece6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-plista-versions: plista-plugin- libplista-php-0.0.0
date: Sat, 05 Nov 2022 01:51:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 varnish-v4
x-plista-node: plista853
age: 588
content-length: 16968
last-modified: Sat, 05 Nov 2022 01:42:01 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-varnish: 150537676 150161167
cache-control: public, must-revalidate, proxy-revalidate
accept-ranges: bytes
expires: Sun, 06 Nov 2022 01:42:02 GMT

GET
H2

200

v60.js Show response
cdn-gl.imrworldwide.com/
Redirect Chain

https://secure-au.imrworldwide.com/v60.js
https://cdn-gl.imrworldwide.com/v60.js

21 KB
7 KB

26ms
26ms

Script
application/javascript

2600:9000:2240:fa00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/v60.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Server: 2600:9000:2240:fa00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 117ed873640b992e38f34a0a761dd3e1cda6b3c24c9507bb3adc0323039f8ff1

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-amz-version-id: PmT0ztgo6pW7kPCi5f5AnKDRXRQLwscI
content-encoding: gzip
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
date: Fri, 04 Nov 2022 02:12:48 GMT
last-modified: Mon, 25 Jul 2022 13:33:52 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 85144
x-amz-server-side-encryption: AES256
etag: W/"3bad78b036ef952c6ace672b2251b459"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: rBPM2OYV04GRT9oMmR-qZkcPXXNdfHKj7COqpJvVuEA6tK206mL4Qg==

Redirect headers

location: https://cdn-gl.imrworldwide.com:443/v60.js
date: Sat, 05 Nov 2022 01:51:51 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2 200 ggcmb510.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 12 KB
5 KB 102ms
26ms Script
application/javascript 2600:9000:2240:fa00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:fa00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-amz-version-id: NtivJlRauH.fxC84SX74RUAW7dp_iyBj
content-encoding: gzip
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
date: Sat, 05 Nov 2022 01:10:53 GMT
last-modified: Wed, 28 Sep 2022 14:09:01 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 2459
x-amz-server-side-encryption: AES256
etag: W/"afa0d379b1e6e0a61fad577d0043ff26"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: sEQq1o4wkvaKac-WlwSwrvI66p8EZrS8LTk4ShNso6jDHNRjP0Fbbg==

GET
H/1.1 200
OK adc.js Show response
adc-js.nine.com.au/ 76 KB
23 KB 389ms
30ms Script
application/javascript 2600:9000:223c:2200:7:3896:c640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://adc-js.nine.com.au/adc.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:2200:7:3896:c640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 934d4d6010b2bfc6795c8212555ff307c8e883a8fa5f974f601773d4f17e156f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date: Sat, 05 Nov 2022 01:51:03 GMT
Content-Encoding: gzip
Via: 1.1 11e35514d631a9a9566fd489de935c06.cloudfront.net (CloudFront)
Last-Modified: Tue, 02 Mar 2021 06:12:51 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA56-P2
Age: 52
ETag: W/"23c4e4ce44af9dfacd823a16445bddda"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
X-Cache: Hit from cloudfront
Cache-Control: public, max-age=300
Connection: keep-alive
X-Amz-Cf-Id: squ3mUiV9M01uVraajk8ndeXVx8CP1HnN15I1iMSCqs947Zm-JwBmQ==

GET
H2 200 door.js Show response
au-script.dotmetrics.net/ 9 KB
4 KB 863ms
773ms Script
application/javascript 13.224.189.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://au-script.dotmetrics.net/door.js?d=www.afr.com&t=companies
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-92.fra2.r.cloudfront.net
Software: Kestrel /
Resource Hash: a302d1c675cc09580fb510a92bfc643b841f74fafb4c2733237d1774f00549a5

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: br
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
server: Kestrel
x-amz-cf-pop: FRA2-C1
etag: ".www.afr.com.companies.216.2022110501"
vary: Accept-Encoding
x-cache: Miss from cloudfront
p3p: policyref="https://au-script.dotmetrics.net/w3c/p3p.xml", CP="NOI DSP LAW CURa ADMa DEVa PSAa HISa OUR IND STA"
content-type: application/javascript
cache-control: private
x-amz-cf-id: mxF4rWXP8J30dqNmi4pScDb91Ch3WGP-AllGcvFXTS0ZnecSPwBVLQ==

GET
H2 200 graphql Show response
api.afr.com/ 15 KB
2 KB 290ms
290ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20FinancialStockRelatedQuotes(%24symbol%3A%20String!)%20%7B%20quoteFull%3A%20financialStockSummaryQuote(symbol%3A%20%24symbol)%20%7B%20...FinancialStockRelatedSummaryQuoteFragment%20%7D%20quoteHistory%3A%20financialStockHistoricalQuotes(%20interval%3A%20DAILY_1_YEAR%20symbol%3A%20%24symbol%20)%20%7B%20...FinancialStockRelatedHistoricalQuotesChartFragment%20%7D%20quoteIntradayTrades%3A%20financialStockHistoricalQuotes(%20interval%3A%20FIVE_MINUTES_1_DAY%20symbol%3A%20%24symbol%20)%20%7B%20...FinancialStockIntradayRelatedQuotesChartFragment%20%7D%20%7D%20fragment%20FinancialStockRelatedHistoricalQuotesChartFragment%20on%20FinancialStockHistoricalQuotesResponse%20%7B%20error%20%7B%20message%20type%20%7B%20class%20%7D%20%7D%20quotes%20%7B%20date%3A%20time%20close%20%7D%20%7D%20fragment%20FinancialStockIntradayRelatedQuotesChartFragment%20on%20FinancialStockHistoricalQuotesResponse%20%7B%20error%20%7B%20message%20type%20%7B%20class%20%7D%20%7D%20quotes%20%7B%20date%3A%20time%20salePrice%3A%20close%20%7D%20%7D%20fragment%20FinancialStockRelatedSummaryQuoteFragment%20on%20FinancialStockSummaryQuoteResponse%20%7B%20error%20%7B%20message%20type%20%7B%20class%20%7D%20%7D%20quote%20%7B%20last%3A%20lastPrice%20lastUpdated%3A%20providerUpdateTime%20open%3A%20openPrice%20previousClose%20%7D%20%7D%20&operationName=FinancialStockRelatedQuotes&variables=%7B%22symbol%22%3A%22ASX_QAN%22%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8c08ae8d2532333ec1b09ab09cf176842b1f770ad9000e583cb96b90b0784e07

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10144-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 0
vary: Accept-Encoding, Origin
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: public, max-age=60
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 1782
x-cache-hits: 0, 0

GET
H3 200 swg-button.css
news.google.com/swg/js/v1/ 21 KB
6 KB 100ms
25ms Stylesheet
text/css 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-button.css

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c429b056c18833dd3d7fe28ab8ba904526ad1375398ffac0a0e4f2d278e1ac43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:03:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2899
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6458
x-xss-protection: 0
last-modified: Wed, 02 Nov 2022 19:15:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Sat, 05 Nov 2022 01:53:31 GMT

GET
H3 200 loader.svg
news.google.com/swg/js/v1/ 0
1 KB 55ms
29ms Other
image/svg+xml 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/loader.svg

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:48:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 200
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1049
x-xss-protection: 0
last-modified: Mon, 16 Mar 2020 18:14:05 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: image/svg+xml
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Sat, 05 Nov 2022 02:38:30 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 64ms
15ms Script
text/javascript 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 05 Nov 2022 01:01:23 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 3028
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Sat, 05 Nov 2022 03:01:23 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
2 KB 276ms
54ms XHR
application/json 34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=BEB5C8A15492DB600A4C98BC%40AdobeOrg&d_nsid=0&ts=1667613110901

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

abcf1f6bf18be92a1da8a7f69cb947bbd24766f153e97dfe89429497292c2043

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v045-0ff225fd5.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: yne8kcg8SZI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.afr.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 875
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 collect.js Show response
10510523.collect.igodigital.com/ 8 KB
2 KB 418ms
120ms Script
application/javascript 44.195.168.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://10510523.collect.igodigital.com/collect.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.195.168.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-195-168-154.compute-1.amazonaws.com
Software: /
Resource Hash: 463faad63e59f653f8367ca1bd38629a240ebd4f2165c313e660933acc322b04

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
last-modified: Fri, 04 Nov 2022 06:27:24 GMT
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 p.js Show response
cdn.parsely.com/keys/afr.com/ 72 KB
25 KB 102ms
30ms Script
application/javascript 13.225.85.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/afr.com/p.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NN4PPKH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.85.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-85-39.fra2.r.cloudfront.net
Software: nginx /
Resource Hash: c99bb554f568a8bfa9c4ebf178407e1fe47e531cd6f1a8f520d3b5c6942deb50

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: public
date: Fri, 04 Nov 2022 04:14:41 GMT
content-encoding: gzip
via: 1.1 6c9a2d99a25484f38efa27d58a726b2c.cloudfront.net (CloudFront)
last-modified: Mon, 04 Apr 2022 21:02:58 GMT
server: nginx
x-amz-cf-pop: FRA2-C2
age: 77830
etag: W/"624b5d02-11f4e"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400, public
x-amz-cf-id: aW7lrCs5EgNuGoxCPYD98ZRXIfF5l-cAZfRHy9RkHaXUFl6O7vCvCw==
expires: Sat, 05 Nov 2022 04:14:41 GMT

GET
H2

200

src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja;dc_l... Show response
adservice.google.com/ddm/fls/z/ Frame D59D
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=6633783;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvj...
https://ad.doubleclick.net/ddm/activity/src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-d...
https://adservice.google.com/ddm/fls/z/src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-de...

42 B
107 B

124ms
63ms

Document
image/gif

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/z/src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=520148896139.343

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 42
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://adservice.google.com/ddm/fls/z/src=6633783;dc_pre=CLOK7Pj2lfsCFcrFsgodWBMIbg;type=afral0;cat=au_af0;u1=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=520148896139.343
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200
OK / Show response
l.ffx.io/ 2 B
417 B 353ms
292ms XHR
text/plain 3.104.213.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.ffx.io/
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.213.201 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-213-201.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json

Response headers

Date: Sat, 05 Nov 2022 01:51:52 GMT
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Length: 2

OPTIONS
H/1.1 204
No Content /
l.ffx.io/ Frame 0
0 1208ms
286ms Preflight 3.104.213.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.ffx.io/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.213.201 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-213-201.ap-southeast-2.compute.amazonaws.com
Software: nginx/1.15.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 0
Date: Sat, 05 Nov 2022 01:51:51 GMT
Server: nginx/1.15.9

GET
H3 200 entitlements Show response
news.google.com/swg/_/api/v1/publication/afr.com/ 2 B
58 B 95ms
85ms Fetch
application/json 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/_/api/v1/publication/afr.com/entitlements

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: text/plain, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientHttp/cspreport
content-encoding: gzip
content-disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.afr.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 v2 Show response
mb.moatads.com/yi/ 537 B
710 B 250ms
77ms Script
text/html 34.240.95.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CE%24%3D!!t*8Wi_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-YHLM1%2B7Cex1YkaWe08ceLJHXkgPshLKyuz%2F4uhjkxPYPVB8OEV7WXRwEOC0dEk1CVCWz&rs=1-epp8RG4580cdYQ%3D%3D&sc=1&os=1-pA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&pcode=fairfaxheader492510264302&rx=495631879488&callback=MoatNadoAllJsonpRequest_19213284
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/fairfaxheader492510264302/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.240.95.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-95-84.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: e4233cd36263120f7994dd660cf38faa774f2cf40285016f1aa0c389ebb1ded5

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "26ed845d58ee061a223819c3d8057ac1edd10c10"
content-length: 537
content-type: text/html; charset=UTF-8

GET
H2 200 iframe.html Show response
z.moatads.com/hd09824092/ Frame 0BE5 1 KB
2 KB 26ms
24ms Document
text/html 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/hd09824092/iframe.html
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/fairfaxheader492510264302/moatheader.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 49d65831c7e98a7d885d223699a41198204329efff9d1904c8af71323f613d68

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=1818
content-length: 1374
content-type: text/html
date: Sat, 05 Nov 2022 01:51:50 GMT
etag: "4a9cbc2e5bc164313dace42a58bef141"
last-modified: Tue, 26 Jan 2021 22:41:39 GMT
server: AmazonS3
x-amz-id-2: tXhAc64MXavoo2Ys7gL4K0CHvWdnnjW6yMDYhattkSwkbmjydK4ZTHB9EYLhbnHzR5lAnVYPFb8=
x-amz-request-id: 7Y2H1YDSCY2G4ZCG

GET
H2 200 83b2e5fd8b4a216a56b3b5943c03e909bc319f73
static.ffx.io/images/$zoom_0.1588%2C$multiply_4%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_0/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/ 6 KB
6 KB 17ms
16ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.1588%2C$multiply_4%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_0/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/83b2e5fd8b4a216a56b3b5943c03e909bc319f73
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 143997bc04dd0aeef29624286d2afc177342404a1e80323076cd718b911340b8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 268606
edge-cache-tag: 287847766833310694950144149327515262001,394211870221188089212338292760052314452,5f5f4219172da4ec8104790896b11172
cache-tag: 287847766833310694950144149327515262001,394211870221188089212338292760052314452,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="83b2e5fd8b4a216a56b3b5943c03e909bc319f73.webp"
content-length: 5880
x-cld-skey: 287847766833310694950144149327515262001 394211870221188089212338292760052314452 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6920-MXP, cache-mxp6946-MXP
last-modified: Tue, 01 Nov 2022 23:12:17 GMT
server: cloudinary
x-timer: S1667613111.047174,VS0,VE0
etag: "a3c4979b357aab0c38dd48eccd1e9a0e"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 31f444803eb26503ae24806bd2e499e94ae2bd05
static.ffx.io/images/$zoom_0.7927%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_769%2C$y_264/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/ 6 KB
7 KB 16ms
16ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.7927%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_769%2C$y_264/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/31f444803eb26503ae24806bd2e499e94ae2bd05
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: aa394c77e56df8c9b63628bd1c302f489faf2df27d47700c92188f1076e81946

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 114147
edge-cache-tag: 339443446196651617564308079730776662036,257185647859255198498485612293522198274,5f5f4219172da4ec8104790896b11172
cache-tag: 339443446196651617564308079730776662036,257185647859255198498485612293522198274,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="31f444803eb26503ae24806bd2e499e94ae2bd05.webp"
content-length: 6556
x-cld-skey: 339443446196651617564308079730776662036 257185647859255198498485612293522198274 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6921-MXP, cache-mxp6946-MXP
last-modified: Thu, 03 Nov 2022 14:34:28 GMT
server: cloudinary
x-timer: S1667613111.050704,VS0,VE0
etag: "30500628af68ebbfe6ea948c4ff54447"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 cb7b0c6c5f61ebbee83dfca20ec8dcaaa9bb79bc
static.ffx.io/images/$zoom_0.6026%2C$multiply_1%2C$ratio_1.777778%2C$width_1059%2C$x_1022%2C$y_1205/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/ 4 KB
5 KB 16ms
16ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.6026%2C$multiply_1%2C$ratio_1.777778%2C$width_1059%2C$x_1022%2C$y_1205/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/cb7b0c6c5f61ebbee83dfca20ec8dcaaa9bb79bc
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f75b1cf1cb396419751a3f00768026a2e90779ed24437de8d82c1e1551cb7805

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 78832
edge-cache-tag: 339779037314150401016282197686890644343,371403989471122064304070859042639263274,5f5f4219172da4ec8104790896b11172
cache-tag: 339779037314150401016282197686890644343,371403989471122064304070859042639263274,5f5f4219172da4ec8104790896b11172
x-cache: HIT, HIT
content-disposition: inline; filename="cb7b0c6c5f61ebbee83dfca20ec8dcaaa9bb79bc.webp"
content-length: 4298
x-cld-skey: 339779037314150401016282197686890644343 371403989471122064304070859042639263274 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6968-MXP, cache-mxp6946-MXP
last-modified: Thu, 03 Nov 2022 21:00:31 GMT
server: cloudinary
x-timer: S1667613111.055873,VS0,VE0
etag: "ff8557d1e1e815578c35fac92ee1fa1d"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 2

GET
H2 200 28e043af7c087e28d3d64a63dce70370fec88d56
static.ffx.io/images/$zoom_0.3443%2C$multiply_3%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_27/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/ 4 KB
4 KB 16ms
16ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.3443%2C$multiply_3%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_27/t_crop_custom/c_scale%2Cw_220%2Cq_88%2Cf_auto/28e043af7c087e28d3d64a63dce70370fec88d56
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e89cdbdc1a8aac6e7f4dca82e84fa74495dc7d05185b625d15ab4061dab99fe8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 241139
edge-cache-tag: 308952168900372985213085374372634556039,232034308855344145336264463995985198249,5f5f4219172da4ec8104790896b11172
cache-tag: 308952168900372985213085374372634556039,232034308855344145336264463995985198249,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="28e043af7c087e28d3d64a63dce70370fec88d56.webp"
content-length: 3836
x-cld-skey: 308952168900372985213085374372634556039 232034308855344145336264463995985198249 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6931-MXP, cache-mxp6946-MXP
last-modified: Wed, 02 Nov 2022 06:45:04 GMT
server: cloudinary
x-timer: S1667613111.064285,VS0,VE0
etag: "75dd231577da32ff3a97fc69ca37fa41"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
157 B 489ms
447ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1667613111039&id=t2_rkf9cnj5&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&uuid=ee59dc00-123e-4d01-9aa9-8f0baa946b42&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_40383b7f
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish
server: Varnish
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 27ms
26ms Script
application/x-javascript 2a02:26f0:780::5f65:3671
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:780::5f65:3671 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 3f50a1ccb55e595667f30077ae38364f5d3eab17837057fd32a0e2bc13cd9013

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 02:12:26 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=70303
accept-ranges: bytes
content-length: 4611

GET
H2 200 /
www.google.com/pagead/1p-user-list/AW-1006500043/ 42 B
548 B 124ms
41ms Image
image/gif 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/AW-1006500043/?random=1667613110769&cv=11&fst=1667610000000&bg=ffffff&guid=ON&async=1&gtm=2wgb20&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&tiba=Qantas%20CEO%20Alan%20Joyce%20books%20%244m%20incentive%20despite%20protest%20vote&fmt=3&is_vtc=1&random=3653681160&rmt_tld=0&ipr=y

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.it/pagead/1p-user-list/AW-1006500043/ 42 B
548 B 100ms
40ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/AW-1006500043/?random=1667613110769&cv=11&fst=1667610000000&bg=ffffff&guid=ON&async=1&gtm=2wgb20&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&tiba=Qantas%20CEO%20Alan%20Joyce%20books%20%244m%20incentive%20despite%20protest%20vote&fmt=3&is_vtc=1&random=3653681160&rmt_tld=1&ipr=y

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.f1e65ef904544a33c6d0.js Show response
script.hotjar.com/ 262 KB
67 KB 141ms
41ms Script
application/javascript 18.66.2.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.f1e65ef904544a33c6d0.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-182799.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.2.12 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-2-12.txl50.r.cloudfront.net

Software

Resource Hash

bd411c282a41f2967f5db7ec0b4c9d8ea6eb6b95b26b5507f2889c8c37fd8043

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 12:22:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 36e42f052a24feab91529d442c70cf34.cloudfront.net (CloudFront)
x-amz-cf-pop: TXL50-P1
age: 48585
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 68402
last-modified: Fri, 04 Nov 2022 12:21:18 GMT
etag: "0f58b5937c38edb646c879633af2ba34"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: JTnGnITko7iUD0vDZS19OW35q9fzU891MSDJzYxFiLyKUYryNOfpoQ==

GET
H3 200 419599435931961 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 102ms
72ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/419599435931961?v=2.9.89&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

83d6eb63792b184bbe2715ea8f52c929d68dffd598e0e44c0c342c1f6c2f2fe8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: OlzdWHmGyASA1kAoTm5ssauqqn52ut0o3sBiT2MOHnQT472Az72Ab9KvNxfH1JDQ9a2NgcPfjvbIEe5vKZol+A==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3

200

serviceiframe Show response
news.google.com/swg/ui/v1/ Frame 1B08
Redirect Chain

https://news.google.com/swg/_/ui/v1/serviceiframe?_=463225&publicationId=afr.com
https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com

25 KB
8 KB

88ms
87ms

Document
text/html

2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

187d3d34e55b45bf7e4d3062ea96a376b90906bfeb60825f5058875266ff11e9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport script-src 'report-sample' 'nonce-1wXbsrVymlrt3Gj7Kyxirw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /swg/_/SubscribewithgoogleClientUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport script-src 'report-sample' 'nonce-1wXbsrVymlrt3Gj7Kyxirw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /swg/_/SubscribewithgoogleClientUi/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-resource-policy: same-site
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 0

Redirect headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
content-security-policy: require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport script-src 'report-sample' 'nonce-Yrhy-JrUigwS_Xx-vSGbpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /swg/_/SubscribewithgoogleClientUi/cspreport/allowlist
content-type: application/binary
cross-origin-resource-policy: same-site
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 196ms
134ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=359e7d22-462d-4fe0-89b1-723e1864e887&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=73faeb51-8986-4c9a-bab4-789f9f1e1c5a&tw_document_href=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&tw_iframe_status=0&txn_id=o1c4v&type=javascript&version=2.3.29

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-response-time: 110
date: Sat, 05 Nov 2022 01:51:50 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: d780e3b80ceb26f0
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 4c18ecd09a1aee0a2d42b2fde619df53f3bfc46907d5d5101c14762323b8900b
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
724 B 375ms
141ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=359e7d22-462d-4fe0-89b1-723e1864e887&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=73faeb51-8986-4c9a-bab4-789f9f1e1c5a&tw_document_href=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&tw_iframe_status=0&txn_id=o1c4v&type=javascript&version=2.3.29

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-response-time: 116
date: Sat, 05 Nov 2022 01:51:51 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: f748c966fc967a01
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 066acd985edd808d522c080857e412ac8d07320e47ffde942e263b23d9cad10e
content-length: 43

GET
H2 200 fc2c63baa23f7c11ea923073.js Show response
static-au.plista.com/async/pub/ 31 B
362 B 31ms
31ms Script
application/javascript 136.243.44.4
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static-au.plista.com/async/pub/fc2c63baa23f7c11ea923073.js

Requested by

Host: static-au.plista.com
URL: https://static-au.plista.com/async.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

136.243.44.4 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.4.44.243.136.clients.your-server.de

Software

nginx /

Resource Hash

e8a2bc039ea82266ecd31dcb748fe90f212f6358fcf2502eb0061d9652b3638f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 05 Nov 2022 01:44:27 GMT
server: nginx
age: 442
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-varnish: 150297094 149879863
via: 1.1 varnish-v4
cache-control: public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 51
expires: Sun, 06 Nov 2022 01:44:28 GMT

GET
H2 200 box-c6ca1c87e308a39aabb76b56ba54398b.html Show response
vars.hotjar.com/ Frame 8580 2 KB
1 KB 100ms
24ms Document
text/html 13.224.189.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vars.hotjar.com/box-c6ca1c87e308a39aabb76b56ba54398b.html

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-182799.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-10.fra2.r.cloudfront.net

Software

Resource Hash

a0084043f26a51ea743463b4a653e4850cbaae0868832e4471a199f753fc6b27

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
age: 48585
cache-control: max-age=31536000
content-encoding: br
content-length: 1035
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 04 Nov 2022 12:22:06 GMT
etag: "b6d25d1350d6a014d80689f389e76f97"
last-modified: Fri, 04 Nov 2022 12:21:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
x-amz-cf-id: 8Z5PdPE5-0D7Ga3ii1yGsW9oW8qbfhbMcOLfmejuzCyODLyoEVcRVA==
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront
x-robots-tag: none

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 68ms
32ms XHR
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1981009996&t=pageview&_s=1&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&dp=%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&ul=en-us&de=UTF-8&dt=Qantas%20Joyce%20books%204m%20incentive%20despite%20protest%20vote&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACEABBAAAACACI~&jid=768910766&gjid=922688218&cid=657732761.1667613111&tid=UA-91053368-8&_gid=1461801601.1667613111&_r=1&gtm=2wgb20NN4PPKH&cd1=afr&cd2=2022-11-04T05%3A26%3A26.000Z&cd3=2022-11-04T05%3A26%3A26.000Z&cd4=Lucas%20Baird&cd5=WEB&cd6=F31617EE-F973-45D2-B439-40DFA86F5D7F&cd7=article&cd8=Companies&cd9=transport&cd10=authoring&cd11=p5bvja&cd12=false&cd14=visitor&cd16=0&cd21=AFR&cd22=Qantas%20Airways%20Limited%7CAlan%20Joseph%20Joyce%7CRichard%20James%20Barr%20Goyder%7CAGM%20season&cd23=Aviation&cd24=non%20metered&cd28=P70F2B436-31E2-4369-A3CB-294DC350A880&cd29=afr.com-brand%20only&cd33=%222116ea75-e7e1-43ed-838c-3a23c8b46883%22&cd38=&cd40=desktop&cd42=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&cd46=Qantas%20Joyce%20books%204m%20incentive%20despite%20protest%20vote&cd56=visitor&cd57=false&cd60=&cd61=false&cd62=&cd63=&cd64=&cd65=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F107.0.5304.87%20Safari%2F537.36&cd66=&z=84328880

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.afr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 glcfg510.js Show response
cdn-gl.imrworldwide.com/novms/js/2/configs/ 2 KB
1 KB 27ms
27ms Script
application/javascript 2600:9000:2240:fa00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:fa00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-amz-version-id: ewvW3g4lb5GRPqI93QGuWRxGJGah4nJs
content-encoding: gzip
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
date: Sat, 05 Nov 2022 01:07:05 GMT
last-modified: Wed, 28 Sep 2022 14:09:00 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 2696
x-amz-server-side-encryption: AES256
etag: W/"931051f801612c3a0e2782961ac3d56c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: Km8Kb4cJgD5mC9B4OtIO7B1O-aoh8wKqAL2XFZyAck4Yp_wIpBbY1Q==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/9724/domain/afr.com/ 36 B
375 B 32ms
31ms XHR
application/json 13.224.189.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/9724/domain/afr.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-123.fra2.r.cloudfront.net
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 05 Nov 2022 00:01:39 GMT
content-encoding: gzip
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 6612
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=39595
x-amz-cf-id: spg-uP7IfZnYbifxvnSWlLs5zqE_ZWsO1Gl2Io7lTM6mdEUBUEF9ew==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-202...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D9724%252C3519914%26time%3D1667613111120%26url%3Dhttps%253A%252F%252Fwww.afr.com%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-202...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20...

0
265 B

279ms
194ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&liSync=true&e_ipv6=AQLZ0xAoJLNBlwAAAYRFfLXr_TNxNqRb2n718QjcYULg4Vl60QoMAeNdkGPj-lOK49dyeA
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: FA9139BE9B824E769C1A67103E1F6790 Ref B: MIL30EDGE1310 Ref C: 2022-11-05T01:51:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXsr28qsnoDRN9l4p5ykA==

Redirect headers

date: Sat, 05 Nov 2022 01:51:51 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 83F77632CF4F4F7AA6297858C061C85B Ref B: MIL30EDGE1210 Ref C: 2022-11-05T01:51:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=9724%2C3519914&time=1667613111120&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&liSync=true&e_ipv6=AQLZ0xAoJLNBlwAAAYRFfLXr_TNxNqRb2n718QjcYULg4Vl60QoMAeNdkGPj-lOK49dyeA
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXsr28mff5N3/OmDT0IKA==

OPTIONS
H2 200 token
cdn.linkedin.oribi.io/partner/9724/domain/afr.com/ Frame 0
0 111ms
25ms Preflight 13.224.189.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/9724/domain/afr.com/token
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-123.fra2.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 1800
age: 12819
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Fri, 04 Nov 2022 22:18:12 GMT
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-id: LCpHInXfpgn9rrrQu8bwiD8FC7zfQjH6WHV4jYtCiJrEvJTZzIrJpA==
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront

OPTIONS
H2 200 token
cdn.linkedin.oribi.io/partner/9724/domain/afr.com/ Frame 0
0 110ms
26ms Preflight 13.224.189.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/9724/domain/afr.com/token
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-123.fra2.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 1800
age: 12819
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Fri, 04 Nov 2022 22:18:12 GMT
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-id: UMwLFgOAwTI4iyjHGbuu5RzVp15bVKSobZR2npB5CkZ_c33FjXaxCw==
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/9724/domain/afr.com/ 36 B
375 B 31ms
31ms XHR
application/json 13.224.189.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/9724/domain/afr.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-123.fra2.r.cloudfront.net
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 05 Nov 2022 00:01:39 GMT
content-encoding: gzip
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 6612
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=39595
x-amz-cf-id: oZ6haGML_TxKXhDywirrjIktV0ZQUiV3FgdiR7YlWfNarzMtsY7qMQ==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/9724/domain/afr.com/ 36 B
376 B 30ms
30ms XHR
application/json 13.224.189.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/9724/domain/afr.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-123.fra2.r.cloudfront.net
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 05 Nov 2022 00:01:39 GMT
content-encoding: gzip
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 6612
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=39595
x-amz-cf-id: c4pMNUn67WWToPfqexkNGQVL2kcKfQ6xH_-FGVlFmZIhtzfw8dRbVA==

OPTIONS
H2 200 token
cdn.linkedin.oribi.io/partner/9724/domain/afr.com/ Frame 0
0 109ms
27ms Preflight 13.224.189.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/9724/domain/afr.com/token
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-123.fra2.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 1800
age: 12819
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Fri, 04 Nov 2022 22:18:12 GMT
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-id: tlvvJTlXq5IxaNh2pvKpDAwk3-ymA_H8FZ53Xt-hzcU7N6JIsEdq0g==
x-amz-cf-pop: FRA2-C1
x-cache: Hit from cloudfront

GET
H2 200 10167837.json Show response
s.yimg.com/wi/config/ 2 B
449 B 369ms
123ms XHR
application/json 2a00:1288:80:807::1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10167837.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:00:07 GMT
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
x-amz-request-id: 668PPJ751XYAZ1SB
age: 3104
content-length: 2
x-amz-id-2: CRmx8+ZmH9DSF+0vGaGwP8iikoOsReQ/411ThDcBhEytNNEdSKBzrORUIuqMbJUFHm4Hlr6Kc34=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

GET
H2 200 dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=*;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-d...
adservice.google.com/ddm/fls/z/ Frame 13D7 42 B
494 B 93ms
62ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=*;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Requested by

Host: 12281244.fls.doubleclick.net
URL: https://12281244.fls.doubleclick.net/activityi;dc_pre=CJek7Pj2lfsCFfUjBgAdR0cPgw;src=12281244;type=afr0;cat=allpa0;ord=2727056862613;gtm=2wgb20;auiddc=1587715341.1667613111;~oref=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://12281244.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dest5.html Show response
fairfaxau.demdex.net/ Frame 05B2 7 KB
3 KB 224ms
49ms Document
text/html 34.253.119.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fairfaxau.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.253.119.106 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-253-119-106.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v045-0492369ce.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: Aj4K2nXrQIM=
content-encoding: gzip
date: Sat, 5 Nov 2022 01:51:51 GMT
last-modified: Fri, 28 Oct 2022 11:22:23 GMT
transfer-encoding: chunked
vary: accept-encoding

GET
H2 200 id Show response
fairfaxau.sc.omtrdc.net/ 2 B
264 B 136ms
35ms XHR
application/x-javascript 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fairfaxau.sc.omtrdc.net/id?d_visid_ver=1.8.0&d_fieldgroup=A&mcorgid=BEB5C8A15492DB600A4C98BC%40AdobeOrg&mid=13720711878759880134141202686927639560&ts=1667613111232

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://www.afr.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 2
x-xss-protection: 1; mode=block

POST
H/1.1 200
OK event Show response
nd.demdex.net/ 2 KB
1 KB 257ms
56ms XHR
application/json 34.250.104.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://nd.demdex.net/event?_ts=1667613110903

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.250.104.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-250-104-41.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f4ab6372f3e66d92a70aab85aee716115173d6d132b0afbe1d2b0bebb9b6551c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v045-06601d6e7.edge-irl1.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: jVfpv0aMRRU=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.afr.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 668
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
439 B 109ms
35ms XHR
text/plain 2a00:1450:400c:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-91053368-8&cid=657732761.1667613111&jid=768910766&gjid=922688218&_gid=1461801601.1667613111&_u=YGBACEAABAAAACACI~&z=462400513

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b4cd4f889e2c7dd71da12d2b0a29aa6346de2e5d8b3c882d7700d64c700f661d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.afr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=695310944...
adservice.google.com/ddm/fls/z/ Frame 5CA3 42 B
107 B 65ms
63ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6953109447522.248

Requested by

Host: 12393262.fls.doubleclick.net
URL: https://12393262.fls.doubleclick.net/activityi;dc_pre=COrf7fj2lfsCFQnb1Qod7-gFJA;src=12393262;type=afr0;cat=allpa0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6953109447522.248?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://12393262.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 P70F2B436-31E2-4369-A3CB-294DC350A880.js Show response
cdn-gl.imrworldwide.com/conf/ 32 KB
7 KB 28ms
27ms Script
application/javascript 2600:9000:2240:fa00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/conf/P70F2B436-31E2-4369-A3CB-294DC350A880.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:fa00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cbfc040de2d45c04515697a5096c0c84b5357e24da2e8b89ec58def23dd61ea9

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-amz-version-id: h8lRctPOhTKAW7iGB7t_3ymsB8lcTWGn
content-encoding: gzip
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
date: Sat, 05 Nov 2022 01:19:17 GMT
last-modified: Fri, 04 Nov 2022 01:17:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 2499
x-amz-server-side-encryption: AES256
etag: W/"786f6190d0d5ef7372ee9d12e270294d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400,s-maxage=86400
x-amz-cf-id: FatlcWmQiuOIo3sot1ki5xGrOo_tWs8YIMzkUmHShL-taZZ0XGC5Gg==

GET
H2 200 storageframe.html Show response
secure-gl.imrworldwide.com/ Frame 99B6 11 KB
4 KB 283ms
185ms Document
text/html 2600:9000:21f3:0:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-gl.imrworldwide.com/storageframe.html
Requested by: Host: secure-au.imrworldwide.com
URL: https://secure-au.imrworldwide.com/v60.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:0:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
etag: W/"6324ea19-2b27"
last-modified: Fri, 16 Sep 2022 21:26:49 GMT
server: nginx
vary: Accept-Encoding
via: 1.1 27f665df26bde4a7226480b4a2890ff8.cloudfront.net (CloudFront)
x-amz-cf-id: 4Ht6IMC3pQ8ImeYgBjd6tom2gIWYUVT--z7DPi-Qm8EmzFnphJAuCg==
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront

GET
H3 200 1831268437115893 Show response
connect.facebook.net/signals/config/ 294 KB
84 KB 68ms
67ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1831268437115893?v=2.9.89&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

26654ed4ccbca63ecf0eb1eaf9b8a5f2b02e850e55c3e779e9d7d0d609975bdf

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: zmy2oecOrgHwoLb0Y9d9uhIdg2V+cwPvppCZ/Wb/EbzJKGlgGdADFhsAq+CBcZ8eACzcD81Em1AQVqQeoB9NgA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 96ms
28ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=419599435931961&ev=PageView&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111272&cd[brand]=afr&sw=1600&sh=1200&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H3 204 cspreport
news.google.com/swg/_/SubscribewithgoogleClientUi/ Frame 1B08 0
25 B 49ms
49ms Other
text/html 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/_/SubscribewithgoogleClientUi/cspreport

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport, script-src 'report-sample' 'nonce-rzWZjWiiazstN6Xq1r_yIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /swg/_/SubscribewithgoogleClientUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport, script-src 'report-sample' 'nonce-rzWZjWiiazstN6Xq1r_yIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /swg/_/SubscribewithgoogleClientUi/cspreport/allowlist
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 swg-button.css
news.google.com/swg/js/v1/ Frame 1B08 21 KB
6 KB 26ms
25ms Stylesheet
text/css 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-button.css

Requested by

Host: news.google.com
URL: https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c429b056c18833dd3d7fe28ab8ba904526ad1375398ffac0a0e4f2d278e1ac43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:03:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2900
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6458
x-xss-protection: 0
last-modified: Wed, 02 Nov 2022 19:15:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="news-frontend"
vary: Accept-Encoding
report-to: {"group":"news-frontend","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/news-frontend"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Sat, 05 Nov 2022 01:53:31 GMT

GET
H2 200 m=_b,_tp,_r Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/am=zgAAAQ/d=1/excm=_b,_r,_tp,serviceiframeview/ed=1/dg=0/wt=2/rs=ABXTjI... Frame 1B08 171 KB
61 KB 86ms
25ms Script
text/javascript 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/am=zgAAAQ/d=1/excm=_b,_r,_tp,serviceiframeview/ed=1/dg=0/wt=2/rs=ABXTjI5CICNbKwcKdCR8HbaOfCL2tVyMtA/m=_b,_tp,_r

Requested by

Host: news.google.com
URL: https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

430d1161adea15af5a99102340e870262390269670f34c36f89402ffbc9d42b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 17:02:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118146
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61537
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 00:50:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/subscribewithgoogle-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/subscribewithgoogle-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/subscribewithgoogle-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Nov 2023 17:02:45 GMT

GET
H3 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 24ms
23ms Script
text/javascript 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:30:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1283
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1129
x-xss-protection: 0
last-modified: Thu, 30 Dec 2021 12:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 05 Nov 2022 02:30:28 GMT

GET
H2 200 83b2e5fd8b4a216a56b3b5943c03e909bc319f73
static.ffx.io/images/$zoom_0.1588%2C$multiply_4%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_0/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/ 8 KB
9 KB 18ms
15ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.1588%2C$multiply_4%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_0/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/83b2e5fd8b4a216a56b3b5943c03e909bc319f73
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: dcf426eeed18fa7b759dba107fa8b186ea4bd01e7cf19a4c181cd4fb084d09a8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 267422
edge-cache-tag: 287847766833310694950144149327515262001,214855715283963706091112267472527124758,5f5f4219172da4ec8104790896b11172
cache-tag: 287847766833310694950144149327515262001,214855715283963706091112267472527124758,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="83b2e5fd8b4a216a56b3b5943c03e909bc319f73.webp"
content-length: 8098
x-cld-skey: 287847766833310694950144149327515262001 214855715283963706091112267472527124758 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6961-MXP, cache-mxp6946-MXP
last-modified: Tue, 01 Nov 2022 23:12:16 GMT
server: cloudinary
x-timer: S1667613111.341352,VS0,VE0
etag: "f3d04190aa8206735d84f7d4ea2a2285"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 31f444803eb26503ae24806bd2e499e94ae2bd05
static.ffx.io/images/$zoom_0.7927%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_769%2C$y_264/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/ 11 KB
11 KB 24ms
21ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.7927%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_769%2C$y_264/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/31f444803eb26503ae24806bd2e499e94ae2bd05
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: dacc31ea0ac0633ee543f5d44f5048e8dc1f39a462fc428ad233077505ca1715

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 114175
edge-cache-tag: 339443446196651617564308079730776662036,233932792223900272529397689288375691069,5f5f4219172da4ec8104790896b11172
cache-tag: 339443446196651617564308079730776662036,233932792223900272529397689288375691069,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="31f444803eb26503ae24806bd2e499e94ae2bd05.webp"
content-length: 11098
x-cld-skey: 339443446196651617564308079730776662036 233932792223900272529397689288375691069 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6971-MXP, cache-mxp6946-MXP
last-modified: Thu, 03 Nov 2022 18:00:27 GMT
server: cloudinary
x-timer: S1667613111.341604,VS0,VE1
etag: "25622b55eb9ee04e30c181d298fbbd9f"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 cb7b0c6c5f61ebbee83dfca20ec8dcaaa9bb79bc
static.ffx.io/images/$zoom_0.6026%2C$multiply_1%2C$ratio_1.777778%2C$width_1059%2C$x_1022%2C$y_1205/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/ 8 KB
9 KB 21ms
20ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.6026%2C$multiply_1%2C$ratio_1.777778%2C$width_1059%2C$x_1022%2C$y_1205/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/cb7b0c6c5f61ebbee83dfca20ec8dcaaa9bb79bc
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: a8a794dd208864c93b29276b44b554f364c9fa194e61568d4c9fca2fb9c0438f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 103732
edge-cache-tag: 339779037314150401016282197686890644343,291787386539708338844588866464973838307,5f5f4219172da4ec8104790896b11172
cache-tag: 339779037314150401016282197686890644343,291787386539708338844588866464973838307,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="cb7b0c6c5f61ebbee83dfca20ec8dcaaa9bb79bc.webp"
content-length: 8582
x-cld-skey: 339779037314150401016282197686890644343 291787386539708338844588866464973838307 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6961-MXP, cache-mxp6946-MXP
last-modified: Thu, 03 Nov 2022 21:00:15 GMT
server: cloudinary
x-timer: S1667613111.341574,VS0,VE1
etag: "de72d5896a9c7537a470e8c2a5b01d6c"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 28e043af7c087e28d3d64a63dce70370fec88d56
static.ffx.io/images/$zoom_0.3443%2C$multiply_3%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_27/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/ 6 KB
7 KB 18ms
18ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.3443%2C$multiply_3%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_27/t_crop_custom/c_scale%2Cw_300%2Cq_88%2Cf_auto/28e043af7c087e28d3d64a63dce70370fec88d56
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: d226e59228596b7a5ee8b2b58cb401a7df9618df22b7c98e7d1e305145ab02be

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 79113
edge-cache-tag: 308952168900372985213085374372634556039,245467414733304643716487944198710532732,5f5f4219172da4ec8104790896b11172
cache-tag: 308952168900372985213085374372634556039,245467414733304643716487944198710532732,5f5f4219172da4ec8104790896b11172
x-cache: HIT, HIT
content-disposition: inline; filename="28e043af7c087e28d3d64a63dce70370fec88d56.webp"
content-length: 6332
x-cld-skey: 308952168900372985213085374372634556039 245467414733304643716487944198710532732 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6968-MXP, cache-mxp6946-MXP
last-modified: Wed, 02 Nov 2022 06:44:49 GMT
server: cloudinary
x-timer: S1667613111.345351,VS0,VE1
etag: "396462a049c180f4970342ac803a520a"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1

GET
H3

200

dc_pre=CLK6gPn2lfsCFY6MsgodYSUMJA;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=*
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=1587715341.1667613111?
https://ad.doubleclick.net/activity;dc_pre=CLK6gPn2lfsCFY6MsgodYSUMJA;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=1587715341.1667613111?
https://adservice.google.com/ddm/fls/z/dc_pre=CLK6gPn2lfsCFY6MsgodYSUMJA;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=*

42 B
63 B

63ms
63ms

Image
image/gif

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLK6gPn2lfsCFY6MsgodYSUMJA;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=*

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CLK6gPn2lfsCFY6MsgodYSUMJA;src=6633783;type=afrpa0;cat=paywall;ord=3422661360589;gtm=2wgb20;auiddc=*
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK / Show response
l.ffx.io/ 2 B
417 B 287ms
286ms XHR
text/plain 3.104.213.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.ffx.io/
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.213.201 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-213-201.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json

Response headers

Date: Sat, 05 Nov 2022 01:51:52 GMT
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Length: 2

OPTIONS
H/1.1 204
No Content /
l.ffx.io/ Frame 0
0 961ms
284ms Preflight 3.104.213.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.ffx.io/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.213.201 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-213-201.ap-southeast-2.compute.amazonaws.com
Software: nginx/1.15.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 0
Date: Sat, 05 Nov 2022 01:51:52 GMT
Server: nginx/1.15.9

GET
H2 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
792 B 121ms
35ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=www.afr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 85ms
34ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.afr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 3 KB
523 B 406ms
406ms XHR
text/plain 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2281875772716836&correlator=1578147559743532&eid=44768258&output=ldjh&gdfp_req=1&vrg=2022110101&ptt=17&impl=fifs&iu_parts=21671780509%2Cafr%2Ccompanies%2Ctransport%2Caviation&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=970x250%7C728x90%2C970x250%7C728x90%2C320x50%7C6x2%2C300x600%7C300x250%7C160x600%2C320x50%7C6x2&fluid=0%2C0%2Cheight%2C0%2Cheight&ifi=1&adks=1795415676%2C388102437%2C2934288840%2C1543766756%2C1061226238&sfv=1-0-39&prev_scp=pos%3D1%26src_ad_id%3Dadspot-970x250_728x90-pos1-desktop%7Cpos%3D2%26src_ad_id%3Dadspot-970x250_728x90-pos2-desktop%7Cpos%3D1%26src_ad_id%3Dadspot-N-6x2-pos1-desktop%26nativesz%3D6x2%7Cpos%3D3%26src_ad_id%3Dadspot-300x600_300x250_160x600-pos3-desktop%7Cpos%3D2%26src_ad_id%3Dadspot-N-6x2-pos2-desktop%26nativesz%3D6x2&cust_params=adKitVersion%3D2.1.14%26autoRefresh%3Dfalse%26brms%3Dtrue%26brvs%3Dtrue%26deployEnv%3Dproduction%26layout%3Dblue%26pageid%3Dp5bvja%26pageviewid%3DF31617EE-F973-45D2-B439-40DFA86F5D7F%26swgt%3Dna%26sysEnv%3Ddesktop%26cat%3Dcompanies%26cat1%3Dtransport%26cat2%3Daviation%26ctype%3Darticle%26csub%3Dvisitor%26m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DdataAvailable%26m_gv%3DdataAvailable%26gs_cat%3Dtravel_australia%252Cjourno_finexpert%252Cneg_toyota_brandsafety%252Cnims_all_things_summer%252Camex_master_kwbl%252Cneg_custom_deutschebank%252Chow-to-get-there%252Cnims_travel_and_experiences%252Cneg_apple_keywords%252Cneg_custom_youtube%252Chousingmarket%252Ccustom_nab_2020%252Cqantas_blacklist%252Cneg_cadbury100years_brandsafety%252Cneg_qantas_master_kwbl%252Cnims_inspirational_women%252Cneg_cadbury_brandsafety_oa%252Cneg_custom_nespresso%252Cnims_summer_reading%252Csecondary_income_predts%252Cneg_queen_elizabeths_death%252Cmicrosoft_master_kwbl%252Cgs_business%252Cneg_westpac_brandsaftey2020%252Cwestpac_brandsaftey%252Cwestpac_kwbl%252Cmyer_kwbl%252Cneg_custom_homeworld%252Cneg_custom_melbourne_business_school%252Cneg_ffx_anzbank_kwbl%252Cmicrosoft_kwbl%252Cardent_kwbl%252Cdreamworld_accident_kwbl%252Cneg_custom_freestyle_libre%252Cneg_custom_mondelez%252Cgs_travel_air%252Cneg_custom-brand-safety_macquarie-bank%252Cgreat_southern_rail_kwbl%252Csemi_retired_workforce_predts%252Cgb_safe%252Cinfrastructure%252Cnswdestinations%252Cgs_travel%252Cmcd_scandal_kwbl%252Cairlines_kwbl%252Cwoolworths_retail_vertical%252Cneg_custom_mondelez2020%252Cntdestinations%252Cqlddestinations%252Csadestinations%252Ctasdestinations%252Cvicdestinations%252Cwadestinations%252Cweekend-escapes%252Cneg_custom_bunnings%252Cneg_custom_celebrity_cruises%252Cbunnings_master_kwbl%252Chbf_negative_kwbl%252Cgt_negative%252Cgs_economy_markets%252Cunhcr-emergency%252Chome_loans_predts%252Cnab_neg_kw%252Ccustom_sealink2021%252Cneg_russia_ukraine_conflict_oa%252Ccustom_fssa_financial_sector%252Cnewhome-builds%252Cneg_lego_custom%252Cgs_economy%252Caccounting_students_predts%252Cchanging_careers_predts%252Cnesting_seg_example%252Cnims_who_mattered%252Clogmein_meetings_predts%252Cbhp_kwbl%252Cgs_business_management%252Cnims_arts_and_culture%252Cmayohardware_thermalbodycameras%252Cbtfinancial_kwbl%252Clandcorp_kwbl%252Cproductivity%252Ccommsec_negativekeywords%252Cubank_kwbl%252Cyoutube_kwbl%252Cneg_sabic_brandsafety%252Cgs_business_careers%252Cself_improvement%252Cneg_ninepub_covid19%252Cneg_custom_tiffanyandco_queen_death%252Cford_kwbl%252Cgoogle_master_kwbl%252Cneg_russia_ukraine%252Cneg_us_protests%252Cnims_fin_magazine%252Cxero_competitors_predts%252Csportscars%252Cfirsthomebuyers%252Cneg_ey_finance_brand_safety%252Cneg_nestle_master%252Cgolden_globes_predts%252Cneg_custom_auspost%252Cpaypal_sme_predts%252Cgs_covid19%252Cgv_safe&sc=1&cookie_enabled=1&abxe=1&dt=1667613111413&lmt=1667613111&dlt=1667613110135&idt=836&adxs=315%2C315%2C-9%2C-9%2C-9&adys=231%2C1274%2C-9%2C-9%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C1%7C-1%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&frm=20&vis=1&psz=1600x138%7C1340x122%7C0x-1%7C0x-1%7C0x-1&msz=1600x90%7C1340x90%7C0x-1%7C0x-1%7C0x-1&fws=4%2C4%2C2%2C2%2C2&ohw=1600%2C1600%2C0%2C0%2C0&ga_vid=657732761.1667613111&ga_sid=1667613111&ga_hid=1981009996&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39eb62961f683cb8bf00a27737530e01c1d59003deb71aa3a91237b9388d4073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 494
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.afr.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
7875bd8cec82421e2902fdac676555a6.safeframe.googlesyndication.com/safeframe/1-0-39/html/ Frame 1904 6 KB
3 KB 129ms
33ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7875bd8cec82421e2902fdac676555a6.safeframe.googlesyndication.com/safeframe/1-0-39/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 2988
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sun, 05 Nov 2023 01:51:51 GMT
last-modified: Tue, 25 Oct 2022 18:59:17 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 93ms
37ms Image
image/gif 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-91053368-8&cid=657732761.1667613111&jid=768910766&_u=YGBACEAABAAAACACI~&z=1890013371

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.it/ads/ 42 B
63 B 109ms
36ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-91053368-8&cid=657732761.1667613111&jid=768910766&_u=YGBACEAABAAAACACI~&z=1890013371

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 graphql Show response
api.afr.com/ 15 KB
3 KB 721ms
720ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20MostPopularQuery(%24assetType%3A%20String%2C%20%24brand%3A%20String!%2C%20%24count%3A%20Int%2C%20%24primaryCategory%3A%20String%2C%20%24subCategory%3A%20String%2C%20%24tags%3A%20%5BString!%5D)%20%7B%20mostPopularStories(%20assetType%3A%20%24assetType%20brand%3A%20%24brand%20category%3A%20%24primaryCategory%20count%3A%20%24count%20subCategory%3A%20%24subCategory%20tags%3A%20%24tags%20)%20%7B%20...AssetFragment%20%7D%20%7D%20fragment%20AssetFragment%20on%20Asset%20%7B%20asset%20%7B%20about%20byline%20duration%20headlines%20%7B%20headline%20%7D%20live%20%7D%20assetType%20dates%20%7B%20firstPublished%20modified%20published%20%7D%20id%20featuredImages%20%7B%20landscape16x9%20%7B%20...ImageFragment%20%7D%20landscape3x2%20%7B%20...ImageFragment%20%7D%20portrait2x3%20%7B%20...ImageFragment%20%7D%20square1x1%20%7B%20...ImageFragment%20%7D%20%7D%20label%20tags%20%7B%20primary%3A%20primaryTag%20%7B%20...AssetTag%20%7D%20secondary%20%7B%20...AssetTag%20%7D%20%7D%20urls%20%7B%20...AssetURLs%20%7D%20%7D%20fragment%20AssetTag%20on%20AssetTagDetails%20%7B%20company%20%7B%20exchangeCode%20stockCode%20%7D%20context%20displayName%20id%20name%20shortID%20slug%20urls%20%7B%20canonical%20%7B%20brand%20path%20%7D%20published%20%7B%20afr%20%7B%20path%20%7D%20%7D%20%7D%20%7D%20fragment%20AssetURLs%20on%20AssetURLs%20%7B%20canonical%20%7B%20brand%20path%20%7D%20published%20%7B%20afr%20%7B%20path%20%7D%20%7D%20%7D%20fragment%20ImageFragment%20on%20Image%20%7B%20data%20%7B%20altText%20aspect%20autocrop%20caption%20cropWidth%20id%20offsetX%20offsetY%20zoom%20%7D%20%7D%20&operationName=MostPopularQuery&variables=%7B%22brand%22%3A%22afr%22%2C%22primaryCategory%22%3A%22companies%22%2C%22count%22%3A5%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 65c93c54493488439390c91f835ffadc736e0b617a99fbc4871a8e4b0a1a37e8

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10141-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:52 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 4
vary: Accept-Encoding, Origin
x-cache: HIT, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: public, max-age=60
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 3155
x-cache-hits: 2, 0

GET
H2 200 graphql Show response
api.afr.com/ 19 KB
4 KB 311ms
310ms XHR
application/json 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.afr.com/graphql?query=query%20assetsConnectionByCriteria(%24after%3A%20ID%2C%20%24brand%3A%20Brand!%2C%20%24categories%3A%20%5BInt!%5D%2C%20%24first%3A%20Int!%2C%20%24render%3A%20Render!%2C%20%24types%3A%20%5BAssetType!%5D!)%20%7B%20assetsConnectionByCriteria(%20after%3A%20%24after%20brand%3A%20%24brand%20categories%3A%20%24categories%20first%3A%20%24first%20render%3A%20%24render%20types%3A%20%24types%20)%20%7B%20edges%20%7B%20cursor%20node%20%7B%20...AssetFragment%20sponsor%20%7B%20name%20%7D%20%7D%20%7D%20error%20%7B%20message%20type%20%7B%20class%20%7D%20%7D%20pageInfo%20%7B%20endCursor%20hasNextPage%20%7D%20%7D%20%7D%20fragment%20AssetFragment%20on%20Asset%20%7B%20asset%20%7B%20about%20byline%20duration%20headlines%20%7B%20headline%20%7D%20live%20%7D%20assetType%20dates%20%7B%20firstPublished%20modified%20published%20%7D%20id%20featuredImages%20%7B%20landscape16x9%20%7B%20...ImageFragment%20%7D%20landscape3x2%20%7B%20...ImageFragment%20%7D%20portrait2x3%20%7B%20...ImageFragment%20%7D%20square1x1%20%7B%20...ImageFragment%20%7D%20%7D%20label%20tags%20%7B%20primary%3A%20primaryTag%20%7B%20...AssetTag%20%7D%20secondary%20%7B%20...AssetTag%20%7D%20%7D%20urls%20%7B%20...AssetURLs%20%7D%20%7D%20fragment%20AssetTag%20on%20AssetTagDetails%20%7B%20company%20%7B%20exchangeCode%20stockCode%20%7D%20context%20displayName%20id%20name%20shortID%20slug%20urls%20%7B%20canonical%20%7B%20brand%20path%20%7D%20published%20%7B%20afr%20%7B%20path%20%7D%20%7D%20%7D%20%7D%20fragment%20AssetURLs%20on%20AssetURLs%20%7B%20canonical%20%7B%20brand%20path%20%7D%20published%20%7B%20afr%20%7B%20path%20%7D%20%7D%20%7D%20fragment%20ImageFragment%20on%20Image%20%7B%20data%20%7B%20altText%20aspect%20autocrop%20caption%20cropWidth%20id%20offsetX%20offsetY%20zoom%20%7D%20%7D%20&operationName=assetsConnectionByCriteria&variables=%7B%22brand%22%3A%22afr%22%2C%22categories%22%3A%5B99%5D%2C%22first%22%3A6%2C%22render%22%3A%22WEB%22%2C%22types%22%3A%5B%22article%22%2C%22liveArticle%22%2C%22featureArticle%22%5D%7D
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0a0b35d63dfb5e8c4d01e458ba528e6b49b4974a03ab55c201ae94cdfc426b9c

Request headers

Accept: application/json, text/plain, */*, application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: cache-syd10177-SYD, cache-mxp6946-MXP
date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 0
vary: Accept-Encoding, Origin
x-cache: MISS, MISS
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: public, max-age=30
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 3909
x-cache-hits: 0, 0

GET
H2 200 nlsSDK600.bundle.min.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 195 KB
55 KB 29ms
28ms Script
application/javascript 2600:9000:2240:fa00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/P70F2B436-31E2-4369-A3CB-294DC350A880.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:fa00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2d0ade31483bf44bbdbc9822066eaebf674738b370092fcfc8295e7ae3195d98

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-amz-version-id: Tw1ZrV6S6M8HrQmSnEoR4BpykB7j_69v
content-encoding: gzip
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
date: Sat, 05 Nov 2022 00:52:57 GMT
x-amz-cf-pop: FRA60-P1
age: 3535
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
last-modified: Wed, 28 Sep 2022 14:09:01 GMT
server: AmazonS3
etag: W/"81a9e2a298d0019660cb2966f0c24748"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: uLG5UCidrXIjXdLQLr62w39k9lo3AN_ktjS4KSRc6NRJRkJkjLUMvw==

GET
H2 204 182799 Show response
vc.hotjar.io/sessions/ 0
256 B 137ms
52ms XHR
text/plain 13.225.78.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/182799?s=0.25&r=0.15358729118107162
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.f1e65ef904544a33c6d0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-105.fra2.r.cloudfront.net
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
server: Python/3.7 aiohttp/3.5.4
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: VNdH9iU0gvyuylBQHBy5Co1WL-fvV2c_kzV4rxKM-s7o5cFXJ0GE9g==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 17ms
16ms Image
image/gif 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1981009996&t=event&ni=0&_s=2&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&dp=%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&ul=en-us&de=UTF-8&dt=Qantas%20Joyce%20books%204m%20incentive%20despite%20protest%20vote&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=meter&ea=meter%20impression&el=inline&ev=0&_u=aGBACEALBAAAACAOI~&jid=&gjid=&cid=657732761.1667613111&tid=UA-91053368-8&_gid=1461801601.1667613111&gtm=2wgb20NN4PPKH&cd1=afr&cd2=2022-11-04T05%3A26%3A26.000Z&cd3=2022-11-04T05%3A26%3A26.000Z&cd4=Lucas%20Baird&cd5=WEB&cd6=F31617EE-F973-45D2-B439-40DFA86F5D7F&cd7=article&cd8=Companies&cd9=transport&cd10=authoring&cd11=p5bvja&cd12=false&cd14=visitor&cd15=GA1.2.657732761.1667613111&cd16=0&cd21=AFR&cd22=Qantas%20Airways%20Limited%7CAlan%20Joseph%20Joyce%7CRichard%20James%20Barr%20Goyder%7CAGM%20season&cd23=Aviation&cd24=non%20metered&cd28=P70F2B436-31E2-4369-A3CB-294DC350A880&cd29=afr.com-brand%20only&cd33=%222116ea75-e7e1-43ed-838c-3a23c8b46883%22&cd38=&cd40=desktop&cd42=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&cd46=Qantas%20Joyce%20books%204m%20incentive%20despite%20protest%20vote&cd56=visitor&cd57=false&cd60=&cd61=false&cd62=&cd63=&cd64=&cd65=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F107.0.5304.87%20Safari%2F537.36&cd66=&promo1cr=companies&promo1id=inline&promo1nm=meter&promo1ps=This%20article%20is%20for%20subscribers%20only.&z=38381868

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Nov 2022 14:36:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 40522
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 953970877989909 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 69ms
68ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/953970877989909?v=2.9.89&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4da83a4a1b92935b33948cdee4036db7630f5e7c833b41492d5b4b634de38ffa

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 9vml3+1ZppfRgQTlBQFWT85+bAYHam/rOY7MF+aeSqLbiU8zz5yGWV62LZf9OKyKzw1b8C/B3+6MBq0XASdLug==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 0
18 B 54ms
25ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1831268437115893&ev=PageView&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111521&sw=1600&sh=1200&v=2.9.89&r=stable&ec=0&o=30&par[0]=%7B%22extractorID%22%3A%221111245219334310%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22AUD%22%7D%7D%7D&par[1]=%7B%22extractorID%22%3A%22248737323376397%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22AUD%22%7D%7D%7D&par[2]=%7B%22extractorID%22%3A%22238870547858716%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[3]=%7B%22extractorID%22%3A%221061618751009995%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 1B08 15 KB
16 KB 86ms
26ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: news.google.com
URL: https://news.google.com/swg/ui/v1/serviceiframe?_=463225&publicationId=afr.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
Origin: https://news.google.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 08:32:01 GMT
x-content-type-options: nosniff
age: 148790
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Nov 2023 08:32:01 GMT

GET
H2 202 track_page_view
nova.collect.igodigital.com/c2/10510523/ 43 B
682 B 131ms
130ms Image
image/gif 44.195.168.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nova.collect.igodigital.com/c2/10510523/track_page_view?payload=%7B%22title%22%3A%22Qantas%20CEO%20Alan%20Joyce%20books%20%244m%20incentive%20despite%20protest%20vote%22%2C%22url%22%3A%22https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja%22%2C%22referrer%22%3A%22%22%2C%22user_info%22%3A%7B%7D%7D

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.195.168.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-195-168-154.compute-1.amazonaws.com

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-runtime: 0.006499
date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/gif
cache-control: private
content-transfer-encoding: binary
content-disposition: inline
x-xss-protection: 1; mode=block
x-request-id: 5a0223fd-d555-4b6a-9f47-446ead51955e

GET
H/1.1 200
OK /
p1.parsely.com/plogger/ 43 B
259 B 222ms
50ms Image
image/gif 63.34.81.234
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/plogger/?rand=1667613111561&plid=16582933&idsite=afr.com&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22_pageviewID%22%3A%22F31617EE-F973-45D2-B439-40DFA86F5D7F%22%2C%22member_type%22%3A%22Visitor%22%2C%22memberType%22%3A%22Visitor%22%7D&sid=1&surl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&sref=&sts=1667613111555&slts=0&title=Qantas+CEO+Alan+Joyce+books+%244m+incentive+despite+protest+vote&date=Sat+Nov+05+2022+01%3A51%3A51+GMT%2B0000+(GMT)&action=pageview&js=1&pvid=27817443&u=pid%3D0392550dc682b3e6be1f248be8fa3b65
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.34.81.234 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-34-81-234.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Date: Sat, 05 Nov 2022 01:51:51 GMT
Cache-Control: no-cache
Last-Modified: Saturday, 05-Nov-2022 01:51:51 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
632 B 190ms
56ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Sat%2C%2005%20Nov%202022%2001%3A51%3A51%20GMT&n=0&b=Qantas%20CEO%20Alan%20Joyce%20books%20%244m%20incentive%20despite%20protest%20vote&.yp=10167837&f=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&enc=UTF-8&yv=1.13.0&tagmgr=gtm

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Sat, 05 Nov 2022 01:51:51 GMT

GET
H3 200 m=byfTOb,lsjVmc,xUdipf,OTA3Ae,COQbmf,ws9Tlc,fKUV3e,aurFic,U0aPgd,LEikZe,NwH0H,OmgaI,gychg,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,KG2eXe,DsXBRb,zG9H6c,DfBslb Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.t3jBDWa8Ils.L.B1... Frame 1B08 136 KB
46 KB 79ms
25ms Script
text/javascript 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.t3jBDWa8Ils.L.B1.O/am=zgAAAQ/d=1/exm=_b,_r,_tp/excm=_b,_r,_tp,serviceiframeview/ed=1/wt=2/rs=ABXTjI6JZR7GdrYKo6_dAHQoksKPvvF_Ow/ee=cEt90b:ws9Tlc;QGR0gd:Mlhmy;uY49fb:COQbmf;yxTchf:KUM7Z;qddgKe:xQtZb;iFQyKf:vfuNJf;dIoSBb:SpsfSb;EmZ2Bf:zr1jrb;zxnPse:GkRiKb;NSEoX:lazG7b;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;Pjplud:EEDORb;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:VDovNc;sP4Vbe:VwDzFe;kMFpHd:OTA3Ae;NPKaK:SdcwHb;pXdRYb:MdUzUe;SNUn3:ZwDk9d;LBgRLc:SdcwHb;wR5FRb:O1Gjze/m=byfTOb,lsjVmc,xUdipf,OTA3Ae,COQbmf,ws9Tlc,fKUV3e,aurFic,U0aPgd,LEikZe,NwH0H,OmgaI,gychg,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,KG2eXe,DsXBRb,zG9H6c,DfBslb

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/am=zgAAAQ/d=1/excm=_b,_r,_tp,serviceiframeview/ed=1/dg=0/wt=2/rs=ABXTjI5CICNbKwcKdCR8HbaOfCL2tVyMtA/m=_b,_tp,_r

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d75f5431547273c870eab261222a101bec45db0c5908d9b666d21b5987bd4cac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 17:02:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118146
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46703
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 00:50:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/subscribewithgoogle-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/subscribewithgoogle-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/subscribewithgoogle-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Nov 2023 17:02:45 GMT

POST
H/1.1 200
OK / Show response
l.ffx.io/ 2 B
417 B 288ms
288ms XHR
text/plain 3.104.213.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.ffx.io/
Requested by: Host: www.afr.com
URL: https://www.afr.com/assets/vendors_client.40f5ee1884f9182a7bb7.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.213.201 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-213-201.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json

Response headers

Date: Sat, 05 Nov 2022 01:51:52 GMT
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Length: 2

OPTIONS
H/1.1 204
No Content /
l.ffx.io/ Frame 0
0 804ms
286ms Preflight 3.104.213.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.ffx.io/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.213.201 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-213-201.ap-southeast-2.compute.amazonaws.com
Software: nginx/1.15.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 0
Date: Sat, 05 Nov 2022 01:51:52 GMT
Server: nginx/1.15.9

GET
H/1.1

200
OK

ibs:dpid=358&dpuuid=2946786175838601581
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID
https://dpm.demdex.net/ibs:dpid=358&dpuuid=2946786175838601581

42 B
942 B

58ms
58ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=358&dpuuid=2946786175838601581

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-0ba4161da.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: a2lEmXAXRBc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Sat, 05 Nov 2022 01:51:51 GMT
AN-X-Request-Uuid: 66da839c-6939-4fcd-8dae-5e8163f0df31
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=2946786175838601581
Connection: keep-alive
X-Proxy-Origin: 192.145.127.217; 192.145.127.217; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ls.html Show response
cdn-gl.imrworldwide.com/novms/html/ Frame 7ED6 12 KB
4 KB 26ms
26ms Document
text/html 2600:9000:2240:fa00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:fa00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 2373
cache-control: max-age=86400
content-encoding: gzip
content-type: text/html
date: Sat, 05 Nov 2022 01:12:19 GMT
etag: W/"7fa83dfc7b78314b137e2eb13834daa7"
last-modified: Wed, 28 Sep 2022 14:09:00 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
x-amz-cf-id: TNe-Gzf_rZnzRMmZsZRTNufAy8C2is5hZAcp2XLUJ1znJGX-IwXu5A==
x-amz-cf-pop: FRA60-P1
x-amz-server-side-encryption: AES256
x-amz-version-id: kefD87rpNa3sUBHNjAEOkjjRzic54A4V
x-cache: Hit from cloudfront

GET
H2

200

m
secure-gl.imrworldwide.com/cgi-bin/
Redirect Chain

https://secure-gl.imrworldwide.com/cgi-bin/m?rnd=1667613111624&ci=f2&js=1&cg=0&ts=v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7Bge...
https://secure-gl.imrworldwide.com/cgi-bin/m?rnd=1667613111624&ci=f2&js=1&cg=0&ts=v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7Bge...

44 B
751 B

499ms
499ms

Image
image/gif

2600:9000:21f3:0:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?rnd=1667613111624&ci=f2&js=1&cg=0&ts=v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CE%24%3D!!t*8Wi_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-YHLM1%2B7Cex1YkaWe08ceLJHXkgPshLKyuz%2F4uhjkxPYPVB8OEV7WXRwEOC0dEk1CVCWz&rs=1-epp8RG4580cdYQ%3D%3D&sc=1&os=1-pA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&pcode=fairfaxheader492510264302&rx=495631879488&callback=MoatNadoAllJsonpRequest_19213284&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&sr=1600x1200&id=lstrg-07cb6dd6e20cd2a228e43f5cbb95d9d6&ja=1
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Server: 2600:9000:21f3:0:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:52 GMT
via: 1.1 27f665df26bde4a7226480b4a2890ff8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
cross-origin-resource-policy: cross-origin
content-length: 44
pragma: no-cache
server: nginx
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods: POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: SboRuiJw-17s3ZwRbqkSbJm6u_7zvz5P3Rrpfp47XcuKHjfThZFH2w==
expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

date: Sat, 05 Nov 2022 01:51:52 GMT
via: 1.1 27f665df26bde4a7226480b4a2890ff8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
cross-origin-resource-policy: cross-origin
content-length: 0
pragma: no-cache
server: nginx
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods: POST, OPTIONS
location: https://secure-gl.imrworldwide.com/cgi-bin/m?rnd=1667613111624&ci=f2&js=1&cg=0&ts=v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CE%24%3D!!t*8Wi_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-YHLM1%2B7Cex1YkaWe08ceLJHXkgPshLKyuz%2F4uhjkxPYPVB8OEV7WXRwEOC0dEk1CVCWz&rs=1-epp8RG4580cdYQ%3D%3D&sc=1&os=1-pA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&pcode=fairfaxheader492510264302&rx=495631879488&callback=MoatNadoAllJsonpRequest_19213284&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&sr=1600x1200&id=lstrg-07cb6dd6e20cd2a228e43f5cbb95d9d6&ja=1
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: QYo7Cqi0HaBSVDzcOYhZKM7UYopW3COXCMkc32N7zQtN26ItziGsTg==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=470&dpuuid=7417747602365040016
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjM2NTYzMjkvdC8y/url/https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D470%26dpuuid%3D%24!%7BTURN_UUID%7D
https://dpm.demdex.net/ibs:dpid=470&dpuuid=7417747602365040016

42 B
942 B

94ms
54ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=470&dpuuid=7417747602365040016

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v045-0f822ad5b.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: /Uxd98BWT/0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=470&dpuuid=7417747602365040016
pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 25ms
24ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=953970877989909&ev=PageView&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111635&cd[user.status]=visitor&cd[brand]=afr&cd[page.type]=article&cd[section.primaryCategory]=companies&cd[section.subCategory]=transport&cd[page.renderedPlatform]=WEB&cd[Container%20ID]=GTM-NN4PPKH&cd[page.name]=Qantas%20Joyce%20books%204m%20incentive%20despite%20protest%20vote&cd[page.primaryTag]=Aviation&cd[page.author]=Lucas%20Baird&cd[page.fullPageLoad]=true&cd[userAgent]=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F107.0.5304.87%20Safari%2F537.36&sw=1600&sh=1200&v=2.9.89&r=stable&ec=0&o=30&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 27ms
25ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=419599435931961&ev=Paywall&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111636&cd[eventCategory]=meter&cd[eventLabel]=inline&cd[eventAction]=meter%20impression&cd[userStatus]=visitor&sw=1600&sh=1200&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=1&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 28ms
26ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1831268437115893&ev=Paywall&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111636&cd[eventCategory]=meter&cd[eventLabel]=inline&cd[eventAction]=meter%20impression&cd[userStatus]=visitor&sw=1600&sh=1200&v=2.9.89&r=stable&ec=1&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 28ms
26ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=953970877989909&ev=Paywall&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111637&cd[eventCategory]=meter&cd[eventLabel]=inline&cd[eventAction]=meter%20impression&cd[userStatus]=visitor&sw=1600&sh=1200&v=2.9.89&r=stable&ec=1&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 28ms
27ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=419599435931961&ev=Metered%20Page%20Visitor&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111637&cd[eventCategory]=meter&cd[eventLabel]=inline&cd[userStatus]=visitor&sw=1600&sh=1200&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=2&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&exp=c0&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 29ms
27ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1831268437115893&ev=Metered%20Page%20Visitor&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111638&cd[eventCategory]=meter&cd[eventLabel]=inline&cd[userStatus]=visitor&sw=1600&sh=1200&v=2.9.89&r=stable&ec=2&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 29ms
28ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=953970877989909&ev=Metered%20Page%20Visitor&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613111639&cd[eventCategory]=meter&cd[eventLabel]=inline&cd[userStatus]=visitor&sw=1600&sh=1200&v=2.9.89&r=stable&ec=2&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame 05B2 0
214 B 149ms
27ms Image
text/plain 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=6404&puid=13941555003756582604119416608095394097&gdpr=0&gdpr_consent=
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ibs:dpid=466&dpuuid=%s
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://image5.pubmatic.com/AdServer/usersync/usersync.html?predirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=466%26dpuuid=PM_UID&userIdMacro=PM_UID
https://dpm.demdex.net/ibs:dpid=466&dpuuid=%s

42 B
960 B

49ms
48ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=466&dpuuid=%s

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-028e6f909.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: jTVX51KIQeM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
X-Error: 300,104
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
server: nginx
etag: "615e720b-cde"
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
location: https://dpm.demdex.net/ibs:dpid=466&dpuuid=%s
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
expires: Sat, 05 Nov 2022 01:51:51 GMT

GET
H2 200 gn
secure-dcr.imrworldwide.com/cgi-bin/ Frame 7ED6 44 B
720 B 110ms
54ms Image
image/gif 54.220.37.196
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-dcr.imrworldwide.com/cgi-bin/gn?prd=session&c9=devid,&c13=asid,P70F2B436-31E2-4369-A3CB-294DC350A880&sessionId=raazljxs9wqcwkjjgoxcckgqcctat1667613111&c16=sdkv,bj.6.0.0&uoo=&fp_id=pxqjgpwedmdwdxzcjcozsoc1lvcf11667613111&fp_cr_tm=1667613111620&fp_acc_tm=1667613111620&fp_emm_tm=1667613111620&ve_id=&c30=bldv,6.0.0.623&uid2=&uid2_token=&hem_sha256=&hem_sha1=&hem_md5=&hem_unknown=&sdd=&retry=0
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.220.37.196 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-220-37-196.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cdn-gl.imrworldwide.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
server: nginx
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-dcr.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 /
raazljxs9wqcwkjjgoxcckgqcctat1667613111.nuid.imrworldwide.com/ Frame 7ED6 35 B
350 B 125ms
26ms Image
image/gif 2600:9000:21f3:f800:1d:667e:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://raazljxs9wqcwkjjgoxcckgqcctat1667613111.nuid.imrworldwide.com/
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:f800:1d:667e:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://cdn-gl.imrworldwide.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 03:20:03 GMT
via: 1.1 784dd167d622737126ee2d76985e7d3c.cloudfront.net (CloudFront)
last-modified: Tue, 11 Sep 2018 17:05:20 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
age: 81109
etag: "c2196de8ba412c60c22ab491af7b1409"
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 35
x-amz-cf-id: HxZvgJKRV_IfCdihv5cGh67raA8xBHJk0GDSl7KEkw-Dsv6Bi1lOYA==

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESENDgBugVyaEmCqn10jcesWg&google_cver=1
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MTM5NDE1NTUwMDM3NTY1ODI2MDQxMTk0MTY2MDgwOTUzOTQwOTc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENDgBugVyaEmCqn10jcesWg&google_cver=1?gdpr=0&gdpr_consent=

42 B
942 B

55ms
54ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENDgBugVyaEmCqn10jcesWg&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-028e6f909.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Fxc4zLZqTCI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENDgBugVyaEmCqn10jcesWg&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m=bm51tf Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.t3jBDWa8Ils.L.B1... Frame 1B08 1 KB
734 B 26ms
26ms Script
text/javascript 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.t3jBDWa8Ils.L.B1.O/am=zgAAAQ/d=1/exm=COQbmf,DfBslb,DsXBRb,EEDORb,KG2eXe,LEikZe,Mlhmy,NwH0H,OTA3Ae,OmgaI,U0aPgd,ZfAoz,_b,_r,_tp,aurFic,byfTOb,fKUV3e,gychg,kWgXee,lsjVmc,ovKuLd,ws9Tlc,xUdipf,yDVVkb,zG9H6c/excm=_b,_r,_tp,serviceiframeview/ed=1/wt=2/rs=ABXTjI6JZR7GdrYKo6_dAHQoksKPvvF_Ow/ee=cEt90b:ws9Tlc;QGR0gd:Mlhmy;uY49fb:COQbmf;yxTchf:KUM7Z;qddgKe:xQtZb;iFQyKf:vfuNJf;dIoSBb:SpsfSb;EmZ2Bf:zr1jrb;zxnPse:GkRiKb;NSEoX:lazG7b;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;Pjplud:EEDORb;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:VDovNc;sP4Vbe:VwDzFe;kMFpHd:OTA3Ae;NPKaK:SdcwHb;pXdRYb:MdUzUe;SNUn3:ZwDk9d;LBgRLc:SdcwHb;wR5FRb:O1Gjze/m=bm51tf

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

15254dd87a884af18687c1467621929744ae141cdab9520ba37c404a764ae8a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 17:02:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118146
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 708
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 00:50:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/subscribewithgoogle-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/subscribewithgoogle-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/subscribewithgoogle-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Nov 2023 17:02:45 GMT

POST
H3 200 batchexecute Show response
news.google.com/swg/_/SubscribewithgoogleClientUi/data/ Frame 1B08 508 B
422 B 79ms
79ms XHR
application/json 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/_/SubscribewithgoogleClientUi/data/batchexecute?rpcids=SlvRf&source-path=%2Fswg%2Fui%2Fv1%2Fserviceiframe&f.sid=-1386546825514555864&bl=boq_subscribewithgoogleclientserver_20221102.06_p0&hl=it&soc-app=673&soc-platform=1&soc-device=1&_reqid=6712&rt=c

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

520c11c79404b60ea037e5aa85d67b983cab5ae79e14d50a0c94f0719d3356d7

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Same-Domain: 1
Referer: https://news.google.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-security-policy: require-trusted-types-for 'script';report-uri /swg/_/SubscribewithgoogleClientUi/cspreport
content-encoding: gzip
cross-origin-resource-policy: same-site
content-disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"SubscribewithgoogleClientUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/SubscribewithgoogleClientUi/external"}]}
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="SubscribewithgoogleClientUi"
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=782&dpuuid=Y2XBuAAAJ58t6gBa
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://rtd.tubemogul.com/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D
https://rtd-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D
https://rtd-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D&_test=Y2XBuAAAJ58t6gBa
https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y2XBuAAAJ58t6gBa

42 B
942 B

56ms
54ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y2XBuAAAJ58t6gBa

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v045-034f2d6c4.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: /XWsa615QI0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

x-served-by: cache-mxp6930-MXP
pragma: no-cache
date: Sat, 05 Nov 2022 01:51:52 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1667613112.096704,VS0,VE194
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://dpm.demdex.net/ibs:dpid=782&dpuuid=Y2XBuAAAJ58t6gBa
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
356 B 505ms
121ms XHR
text/plain 54.204.132.72
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/13780390039.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.204.132.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-204-132-72.compute-1.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Sat, 05 Nov 2022 01:51:52 GMT
Server: nginx/1.21.0
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.afr.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: 1eeb1f8f-27d5-463e-a451-e39cf1698a09

GET
H/1.1

200
OK

ibs:dpid=832&dpuuid=EUX6895644594180765557
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://sync.adap.tv/demdex_user_sync
https://dpm.demdex.net/ibs:dpid=832&dpuuid=EUX6895644594180765557

42 B
942 B

55ms
55ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=832&dpuuid=EUX6895644594180765557

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-008327e36.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: JA9L2++KSnQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: //dpm.demdex.net/ibs:dpid=832&dpuuid=EUX6895644594180765557
Server: ribs2.0
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.t3jBDWa8Ils.L.B1... Frame 1B08 17 KB
7 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.it.UW5SZ0T-m3g.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.t3jBDWa8Ils.L.B1.O/am=zgAAAQ/d=1/exm=COQbmf,DfBslb,DsXBRb,EEDORb,KG2eXe,LEikZe,Mlhmy,NwH0H,OTA3Ae,OmgaI,U0aPgd,ZfAoz,_b,_r,_tp,aurFic,bm51tf,byfTOb,fKUV3e,gychg,kWgXee,lsjVmc,ovKuLd,ws9Tlc,xUdipf,yDVVkb,zG9H6c/excm=_b,_r,_tp,serviceiframeview/ed=1/wt=2/rs=ABXTjI6JZR7GdrYKo6_dAHQoksKPvvF_Ow/ee=cEt90b:ws9Tlc;QGR0gd:Mlhmy;uY49fb:COQbmf;yxTchf:KUM7Z;qddgKe:xQtZb;iFQyKf:vfuNJf;dIoSBb:SpsfSb;EmZ2Bf:zr1jrb;zxnPse:GkRiKb;NSEoX:lazG7b;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;Pjplud:EEDORb;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:VDovNc;sP4Vbe:VwDzFe;kMFpHd:OTA3Ae;NPKaK:SdcwHb;pXdRYb:MdUzUe;SNUn3:ZwDk9d;LBgRLc:SdcwHb;wR5FRb:O1Gjze/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c839d180f945074def3b94ff1f04b2f841a0ff5191d7825a83a6a1b223e09e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 17:02:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118145
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7235
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 00:50:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/subscribewithgoogle-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/subscribewithgoogle-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/subscribewithgoogle-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Nov 2023 17:02:46 GMT

GET
H/1.1

200
OK

ibs:dpid=23728&dpuuid=Y2XBt2xNv71ka0P8NDCCgAAA%26664
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=183607&cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D23728%26dpuuid%3D__UID__&s=183607&C=1
https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y2XBt2xNv71ka0P8NDCCgAAA%26664

42 B
942 B

50ms
49ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y2XBt2xNv71ka0P8NDCCgAAA%26664

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-040129606.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: XDXn/WGwQ08=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:51 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=57ejdgoWcXOxKkr23BiOW9rQkjQLGLBFAqhzdawOH66Aq8IWWfUoQ3Y5fiFcuViA2WTg5jjdQHWPWavQks4%2BdfSD6zjQEwhFjyTNc0tuf9XKGqD%2FGMlki%2FMwL2afroSNqIt2ayzS"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y2XBt2xNv71ka0P8NDCCgAAA%26664
cache-control: no-cache
cf-ray: 7651f25d7b865a31-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1

200
OK

ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://ps.eyeota.net/match?bid=6j5b2cv&uid=13941555003756582604119416608095394097&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

42 B
960 B

120ms
52ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-0e1730cee.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: tG13lL3aQv4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
X-Error: 104,303
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=30064&dpuuid={UUID_6j5b2cv}
Date: Sat, 05 Nov 2022 01:51:51 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

POST
H2 200 log Show response
play.google.com/ Frame 1B08 131 B
672 B 99ms
34ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://news.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 05 Nov 2022 01:51:51 GMT

GET
DATA 200
OK truncated
/ 73 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 38814c5240d913c5270db8b8c3eae9f192489b2d2752b63c30562c4287f70015

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

ibs:dpid=30646
dpm.demdex.net/ Frame 05B2
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=13941555003756582604119416608095394097&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-b9HzexlE2pEYqraZzWYn_EjcVPtWEe9grLM-~A

42 B
942 B

54ms
54ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-b9HzexlE2pEYqraZzWYn_EjcVPtWEe9grLM-~A

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://fairfaxau.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v045-08dd6474c.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: D4WXSyEXRN4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Sat, 05 Nov 2022 01:51:51 GMT
strict-transport-security: max-age=31536000
via: http/1.1 spdc0101.pbp.ir2.yahoo.com (ApacheTrafficServer)
server: ATS
age: 0
content-type: text/html;charset=utf-8
location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-b9HzexlE2pEYqraZzWYn_EjcVPtWEe9grLM-~A
content-length: 0

POST
H3 200 / Show response
www.facebook.com/tr/ Frame A6A3 0
15 B 25ms
25ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.afr.com
Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.afr.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:51 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 c9c070611e48ff025fde3574a19c45c2627a710e
static.ffx.io/images/$zoom_0.566%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_400%2C$y_118/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/ 5 KB
5 KB 17ms
17ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.566%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_400%2C$y_118/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/c9c070611e48ff025fde3574a19c45c2627a710e
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 78ef5e038296dad3ddf1847d029ddfcba4df8cad9a35333bd27ba41021b6d861

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 89907
edge-cache-tag: 447940152532186866500955287187248586957,281268567778992740359416075236644991369,5f5f4219172da4ec8104790896b11172
cache-tag: 447940152532186866500955287187248586957,281268567778992740359416075236644991369,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="c9c070611e48ff025fde3574a19c45c2627a710e.webp"
content-length: 5092
x-cld-skey: 447940152532186866500955287187248586957 281268567778992740359416075236644991369 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6920-MXP, cache-mxp6946-MXP
last-modified: Fri, 21 Jan 2022 07:09:51 GMT
server: cloudinary
x-timer: S1667613112.826400,VS0,VE1
etag: "9e681a2a428a64d83c5fe5e9e6fb0e05"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 446b005e3408d36b6cdf9594981771a9b7e0e6d7
static.ffx.io/images/$zoom_0.1937%2C$multiply_4%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_95/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/ 3 KB
4 KB 194ms
193ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.1937%2C$multiply_4%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_95/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/446b005e3408d36b6cdf9594981771a9b7e0e6d7
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 966d07aa6eb120e4998d322d3a7401e2b44dd809bb2dbf726c3a3d957e582592

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:52 GMT
via: 1.1 varnish, 1.1 varnish
age: 0
edge-cache-tag: 448169529085126660082050909387298024617,444157635110089519531439644141309094712,5f5f4219172da4ec8104790896b11172
cache-tag: 448169529085126660082050909387298024617,444157635110089519531439644141309094712,5f5f4219172da4ec8104790896b11172
x-cache: MISS, MISS
content-disposition: inline; filename="446b005e3408d36b6cdf9594981771a9b7e0e6d7.webp"
content-length: 3132
x-cld-skey: 448169529085126660082050909387298024617 444157635110089519531439644141309094712 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6977-MXP, cache-mxp6946-MXP
last-modified: Thu, 20 Oct 2022 05:17:42 GMT
server: cloudinary
x-timer: S1667613112.826756,VS0,VE178
etag: "5a3a7f0773fb4b1c11ed8569e1f08c82"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 0

GET
H2 200 6479d034c51820e1a1640e5419c8c875af14b187
static.ffx.io/images/$zoom_1.4537%2C$multiply_1%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_0/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/ 5 KB
5 KB 17ms
17ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_1.4537%2C$multiply_1%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_0/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/6479d034c51820e1a1640e5419c8c875af14b187
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e46b26a9027dcad07cba908864cf088fa04c2aa6882f1cf5a5b9465d5a4a0440

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 133485
edge-cache-tag: 285538401885981767814665240412720396527,387548514645858171570149845106184053874,5f5f4219172da4ec8104790896b11172
cache-tag: 285538401885981767814665240412720396527,387548514645858171570149845106184053874,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="6479d034c51820e1a1640e5419c8c875af14b187.webp"
content-length: 4862
x-cld-skey: 285538401885981767814665240412720396527 387548514645858171570149845106184053874 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6937-MXP, cache-mxp6946-MXP
last-modified: Thu, 03 Nov 2022 10:34:53 GMT
server: cloudinary
x-timer: S1667613112.827077,VS0,VE1
etag: "e8e0c9edf83ef9623834ca0fab34c095"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 0669e4bbb0a4c3946b998346a3f75e1cd2be21e8
static.ffx.io/images/$zoom_0.2404%2C$multiply_3%2C$ratio_1.777778%2C$width_1059%2C$x_378%2C$y_183/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/ 3 KB
4 KB 17ms
17ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.2404%2C$multiply_3%2C$ratio_1.777778%2C$width_1059%2C$x_378%2C$y_183/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/0669e4bbb0a4c3946b998346a3f75e1cd2be21e8
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: b6c017d78d76f2b04d2fa1c926d5eb1ea63450ba59509a1e20ea62d060ee7650

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 269000
edge-cache-tag: 317141350564298608309877219787091650507,506173272974514770227355069006030356635,5f5f4219172da4ec8104790896b11172
cache-tag: 317141350564298608309877219787091650507,506173272974514770227355069006030356635,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="0669e4bbb0a4c3946b998346a3f75e1cd2be21e8.webp"
content-length: 3544
x-cld-skey: 317141350564298608309877219787091650507 506173272974514770227355069006030356635 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6965-MXP, cache-mxp6946-MXP
last-modified: Tue, 01 Nov 2022 18:03:16 GMT
server: cloudinary
x-timer: S1667613112.827577,VS0,VE1
etag: "c42c60163a51eca937e325c27f687918"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 3bb9c89d1ebae0f21b257689d1c28dc7efd3c665
static.ffx.io/images/$zoom_0.5298%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_72/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/ 3 KB
4 KB 17ms
16ms Image
image/webp 2a04:4e42::645
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.ffx.io/images/$zoom_0.5298%2C$multiply_2%2C$ratio_1.777778%2C$width_1059%2C$x_0%2C$y_72/t_crop_custom/c_scale%2Cw_140%2Cq_88%2Cf_auto/3bb9c89d1ebae0f21b257689d1c28dc7efd3c665
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 529825d1d3c52ebe538eb8aaa3e7f3d784262912c0de1d56c57519b95cce694d

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 250519
edge-cache-tag: 173429208902975188327038303554601056955,180830169370168871405141053760059560734,5f5f4219172da4ec8104790896b11172
cache-tag: 173429208902975188327038303554601056955,180830169370168871405141053760059560734,5f5f4219172da4ec8104790896b11172
x-cache: MISS, HIT
content-disposition: inline; filename="3bb9c89d1ebae0f21b257689d1c28dc7efd3c665.webp"
content-length: 3176
x-cld-skey: 173429208902975188327038303554601056955 180830169370168871405141053760059560734 5f5f4219172da4ec8104790896b11172
x-served-by: cache-mxp6923-MXP, cache-mxp6946-MXP
last-modified: Wed, 02 Nov 2022 04:08:24 GMT
server: cloudinary
x-timer: S1667613112.828586,VS0,VE1
etag: "8cbe25582f7e1b0b3f013d91d1b798ca"
vary: User-Agent
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

POST
H3 200 log Show response
play.google.com/ Frame 1B08 131 B
155 B 86ms
34ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://news.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 05 Nov 2022 01:51:51 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 90ms
32ms Preflight
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 1B08 131 B
155 B 86ms
35ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://news.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 05 Nov 2022 01:51:51 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 89ms
33ms Preflight
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 1B08 131 B
155 B 86ms
36ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://news.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 05 Nov 2022 01:51:51 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 89ms
33ms Preflight
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 1B08 131 B
155 B 87ms
36ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://news.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 05 Nov 2022 01:51:51 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 87ms
33ms Preflight
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 1B08 131 B
155 B 88ms
37ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://news.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 05 Nov 2022 01:51:51 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 85ms
32ms Preflight
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 1B08 131 B
155 B 86ms
35ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sat, 05 Nov 2022 01:51:51 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://news.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 05 Nov 2022 01:51:51 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 85ms
32ms Preflight
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://news.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://news.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/plain; charset=UTF-8
date: Sat, 05 Nov 2022 01:51:51 GMT
expires: Sat, 05 Nov 2022 01:51:51 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 hit.gif
au-script.dotmetrics.net/ 43 B
1 KB 771ms
770ms Image
image/gif 13.224.189.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://au-script.dotmetrics.net/hit.gif?id=12879&url=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&dom=www.afr.com&r=1667613111861&pvs=1&pvid=e7149b76-0a06-4dad-9ec4-2d582cdc4996&c=true&tzOffset=0
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-92.fra2.r.cloudfront.net
Software: Kestrel /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:52 GMT
dotmetrics-hit-status: 01 OK
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
server: Kestrel
x-amz-cf-pop: FRA2-C1
x-cache: Miss from cloudfront
p3p: policyref="https://au-script.dotmetrics.net/w3c/p3p.xml", CP="NOI DSP LAW CURa ADMa DEVa PSAa HISa OUR IND STA"
content-type: image/gif
cache-control: no-cache
x-amz-cf-id: lcsdQNO0aEA54RPAkU9vW0f7aZ2Ab8cLeCCu6YN0WGiyV0wv8Cidew==

GET
H2 200 script.js Show response
au-script.dotmetrics.net/Scripts/ 79 KB
33 KB 766ms
766ms Script
application/javascript 13.224.189.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://au-script.dotmetrics.net/Scripts/script.js?v=216
Requested by: Host: au-script.dotmetrics.net
URL: https://au-script.dotmetrics.net/door.js?d=www.afr.com&t=companies
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-92.fra2.r.cloudfront.net
Software: Kestrel /
Resource Hash: 2f323c23ab941c9e378e9d2152511d980d7a88ead0645133a98ecfe2027bbf61

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:52 GMT
content-encoding: br
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
last-modified: Fri, 04 Nov 2022 09:14:12 GMT
server: Kestrel
x-amz-cf-pop: FRA2-C1
etag: "1d8f02dcd8b3706"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
accept-ranges: bytes
x-amz-cf-id: hlb1q0IX0BstrBaXrrmiVmYJLU4XSXdzleqi7xbnPoynLsjIQ2XE8w==

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 3C97 0
15 B 25ms
25ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.afr.com
Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.afr.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:52 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 / Show response
adc.nine.com.au/ 89 B
528 B 1040ms
299ms Fetch
application/json 3.104.232.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://adc.nine.com.au/?

Requested by

Host: adc-js.nine.com.au
URL: https://adc-js.nine.com.au/adc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.104.232.90 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-104-232-90.ap-southeast-2.compute.amazonaws.com

Software

awselb/2.0 /

Resource Hash

20ce88f58a91adad7b3bcfc9f4098bb8e319c6511eff62b44b212c21127c6426

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Accept: application/json
Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
strict-transport-security: max-age=2592000
server: awselb/2.0
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin: https://www.afr.com
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
access-control-allow-credentials: true
content-length: 89

POST
H3 200 / Show response
www.facebook.com/tr/ Frame DE74 0
15 B 25ms
24ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.afr.com
Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.afr.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:52 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H/1.1 200
OK tp2 Show response
i.ffx.io/com.snowplowanalytics.snowplow/ 2 B
435 B 299ms
299ms XHR
text/plain 13.210.238.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ffx.io/com.snowplowanalytics.snowplow/tp2
Requested by: Host: d2uhnetoehh304.cloudfront.net
URL: https://d2uhnetoehh304.cloudfront.net/2.11.0-patched/sp.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.210.238.169 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-210-238-169.ap-southeast-2.compute.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Date: Sat, 05 Nov 2022 01:51:53 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: https://www.afr.com
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2

OPTIONS
H/1.1 200
OK tp2
i.ffx.io/com.snowplowanalytics.snowplow/ Frame 0
0 297ms
297ms Preflight 13.210.238.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ffx.io/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.210.238.169 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-210-238-169.ap-southeast-2.compute.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://www.afr.com
Connection: keep-alive
Content-Length: 0
Date: Sat, 05 Nov 2022 01:51:53 GMT
Server: akka-http/10.0.9

GET
H2

200

/ Show response
adc.nine.com.au/ Frame 4337
Redirect Chain

https://ib.adnxs.com/getuid?https://adc.nine.com.au?appNexusUid=$UID
https://adc.nine.com.au/?appNexusUid=2946786175838601581

89 B
451 B

302ms
302ms

Document
application/json

3.104.232.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://adc.nine.com.au/?appNexusUid=2946786175838601581

Requested by

Host: adc-js.nine.com.au
URL: https://adc-js.nine.com.au/adc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.104.232.90 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-104-232-90.ap-southeast-2.compute.amazonaws.com

Software

awselb/2.0 /

Resource Hash

20ce88f58a91adad7b3bcfc9f4098bb8e319c6511eff62b44b212c21127c6426

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private
content-length: 89
content-type: application/json; charset=utf-8
date: Sat, 05 Nov 2022 01:51:53 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
server: awselb/2.0
strict-transport-security: max-age=2592000

Redirect headers

AN-X-Request-Uuid: c23a1b83-34c4-40e7-ab14-5780d18b236b
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Sat, 05 Nov 2022 01:51:53 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://adc.nine.com.au?appNexusUid=2946786175838601581
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 192.145.127.217; 192.145.127.217; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H2 200 SiteEvent.dotmetrics Show response
au-script.dotmetrics.net/ 399 B
1 KB 275ms
275ms Script
application/javascript 13.224.189.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://au-script.dotmetrics.net/SiteEvent.dotmetrics?v=eyJpZCI6MTI4NzksImZsIjp0cnVlLCJkb20iOiJ3d3cuYWZyLmNvbSIsImxzbyI6bnVsbCwidXJsIjoiaHR0cHM6Ly93d3cuYWZyLmNvbS9jb21wYW5pZXMvdHJhbnNwb3J0L3FhbnRhcy1qb3ljZS1ib29rcy00bS1pbmNlbnRpdmUtZGVzcGl0ZS1wcm90ZXN0LXZvdGUtMjAyMjExMDQtcDVidmphIiwicnVybCI6IiIsInB2aWQiOiJlNzE0OWI3Ni0wYTA2LTRkYWQtOWVjNC0yZDU4MmNkYzQ5OTYiLCJ0ek9mZnNldCI6MCwib3NzIjp0cnVlLCJvc2VzIjp0cnVlfQ%3D%3D&r=1667613113332
Requested by: Host: au-script.dotmetrics.net
URL: https://au-script.dotmetrics.net/Scripts/script.js?v=216
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-92.fra2.r.cloudfront.net
Software: Kestrel /
Resource Hash: 1a3f80de0d2f972da68b0885f2f19e54d878166edb3d05e4f0f1b0faf93799ab

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
content-encoding: br
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
server: Kestrel
x-amz-cf-pop: FRA2-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
p3p: policyref="https://au-script.dotmetrics.net/w3c/p3p.xml", CP="NOI DSP LAW CURa ADMa DEVa PSAa HISa OUR IND STA"
content-type: application/javascript
cache-control: no-cache
x-amz-cf-id: zNWp1n2pIE92GLxzKyEjoKnBMDg7l5Fxjr2Q7iyRO2yjfZsndlKdrA==

GET
H2 200 / Show response
zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com/SIE/ 7 KB
4 KB 102ms
35ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_1zw3m3dlvZEzjE2

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3a2655f286167a5d3c7b9e519dedc6c3f5c28391dc8369f7f9bc75944a8ef7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 371779
cf-polished: origSize=8487
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"2127-3bQ1IXWyWJuoH9knL8A4zKE56Ss"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7651f2688de0839c-MXP
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 37 KB
15 KB 113ms
29ms Script
application/x-javascript 2600:9000:20eb:c000:18:1fcd:351:7bc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:c000:18:1fcd:351:7bc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 300706e57de1a7af148bd670379c4b39bb36dda8160e42d92747a3139af37816

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 00:49:25 GMT
content-encoding: gzip
via: 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
last-modified: Wed, 20 Jul 2022 00:50:34 GMT
server: nginx
x-amz-cf-pop: FRA2-C1
age: 3748
etag: W/"62d7515a-933f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=7200
cross-origin-resource-policy: cross-origin
x-amz-cf-id: ePSwndHFU3mdDm0b2KYf0Tipc2i3rONkEWh47LaeMI85ddBNCYqVnA==
expires: Sat, 05 Nov 2022 02:49:25 GMT

GET
H/1.1 200
OK dest5.html Show response
nd.demdex.net/ Frame E428 7 KB
3 KB 52ms
52ms Document
text/html 34.250.104.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://nd.demdex.net/dest5.html?d_nsid=0

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.250.104.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-250-104-41.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v045-00960800d.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: /XBnVa0UTeM=
content-encoding: gzip
date: Sat, 5 Nov 2022 01:51:53 GMT
last-modified: Fri, 28 Oct 2022 13:34:30 GMT
transfer-encoding: chunked
vary: accept-encoding

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 127ms
39ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022110101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da5f500acc677252cea8169993dc399e2e97daddc470605be6f10862a2399810

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11183
x-xss-protection: 0

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 116ms
114ms Script
application/javascript 2a00:1288:80:807::1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.afr.com
URL: https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:50:41 GMT
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding: gzip
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
x-amz-request-id: 3BD12WWRX1HQV7XR
age: 73
x-amz-server-side-encryption: AES256
x-amz-id-2: fyj5vEcmDg1Z7GEaNFnGG10SNrJ5xoXPiN7PozO69dJ00G7KYWJrj3nxbP/roO0Kpja/WlgEtrg=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 28ms
26ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=419599435931961&ev=Paywall&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613113617&sw=1600&sh=1200&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=4&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:53 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 28ms
27ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1831268437115893&ev=Paywall&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613113618&sw=1600&sh=1200&v=2.9.89&r=stable&ec=4&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:53 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ 0
15 B 29ms
28ms Image
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=953970877989909&ev=Paywall&dl=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&rl=&if=false&ts=1667613113619&sw=1600&sh=1200&v=2.9.89&r=stable&ec=4&o=29&fbp=fb.1.1667613111270.1695668977&it=1667613111052&coo=false&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 05 Nov 2022 01:51:53 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
291 B 55ms
54ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&b=Qantas%20CEO%20Alan%20Joyce%20books%20%244m%20incentive%20despite%20protest%20vote&.yp=10167916&f=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&enc=UTF-8&yv=1.13.0&tagmgr=gtm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:53 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Sat, 05 Nov 2022 01:51:53 GMT

GET
H2 200 11.ef6dd521fd8480c07042.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 61 KB
19 KB 31ms
29ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/11.ef6dd521fd8480c07042.chunk.js?Q_CLIENTVERSION=1.80.1&Q_CLIENTTYPE=web&Q_BRANDID=www.afr.com

Requested by

Host: zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com
URL: https://zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_1zw3m3dlvZEzjE2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa7fa15c5459ddf8fe98d6236c629700c3b4979c5d379ba2985b6851c68d23d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 111729
cf-polished: origSize=63601
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 25 Oct 2022 22:16:02 GMT
cf-bgj: minify
server: cloudflare
etag: W/"f871-184113784d0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7651f268ce04839c-MXP
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2

404

sync
ups.analytics.yahoo.com/ups/28/ Frame E428
Redirect Chain

https://pixel.advertising.com/ups/28/sync?uid=13692555445124439504139511981616357387&_origin=1&redir=true
https://ups.analytics.yahoo.com/ups/28/sync?uid=13692555445124439504139511981616357387&_origin=1&redir=true

0
258 B

56ms
29ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/28/sync?uid=13692555445124439504139511981616357387&_origin=1&redir=true

Protocol

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://nd.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/28/sync?uid=13692555445124439504139511981616357387&_origin=1&redir=true
date: Sat, 05 Nov 2022 01:51:53 GMT
cache-control: no-store
content-type: text/html
server: ATS/9.1.10.25
content-length: 389
content-language: en

GET
H2 200 ping
ping.chartbeat.net/ 43 B
201 B 346ms
112ms Image
image/gif 34.204.152.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=afr.com&p=%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&u=Cy1lDm-eoHWCJkJ8K&d=afr.com&g=27223&g0=companies%2C%20article&g1=Lucas%20Baird&g4=article&n=1&f=00001&c=0&x=0&m=0&y=3734&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&PA=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&b=3809&_s=%7B%22pageViewId%22%3A%22F31617EE-F973-45D2-B439-40DFA86F5D7F%22%7D&t=BGT_qLDTEUdFDTCa_Qc5uhhBW0UM3&V=136&i=Qantas%20Joyce%20books%204m%20incentive%20despite%20protest%20vote&tz=0&_acct=anon&sn=1&sv=CYl3USBHbDXrCS7_04D3NyNRRH6WI&sd=1&im=067b0ff3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.204.152.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-204-152-211.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 05 Nov 2022 01:51:54 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-length: 43
expires: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 91ms
33ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022110101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 05 Nov 2022 01:51:53 GMT

GET
H/1.1

200
OK

ibs:dpid=19566&dpuuid=%s
dpm.demdex.net/ Frame E428
Redirect Chain

https://image5.pubmatic.com/AdServer/usersync/usersync.html?predirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=19566%26dpuuid=PM_UID&userIdMacro=PM_UID
https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s

42 B
942 B

49ms
48ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://nd.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v045-06d6ad95b.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Egp1ubxkSrA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:53 GMT
server: nginx
etag: "615e720b-cde"
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
location: https://dpm.demdex.net/ibs:dpid=19566&dpuuid=%s
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
expires: Sat, 05 Nov 2022 01:51:53 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 3 KB
1 KB 173ms
173ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_1zw3m3dlvZEzjE2&Q_CLIENTVERSION=1.80.1&Q_CLIENTTYPE=web

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/11.ef6dd521fd8480c07042.chunk.js?Q_CLIENTVERSION=1.80.1&Q_CLIENTTYPE=web&Q_BRANDID=www.afr.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b71ebacb69286ae0edb0a8618a55907f402ff2299be342a3cfa096d72a47152

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.afr.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 05 Nov 2022 01:51:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.afr.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 71e35b294430c404
cf-ray: 7651f2690e36839c-MXP
timing-allow-origin: *

GET
H/1.1

200
OK

ibs:dpid=72352&dpuuid=3843851073705992210805&gdpr=0&gdpr_consent=
dpm.demdex.net/ Frame E428
Redirect Chain

https://dmpsync.3lift.com/getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://dmpsync.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://dpm.demdex.net/ibs:dpid=72352&dpuuid=3843851073705992210805&gdpr=0&gdpr_consent=

42 B
942 B

56ms
55ms

Image
image/gif

34.249.157.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=72352&dpuuid=3843851073705992210805&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

34.249.157.182 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-157-182.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://nd.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v045-00d8e63fa.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 86Z+YCSJQrc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=72352&dpuuid=3843851073705992210805&gdpr=0&gdpr_consent=
date: Sat, 05 Nov 2022 01:51:53 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame E428
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=adobe&id=13692555445124439504139511981616357387
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=13692555445124439504139511981616357387

0
339 B

159ms
48ms

Image
text/plain

52.210.36.224
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=13692555445124439504139511981616357387
Protocol: H2
Server: 52.210.36.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-36-224.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://nd.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-served-by: beacon-n008-dub-prod.krxd.net
date: Sat, 05 Nov 2022 01:51:54 GMT
cache-control: private, no-cache, no-store
x-request-time: D=32 t=1667613114
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=13692555445124439504139511981616357387
date: Sat, 05 Nov 2022 01:51:54 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a011-ash-prod.krxd.net

GET
H/1.1 200
OK u
dmp.v.fwmrm.net/ad/ Frame E428 0
361 B 495ms
107ms Image
text/html 2607:ae80:5::149
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.v.fwmrm.net/ad/u?mode=echo&cr=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D796%26dpuuid%3D%23%7Buser.id%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2607:ae80:5::149 , United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://nd.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

P3P: policyref="https://www.freewheel.tv/w3c/p3p.xml",CP="ALL DSP COR NID"
Pragma: no-cache
Date: Sat, 05 Nov 2022 01:51:54 GMT
Cache-Control: no-store
Expires: 0
Content-Length: 0
Content-Type: text/html

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0EDE 13 KB
5 KB 78ms
25ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
age: 7568
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 04 Nov 2022 23:45:45 GMT
expires: Sat, 04 Nov 2023 23:45:45 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6366 783 B
536 B 35ms
34ms Document
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7cb55ffdebf3040f2545c1b998523f2362795291a32d573447ea99f87e93060d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3BV0UcAr4izYd86g1E1CYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.afr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-3BV0UcAr4izYd86g1E1CYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 05 Nov 2022 01:51:53 GMT
expires: Sat, 05 Nov 2022 01:51:53 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6366 0
0 110ms
59ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022110101&jk=2281875772716836&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

GET
H3 200 PTWQOrfCOp17EyrMcPeT6PfhP85_faJCCfTgkqMfTIQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 0EDE 36 KB
16 KB 29ms
26ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PTWQOrfCOp17EyrMcPeT6PfhP85_faJCCfTgkqMfTIQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d35903ab7c23a9d7b132acc70f793e8f7e13fce7f7da24209f4e092a31f4c84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Fri, 04 Nov 2022 00:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91106
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16184
x-xss-protection: 0
last-modified: Thu, 20 Oct 2022 10:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Nov 2023 00:33:27 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0EDE 0
10 B 26ms
26ms Image
text/plain 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?m9bxfQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:51:54 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 gn
secure-dcr.imrworldwide.com/cgi-bin/ 44 B
596 B 53ms
53ms Image
image/gif 54.220.37.196
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-dcr.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=au-302812&ch=au-302812_b25_afr.com-brand%20only_S&asn=afr.com-brand%20only&fp_id=pxqjgpwedmdwdxzcjcozsoc1lvcf11667613111&fp_cr_tm=1667613111620&fp_acc_tm=1667613111620&fp_emm_tm=1667613111620&ve_id=&sessionId=raazljxs9wqcwkjjgoxcckgqcctat1667613111&prv=1&c6=vc,b25&ca=NA&c13=asid,P70F2B436-31E2-4369-A3CB-294DC350A880&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,afr&sup=1&segment2=&segment1=&forward=0&plugv=&playerv=&ad=0&cr=V&c9=devid,&enc=true&c1=nuid,xryemzc1zm4cx2stkvfyjrtg733qp1667613111&at=view&rt=text&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,16676131116168172&c30=bldv,6.0.0.623&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&pc=NA&c53=fef,n&c54=oad,&c55=cref3,&c57=adldf,2&ai=p5bvja&c3=st,c&c64=starttm,1667613113&adid=p5bvja&c58=isLive,false&c59=sesid,&c61=createtm,1667613113&c63=pipMode,&uoo=&c68=bndlid,&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c76=adbsnid,&c44=progen,&davty=0&si=https%3A%2F%2Fwww.afr.com%2Fcompanies%2Ftransport%2Fqantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja&c66=mediaurl,&sdd=&c62=sendTime,1667613113&rnd=771660
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.220.37.196 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-220-37-196.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Nov 2022 01:51:54 GMT
server: nginx
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-dcr.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 63ms
62ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022110101&jk=2281875772716836&bg=!6Oul66_NAAZPh4lnb4c7ACkAdvg8WlL9RJOvGHka60-gcWaL-fv2To1Pdcyf1tvJTjSMnK1QjfXcQAIAAABTUgAAAANoAQcKAMl5XDtLxKVNyafbr1usNmgelZ_dzFLzKm4wPvdu1Dk9nT6OkLI8If4dLHpmiRPT07QGSq1kd1HxopEseFpXTKbVyPKz-0VRXRKIlFIaZBvvcR7XowN_zAEgS6uNnr0kOJA79UhOd1MjhmULbEsN7SnfPNI_Iv5oZCoIAAZ9TDniQl68B5tl1EHNup0D0ezXU7wBVzpbnHUq0efQ4PJ3tmMqUFaBSzplKJOdP28mwnUjzmGiCHOPLIhQOvbqcGimztgAwHNcQ5xaDemZAp0-K5XfUj_oO9M2qrTnqEPoTXBfARYmM7kFwhVzx5rj0B5lR6LH7t1y5bSrpU2hyM3Cg3Bq26BnuuhwoCNaNOiWlJwVoURUxiiHDEd_DYWorPv3hzDMGdySVPyfZfonDz0dQyWCHbAhbsOgpzet3ZvkOQpaXJogts0LzUsSKDcMAxUeOVtQMOx24b9xY3akqRdTOA2Zj5IAj5zhMXHHCJkDKFWIywrGgoyPFY3xZGdPbeJDd8VaFvllhlfDuVm3HpMIVCVDhG397hkv-LfX3E7gS2dzJgGWTxBrsq5D1xaV6cYNOHHyWV2fNoyLjtUCLcNxiYX-YZj4FOKM6tPEPnARKCptcyI803VuqCi0-Yh5bAK3j0c8Hy6qqHiqO2hL__mP1pXCCkbR1JLGNSOtRD1QvFeI8iiUOh5nfD1-3a9mV44lgEJ0-KQDTVyYD2ozvZKJI7CAnmvIKeTQZH-9vRtkyJQyWktLIQKK0QVjcjNqsvUTTkNoVaO4sz8kTTjeiPfG9zIHpWTWNzwybOgnGAf2CZTSahoPcGoX5WIPvhYgS_Lr0ma3_i7GUQVcIf-SkwnTUt_xJeOh6wtzPZRDIYaWXj3cLICgu_AH7aR-YSj0fz1FRh_gw2j6GumkjR2WXmtmpfwi_DcMIFA-5L-WzcWZyEaDpwgVqyV7viZWYVolHf9_SlgNHbPpQO1NiwGKYJAc_Ab4NWX9-6GqWGrF-EUxxOrseboLhMy5CqtV9s3WtGB9oMpt4JFlOZYfR3g-ozP0rDae15ia_QLMDAlJfptwYXkmadIUnhQv9WorvES9F6rOg2mDp9wg_0NSpWQYwZfeeZYB544skUbJnEe748-nZD5TowWX9R_2rHcZXBFhrv5cR7CR65tlfIJVN54
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

OPTIONS
H/1.1 200
OK tp2
i.ffx.io/com.snowplowanalytics.snowplow/ Frame 0
0 297ms
297ms Preflight 13.210.238.169
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://i.ffx.io/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.210.238.169 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-210-238-169.ap-southeast-2.compute.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.afr.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://www.afr.com
Connection: keep-alive
Content-Length: 0
Date: Sat, 05 Nov 2022 01:51:58 GMT
Server: akka-http/10.0.9

POST tp2
i.ffx.io/com.snowplowanalytics.snowplow/ 0
0

GET
H2 200 1x1.png
p.afr.com/ 68 B
531 B 346ms
17ms Image
image/png 34.149.151.54

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.afr.com/1x1.png?adblockdetected=enabled&pageviewid=F31617EE-F973-45D2-B439-40DFA86F5D7F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.151.54 -, , ASN (),
Reverse DNS
Software: UploadServer /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.afr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Sat, 05 Nov 2022 01:28:45 GMT
age: 1393
x-guploader-uploadid: ADPycdvZA0LQgSXP3ABAupGWN94jFl_-VibH772NdokYdXNz_doVobiCT4Gh6WzlOShN1rhXaIBOzaQAEGhdFany4USqXp9Gl_tT
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
last-modified: Thu, 14 Oct 2021 21:35:53 GMT
server: UploadServer
etag: "91e42db1c66c0b276abf6234dc50b2eb"
x-goog-generation: 1634247353034335
x-goog-hash: crc32c=FWkPzg==, md5=keQtscZsCydqv2I03FCy6w==
content-type: image/png
cache-control: public,max-age=300
x-goog-stored-content-length: 68
accept-ranges: bytes

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: i.ffx.io
URL: https://i.ffx.io/com.snowplowanalytics.snowplow/tp2

Verdicts & Comments Add Verdict or Comment

204 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

68 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.afr.com/	1970-01-20 07:13:34	Name: _sp_ses.0af9 Value: *
.afr.com/	1970-01-20 16:49:33	Name: _sp_id.0af9 Value: 152d0e2d-51b7-44d8-a3c4-c0c470d46af2.1667613111.1.1667613111.1667613111.522cb651-8558-4af8-98ff-fc62166a69f3
.afr.com/	1970-01-20 11:32:45	Name: optimizelyEndUserId Value: oeu1667613110697r0.8503474340648487
.afr.com/	1970-01-20 09:23:09	Name: _gcl_au Value: 1.1.1587715341.1667613111
www.afr.com/	1969-12-31 23:59:59	Name: _bsMode Value: true
.afr.com/	1970-01-20 09:23:09	Name: _rdt_uuid Value: 1667613111039.ee59dc00-123e-4d01-9aa9-8f0baa946b42
.afr.com/	1970-01-20 16:49:33	Name: _ga Value: GA1.2.657732761.1667613111
.afr.com/	1970-01-20 07:14:59	Name: _gid Value: GA1.2.1461801601.1667613111
.afr.com/	1970-01-20 07:13:33	Name: _gat_ffxTracker Value: 1
.demdex.net/	1970-01-20 11:32:45	Name: demdex Value: 13941555003756582604119416608095394097
.doubleclick.net/	1970-01-20 16:35:09	Name: IDE Value: AHWqTUkaxKNUmf7dDVhkYUEJBrxAj4Wj6aGtXJmfaq8gIkEXN9V2ZH4X54Oc9xdX3cg
.afr.com/	1969-12-31 23:59:59	Name: AMCVS_BEB5C8A15492DB600A4C98BC%40AdobeOrg Value: 1
.afr.com/	1970-01-20 09:23:09	Name: _fbp Value: fb.1.1667613111270.1695668977
.www.afr.com/	1970-01-20 07:14:59	Name: ln_or Value: d
.t.co/	1970-01-20 16:49:33	Name: muc_ads Value: 3b9f3523-150a-4b75-8f01-f403f037400a
.afr.com/	1970-01-20 15:59:09	Name: AMCV_BEB5C8A15492DB600A4C98BC%40AdobeOrg Value: -1176276602%7CMCIDTS%7C19302%7CMCMID%7C13720711878759880134141202686927639560%7CMCAAMLH-1668217911%7C6%7CMCAAMB-1668217911%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1667620311s%7CNONE%7CMCAID%7CNONE
.linkedin.com/	1970-01-20 07:56:45	Name: UserMatchHistory Value: AQIu2cbukp0GpwAAAYRFfLRADs2bIVQeFdEa0TfdeQxxm7TQt0P34Xfbd9jB5Crp21bPc4lh5STMfQ
.linkedin.com/	1970-01-20 07:56:45	Name: AnalyticsSyncHistory Value: AQJAkIDbDNlgUQAAAYRFfLRAE1TaEUxr7SLRrafyjvwcvAjSCDqxRqb4j86Rg7wJotrGJqmV9tgupEDjTn_sdA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 15:59:09	Name: bcookie Value: "v=2&f33845ea-0c99-431d-80c9-67cb25e5557e"
.linkedin.com/	1970-01-20 07:14:59	Name: lidc Value: "b=TGST03:s=T:r=T:a=T:p=T:g=2866:u=1:x=1:i=1667613111:t=1667699511:v=2:sig=AQEyOBvCGCpvNQK6R9O1QfGLLs4RQxki"
.afr.com/	1970-01-20 15:59:09	Name: _hjSessionUser_182799 Value: eyJpZCI6IjgxYTc2YzVkLWMwNTAtNTY2ZS1iNGFmLWU0NDI2ZGM4Y2I1ZSIsImNyZWF0ZWQiOjE2Njc2MTMxMTEzNjIsImV4aXN0aW5nIjpmYWxzZX0=
.afr.com/	1970-01-20 07:13:34	Name: _hjFirstSeen Value: 1
www.afr.com/	1970-01-20 07:13:33	Name: _hjIncludedInSessionSample Value: 1
.afr.com/	1970-01-20 07:13:34	Name: _hjSession_182799 Value: eyJpZCI6Ijg4NmRlMmM0LTBhOTAtNGVhZi04ZDMwLTBmZWE1NGRlNmE5YSIsImNyZWF0ZWQiOjE2Njc2MTMxMTE0NzAsImluU2FtcGxlIjp0cnVlfQ==
.afr.com/	1970-01-20 07:13:34	Name: _hjAbsoluteSessionInProgress Value: 1
.afr.com/	1970-01-20 07:56:45	Name: aam_uuid Value: 13692555445124439504139511981616357387
.twitter.com/	1970-01-20 16:49:33	Name: guest_id_marketing Value: v1%3A166761311147797012
.twitter.com/	1970-01-20 16:49:33	Name: guest_id_ads Value: v1%3A166761311147797012
.twitter.com/	1970-01-20 16:49:33	Name: personalization_id Value: "v1_ZMU/auUChkec0Jz8oIsMow=="
.twitter.com/	1970-01-20 16:49:33	Name: guest_id Value: v1%3A166761311147797012
.afr.com/	1970-01-20 07:13:34	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://www.afr.com/companies/transport/qantas-joyce-books-4m-incentive-despite-protest-vote-20221104-p5bvja%22%2C%22sref%22:%22%22%2C%22sts%22:1667613111555%2C%22slts%22:0}
.afr.com/	1970-01-20 16:42:57	Name: _parsely_visitor Value: {%22id%22:%22pid=0392550dc682b3e6be1f248be8fa3b65%22%2C%22session_count%22:1%2C%22last_session_ts%22:1667613111555}
.afr.com/	1970-01-20 11:32:45	Name: nol_fpid Value: pxqjgpwedmdwdxzcjcozsoc1lvcf11667613111\|1667613111620\|1667613111620\|1667613111620
.igodigital.com/	1970-01-20 16:49:33	Name: igodigitaltc2 Value: 6ae8a56e-5cac-11ed-b614-aeb554264a5d
.igodigital.com/	1970-01-20 07:13:36	Name: igodigitalst_10510523 Value: 6ae8ad20-5cac-11ed-b614-aeb554264a5d
.igodigital.com/	1970-01-20 07:13:36	Name: igodigitalstdomain Value: 6484
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=it-it
.www.linkedin.com/	1970-01-20 15:59:09	Name: bscookie Value: "v=1&20221105015151db4ab0f8-3375-4f4d-8905-66cd3df8705aAQGJfVYS9jouNVPYRmfbh3T1OML-b4Fl"
.linkedin.com/	1970-01-20 11:32:45	Name: li_gc Value: MTswOzE2Njc2MTMxMTE7MjswMjEb0r11chJchr1BJaEESCCpuQHAtju1KdjEpADhqi9VKA==
.adnxs.com/	1970-01-20 09:23:09	Name: uuid2 Value: 2946786175838601581
.yahoo.com/	1970-01-20 15:59:30	Name: A3 Value: d=AQABBLfBZWMCEOVPUTrCD_ElaapTejCETpEFEgEBAQETZ2NvYwAAAAAA_eMAAA&S=AQAAAoDtxnVjaZLl92tBg1a88Yc
.dpm.demdex.net/	1970-01-20 11:32:45	Name: dpm Value: 13941555003756582604119416608095394097
.turn.com/	1970-01-20 11:32:45	Name: uid Value: 7417747602365040016
.afr.com/	1970-01-20 16:35:09	Name: __gads Value: ID=080e9731a296e677:T=1667613111:S=ALNI_MYgcu-xfUIbs6pVcs5_eicCqBYSbA
.afr.com/	1970-01-20 16:35:09	Name: __gpi Value: UID=00000b7cb0952623:T=1667613111:RT=1667613111:S=ALNI_Mb5JToknvwJDDIsGtQsZDlvsUKYAA
.eyeota.net/	1970-01-20 07:13:33	Name: SERVERID Value: 23859~DM
.casalemedia.com/	1970-01-20 15:59:09	Name: CMID Value: Y2XBt2xNv71ka0P8NDCCgAAA
.casalemedia.com/	1970-01-20 09:23:09	Name: CMPS Value: 664
.casalemedia.com/	1970-01-20 09:23:09	Name: CMPRO Value: 664
.casalemedia.com/	1970-01-20 09:23:09	Name: CMTS Value: 1852
.everesttech.net/	1970-01-20 15:59:09	Name: everest_g_v2 Value: g_surferid~Y2XBuAAAJ58t6gBa
.imrworldwide.com/	1970-01-20 16:35:09	Name: IMRID Value: 6b2858d0-5cac-11ed-b506-25aa9fc53f41
.dotmetrics.net/	1970-01-20 15:59:09	Name: DotMetrics.DeviceKey Value: DeviceID=
.dotmetrics.net/	1970-01-20 15:59:09	Name: DotMetrics.UniqueUserIdentityCookie Value: UserID=5477ac1a-c461-46fd-bfe0-0c4b8005f574&Created=11/05/2022 01:51:52&UserMode=0&guid=a9fde150-79e1-4e0e-8bba-eadd5c42ecfa&ver=1
.nine.com.au/	1970-01-20 15:59:09	Name: NUID Value: fcecc98246404afd95400192fbb8c042
.afr.com/	1970-01-20 15:59:09	Name: NUID Value: fcecc98246404afd95400192fbb8c042
www.afr.com/	1969-12-31 23:59:59	Name: DM_SitId1503 Value: 1
www.afr.com/	1969-12-31 23:59:59	Name: DM_SitId1503SecId12879 Value: 1
au-script.dotmetrics.net/	1970-01-20 07:23:37	Name: AWSALBCORS Value: eHF5YcPUkXeWu+mmaNybgKNeZFUFbIpu8t/Ljb3hVxGnMXgTYc+eLyMK+ekuM97guW8Zlw0mQH5ot4bgVipDMZYFMu22UpgzbpK1pZwP/olCHR8xUkNZkYLXTrjQ
.afr.com/	1970-01-20 16:42:21	Name: _cb Value: Cy1lDm-eoHWCJkJ8K
.afr.com/	1970-01-20 16:42:21	Name: _chartbeat2 Value: .1667613113736.1667613113736.1.CYl3USBHbDXrCS7_04D3NyNRRH6WI.1
.afr.com/	1970-01-20 07:13:34	Name: _cb_svref Value: null
.demdex.net/	1970-01-20 11:32:45	Name: dextp Value: 358-1-1667613111605\|470-1-1667613111630\|481-1-1667613111642\|466-1-1667613111666\|771-1-1667613111674\|782-1-1667613111711\|832-1-1667613111725\|23728-1-1667613111739\|30064-1-1667613111754\|30646-1-1667613111813\|6835-1-1667613113723\|19566-1-1667613113753\|72352-1-1667613113783\|66757-1-1667613113798\|796-1-1667613113814
.advertising.com/	1970-01-20 15:59:30	Name: A3 Value: d=AQABBLnBZWMCEAuMZVbPf0GEIoyypkAB1f4FEgEBAQETZ2NvYwAAAAAA_eMAAA&S=AQAAAtR-BxOcQ-984vH-wuFi7uQ
.3lift.com/	1970-01-20 09:23:09	Name: tluid Value: 3843851073705992210805
.fwmrm.net/	1970-01-20 11:32:45	Name: _uid Value: "a149_7162343787010974680"
.krxd.net/	1970-01-20 11:32:45	Name: _kuid_ Value: PLgUQKzw

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	error	URL: https://www.afr.com/assets/vendorsReactRedux_client.f60fbcbb803f16bccc3c.chunk.js(Line 24) Message: Error: <rect> attribute width: A negative value is not valid. ("-40")
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://api.afr.com/api/content/v0/assets/p5bvnc Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://api.afr.com/api/content/v0/assets/p5bv7t Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ups.analytics.yahoo.com/ups/28/sync?uid=13692555445124439504139511981616357387&_origin=1&redir=true Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10510523.collect.igodigital.com
12281244.fls.doubleclick.net
12393262.fls.doubleclick.net
7875bd8cec82421e2902fdac676555a6.safeframe.googlesyndication.com
a304207300.cdn.optimizely.com
ad.doubleclick.net
adc-js.nine.com.au
adc.nine.com.au
adservice.google.com
adservice.google.it
alb.reddit.com
analytics.twitter.com
api.afr.com
apis.google.com
au-script.dotmetrics.net
beacon.krxd.net
cdn-gl.imrworldwide.com
cdn.linkedin.oribi.io
cdn.optimizely.com
cdn.parsely.com
cm.g.doubleclick.net
cms.analytics.yahoo.com
connect.facebook.net
d.turn.com
d2uhnetoehh304.cloudfront.net
dmp.v.fwmrm.net
dmpsync.3lift.com
dpm.demdex.net
fairfaxau.demdex.net
fairfaxau.sc.omtrdc.net
fairfaxmedia.gscontxt.net
fonts.gstatic.com
googleads.g.doubleclick.net
i.ffx.io
ib.adnxs.com
image5.pubmatic.com
l.ffx.io
logx.optimizely.com
mb.moatads.com
nd.demdex.net
news.google.com
nova.collect.igodigital.com
p.afr.com
p1.parsely.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.advertising.com
play.google.com
ps.eyeota.net
px.ads.linkedin.com
px4.ads.linkedin.com
raazljxs9wqcwkjjgoxcckgqcctat1667613111.nuid.imrworldwide.com
rtd-tm.everesttech.net
rtd.tubemogul.com
s.yimg.com
script.hotjar.com
secure-au.imrworldwide.com
secure-dcr.imrworldwide.com
secure-gl.imrworldwide.com
securepubads.g.doubleclick.net
siteintercept.qualtrics.com
sjs.bizographics.com
snap.licdn.com
sp.analytics.yahoo.com
ssum.casalemedia.com
static-au.plista.com
static.ads-twitter.com
static.chartbeat.com
static.ffx.io
static.hotjar.com
stats.g.doubleclick.net
sync.adap.tv
t.co
token.rubiconproject.com
tpc.googlesyndication.com
ups.analytics.yahoo.com
usermatch.krxd.net
vars.hotjar.com
vc.hotjar.io
www.afr.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.it
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.redditstatic.com
z.moatads.com
zn1zw3m3dlvzezje2-nineresearch.siteintercept.qualtrics.com
i.ffx.io
104.17.209.240
104.18.19.126
104.244.42.5
104.244.42.67
13.107.42.14
13.210.238.169
13.224.189.10
13.224.189.123
13.224.189.92
13.225.78.105
13.225.78.63
13.225.85.39
13.248.245.213
136.243.44.4
142.250.185.134
142.250.185.98
144.21.37.35
146.75.116.157
15.236.176.210
151.101.129.140
151.101.130.49
151.101.194.49
172.217.23.102
18.156.0.31
18.66.2.12
184.24.5.146
185.89.210.212
2001:4860:4802:36::178
2001:678:cb4:bbbb::13
212.82.100.181
212.82.100.182
23.35.237.151
2600:9000:20eb:c000:18:1fcd:351:7bc1
2600:9000:21f3:0:1e:a43d:b640:93a1
2600:9000:21f3:f800:1d:667e:2a40:93a1
2600:9000:223c:2200:7:3896:c640:93a1
2600:9000:2240:fa00:2:42d9:3100:93a1
2600:9000:2394:4a00:10:2964:9d00:21
2607:ae80:5::149
2620:1ec:21::14
2a00:1288:80:807::1
2a00:1450:4001:802::2002
2a00:1450:4001:80b::2003
2a00:1450:4001:80b::2004
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::200e
2a00:1450:4001:810::2002
2a00:1450:4001:812::2002
2a00:1450:4001:827::2001
2a00:1450:4001:828::2001
2a00:1450:4001:828::200e
2a00:1450:4001:82a::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2008
2a00:1450:4001:830::200e
2a00:1450:4001:831::2003
2a00:1450:400c:c07::9b
2a02:26f0:3500:889::13b8
2a02:26f0:780::5f65:3671
2a02:26f0:780::5f65:367a
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42:400::396
2a04:4e42:600::645
2a04:4e42::645
3.104.213.201
3.104.232.90
3.125.70.222
34.149.151.54
34.199.0.186
34.204.152.211
34.240.95.84
34.249.157.182
34.250.104.41
34.253.119.106
44.195.168.154
52.210.36.224
54.204.132.72
54.220.37.196
54.85.225.242
63.34.81.234
69.173.144.165
88.221.168.201
050d11df639f898653841637b53b863839a8f4ec169889d09102a205f98a5ebd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
07a7e43a30c29cd24df54879f4fc788b60a76962f3b3c5623717c19762240225
0a0b35d63dfb5e8c4d01e458ba528e6b49b4974a03ab55c201ae94cdfc426b9c
0cdeaf8a5f6202e7647efd02bd6640bd176506a30513bf6275ea77cb8c2a59db
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
104a311a40dcc24006744eb0b31bd26a1bb3f7c1c805f013320336ac49de0911
108f3ee093be28b330bb270cec80a53d8edbb2fa55bd27b02770cc38c5580729
1111bb046c4dad330cde53241f07a128d28de0d4da7fea8e9aa26d0d8f4914e0
117ed873640b992e38f34a0a761dd3e1cda6b3c24c9507bb3adc0323039f8ff1
143997bc04dd0aeef29624286d2afc177342404a1e80323076cd718b911340b8
15254dd87a884af18687c1467621929744ae141cdab9520ba37c404a764ae8a9
187d3d34e55b45bf7e4d3062ea96a376b90906bfeb60825f5058875266ff11e9
1a3f80de0d2f972da68b0885f2f19e54d878166edb3d05e4f0f1b0faf93799ab
20ce88f58a91adad7b3bcfc9f4098bb8e319c6511eff62b44b212c21127c6426
22f872dc74c8877572311708159df69b6e85a646d0a773a697918f5e9e7ec805
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
26654ed4ccbca63ecf0eb1eaf9b8a5f2b02e850e55c3e779e9d7d0d609975bdf
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
290cafc1d0e290a6ed09095eec3d831770f273b85298c704df503e9d5a0f2dd0
2d0ade31483bf44bbdbc9822066eaebf674738b370092fcfc8295e7ae3195d98
2d5eb494a1667c93f703bf1ad8b2621bebd954d90e15b086757fb47131230f37
2f1b3c20947609880fa669248919d46ad2b26b995cd8f7e2f3d764dff3e47bdb
2f323c23ab941c9e378e9d2152511d980d7a88ead0645133a98ecfe2027bbf61
300706e57de1a7af148bd670379c4b39bb36dda8160e42d92747a3139af37816
32865971bb6a23bcf03abe6002f701b47214f0b3b82f0e4ac60deeb6607b9e8f
338140f080782dd9fc999b9c240cde15f599e7ffd10b3fd3d9085717d38ad8d3
38814c5240d913c5270db8b8c3eae9f192489b2d2752b63c30562c4287f70015
39eb62961f683cb8bf00a27737530e01c1d59003deb71aa3a91237b9388d4073
3c839d180f945074def3b94ff1f04b2f841a0ff5191d7825a83a6a1b223e09e5
3d35903ab7c23a9d7b132acc70f793e8f7e13fce7f7da24209f4e092a31f4c84
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f50a1ccb55e595667f30077ae38364f5d3eab17837057fd32a0e2bc13cd9013
410d88728abf5cc4c86ffe9d6ca4fad8d1bf5c82b718869f5a2c50a6cd35ae64
430d1161adea15af5a99102340e870262390269670f34c36f89402ffbc9d42b7
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
463faad63e59f653f8367ca1bd38629a240ebd4f2165c313e660933acc322b04
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
49d65831c7e98a7d885d223699a41198204329efff9d1904c8af71323f613d68
4da83a4a1b92935b33948cdee4036db7630f5e7c833b41492d5b4b634de38ffa
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
520c11c79404b60ea037e5aa85d67b983cab5ae79e14d50a0c94f0719d3356d7
529825d1d3c52ebe538eb8aaa3e7f3d784262912c0de1d56c57519b95cce694d
54b3121637851046e882df8591a9f2c4472adc2f0c39290cd583e9fccf1aace0
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
65c93c54493488439390c91f835ffadc736e0b617a99fbc4871a8e4b0a1a37e8
690ce2319c300a1b3b8f1a3264640fe917963d53a48f09b61677b0cb8a31025d
6ab6abd4d172d87657a928d55d0664ab2ef68e3c4ef0b9d189926bebabfde225
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b71ebacb69286ae0edb0a8618a55907f402ff2299be342a3cfa096d72a47152
714892f1fc598fef48b0331e7af69cdac69bfb2cec684d199b8650da4a278c75
7456219e58132f5fb71f133c52b6871b53694402fb16f7f60586ac56711a9be7
78ef5e038296dad3ddf1847d029ddfcba4df8cad9a35333bd27ba41021b6d861
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7cb55ffdebf3040f2545c1b998523f2362795291a32d573447ea99f87e93060d
7db1145a7ec687b72f47d21b1e33e89cdebcedad75b5f37585470c3a3936001d
81cbdc276e9a2b8607a20c3020a73465538c4f3119de40f72563be6b91bfb432
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83d6eb63792b184bbe2715ea8f52c929d68dffd598e0e44c0c342c1f6c2f2fe8
85b23ef2b5d148948a0e393c8af051177f818b7fb18cda003998916666caabee
87caefb9fb06a896d9a415f36342907f9a1563c46b338207697768578b453552
8b72c10e7cef9d58e030a96817fa2c3e896fa60311541d575d7d27c3c1b693bd
8c08ae8d2532333ec1b09ab09cf176842b1f770ad9000e583cb96b90b0784e07
8cec4b0f3f90243f3acb7dfa8740e904bfab43a6c95d546731a119719b4eece6
8d3daa16486c1201d63e7faca59f6a74fdc6f70d69454efe14fd3ebeed5d44ed
934d4d6010b2bfc6795c8212555ff307c8e883a8fa5f974f601773d4f17e156f
966d07aa6eb120e4998d322d3a7401e2b44dd809bb2dbf726c3a3d957e582592
97244fdc464b19592f897622016af89b6d6923ee004b9d225d12010a09224578
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98d219b71719a22544b086bde1ec538fd7678bdd8f11266db494bd619e59b08c
a0084043f26a51ea743463b4a653e4850cbaae0868832e4471a199f753fc6b27
a05c8438580b24666efb2d734df0e4d4543cfb5c38bad5f2ebc90d5f98d2fd79
a302d1c675cc09580fb510a92bfc643b841f74fafb4c2733237d1774f00549a5
a3a2655f286167a5d3c7b9e519dedc6c3f5c28391dc8369f7f9bc75944a8ef7b
a3c78596628f7e53c40bbfd0e9eed225181c4c2933a6e051e8fa46c30b221d1f
a44fb6a26732b7892f2802aee69fb0413ecd26b508b5c79720a48c485f4889ee
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a7ba354697d9dcbd1116c8a8b5473f9bf6ce9b680d15c0ff29aa7143cf66f45a
a8a6d62b3d32f3dcbd0868ded7f2e882d76fcee2d581415398adc61aa3b27807
a8a794dd208864c93b29276b44b554f364c9fa194e61568d4c9fca2fb9c0438f
aa394c77e56df8c9b63628bd1c302f489faf2df27d47700c92188f1076e81946
abcf1f6bf18be92a1da8a7f69cb947bbd24766f153e97dfe89429497292c2043
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3
af788498d8b2bfa626b3a8af1d0a9d17e457ab7f6877e696eb6e0358ae566b16
b1864744d73d4e0543e8b54d5fa0f9e2917bde5142e7f540572b05e0db62fba8
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b4cd4f889e2c7dd71da12d2b0a29aa6346de2e5d8b3c882d7700d64c700f661d
b6c017d78d76f2b04d2fa1c926d5eb1ea63450ba59509a1e20ea62d060ee7650
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
bae6f4ba8c378551c65ab6d766b94bf331b017b9d275790a141297bab8c21764
bcf86c48df6f76b921cce4d3b354c52312027494dbac002cf58ff39ca8593ff5
bd411c282a41f2967f5db7ec0b4c9d8ea6eb6b95b26b5507f2889c8c37fd8043
c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1
c429b056c18833dd3d7fe28ab8ba904526ad1375398ffac0a0e4f2d278e1ac43
c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc
c99bb554f568a8bfa9c4ebf178407e1fe47e531cd6f1a8f520d3b5c6942deb50
cb57d1571f5f6066db04f2b96665052692382aa5eee2a8e77286ea2cc9d317b0
cbfc040de2d45c04515697a5096c0c84b5357e24da2e8b89ec58def23dd61ea9
ce331bf5c6c5e330f399d37e697146dd66cbc23038c122adba0b3cd3b1fe2781
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0e041b0ff4b76f99250a2beebd04d625207e604627703f3420045fc0478736d
d226e59228596b7a5ee8b2b58cb401a7df9618df22b7c98e7d1e305145ab02be
d2667aa38599ee0de5244f5ea6aa603484f9cbaf6fea5bfe67d9d15cc7daa731
d40a30b3514e8d68293acf23fc30ce5c3706dc12e35d01398b0d371c94838a50
d75f5431547273c870eab261222a101bec45db0c5908d9b666d21b5987bd4cac
da052f369234699bc3db2d7484b1c2d8d546c7ed0d423145ec5a6318ce1e2118
da5f500acc677252cea8169993dc399e2e97daddc470605be6f10862a2399810
dacc31ea0ac0633ee543f5d44f5048e8dc1f39a462fc428ad233077505ca1715
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dcf426eeed18fa7b759dba107fa8b186ea4bd01e7cf19a4c181cd4fb084d09a8
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e259ce5f9c5928acd8a4814950b7085ce5519c2ca9fc97cc1131fbcb434160cc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4233cd36263120f7994dd660cf38faa774f2cf40285016f1aa0c389ebb1ded5
e46b26a9027dcad07cba908864cf088fa04c2aa6882f1cf5a5b9465d5a4a0440
e89cdbdc1a8aac6e7f4dca82e84fa74495dc7d05185b625d15ab4061dab99fe8
e8a2bc039ea82266ecd31dcb748fe90f212f6358fcf2502eb0061d9652b3638f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1b15bac6b0ac8792055088c7b5b402397063759313079f052f1abe039baee02
f4ab6372f3e66d92a70aab85aee716115173d6d132b0afbe1d2b0bebb9b6551c
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d
f6d9b08f6f1c48ccfc8f6ad4a587093ef81cdb753f6299b758ea62a2c2b749fe
f75b1cf1cb396419751a3f00768026a2e90779ed24437de8d82c1e1551cb7805
f896040524443394b8b1ba4fbd1de94be74378ab901e53b3b40c1323d1735143
fa7fa15c5459ddf8fe98d6236c629700c3b4979c5d379ba2985b6851c68d23d6
fa84adaa52138db2f2ca946b1e3ce31105a39a9a1f1b5fb25ad456241c2d0e73

www.afr.com Open in urlscan Pro 2a04:4e42::645 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

217 Requests

92 %HTTPS

42 %IPv6

52 Domains

90 Subdomains

70 IPs

9 Countries

2506 kBTransfer

7781 kBSize

68 Cookies

20 Outgoing links

Redirected requests

217 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.afr.com Open in urlscan Pro
2a04:4e42::645 Public Scan

Screenshot
Live screenshot

Full Image

217
Requests

92 %
HTTPS

42 %
IPv6

52
Domains

90
Subdomains

70
IPs

9
Countries

2506 kB
Transfer

7781 kB
Size

68
Cookies

217 HTTP transactions
2 data transactions