ercreliefclaim.com Open in urlscan Pro
2606:4700:3033::ac43:9985 Public Scan

Software

BunnyCDN-DE1-756 /

Resource Hash

8796e1b1f79080cbb8112a0cf3d1d6cb6ff8dd4b096a323b1486d1702f41020d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 12/27/2021 05:59:36
cdn-pullzone: 173232
content-encoding: br
vary: Accept-Encoding, Accept-Encoding
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Tue, 21 Dec 2021 17:21:40 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"5c36-17dde0354a0"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: application/javascript; charset=UTF-8
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: 9f1145cb79ec82fe0ba71d2e8a1be9c4
cdn-requestcountrycode: RO
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 video-js.min.css
cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame 04C8 39 KB
9 KB 33ms
16ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video-js.min.css

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91f94a3c7e05d1c1afd01260e88ebea5be6720ed3514c7a82bba96a33d4d6b21

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 447091
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 9046
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:35 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401f-9c5c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cw1AG3GgZr2v5BJpzrZupHOiDeWxv7SHWxWR2e5wjJo%2BJM9h9oncgTJVqZ2BIOQJh2OfhTND1R%2FLW%2FgmP%2FwwDIIK8pkejcFCcDwTA0hcerizVldD%2F0Z4X8%2BhTAxVOCx6vrQoavyQKEZRsGJjO2sWZvoo"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6cc39094ec3d68e5-FRA
expires: Mon, 02 Jan 2023 04:15:37 GMT

GET
H2 200 video.min.js Show response
cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame 04C8 470 KB
106 KB 64ms
47ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video.min.js

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19bd09a46cd5735572bec1a138df1d0c1d408767e59c890581a417bdfcd29b25

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 447414
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 107564
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:35 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401f-757c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rYb58NCM6TDiuQWFsyx8jcEsX28YBG%2FdPPue4fQGjKnOPSocVD9ZSFJcVJ4oYN86rrLkim4HTp6IcoWkRvPq8z41YfWhrpNo05uFUhq4QP0b5Ca4HEp67pi3HY1fWJaQ6LMsxmmPMeIlaLYpWvhgFiU%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6cc39094ec4268e5-FRA
expires: Mon, 02 Jan 2023 04:15:37 GMT

GET
H2 200 videojs-ie8.min.js Show response
cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/ Frame 04C8 19 KB
6 KB 53ms
36ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/videojs-ie8.min.js

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cdefb09aa8ed6fcfcb5ee50239a85d38f1a700653ce9f0420878508c07925ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2887479
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 5911
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:34 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401e-4a99"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M4TVJCOytOXYDx3kPJllCMyXK9T3o0QcuS5%2BzQw87IMdiwmZyZy%2FOBqiNquSHS82M9FZNXlcILsdpApcsDSOPayZM8zOeZmceuDk8ysqc1wlR2EqHgJAVmvJdlfAMg6QNSW05CKFWCY8o3owF1ud%2BG1H"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6cc39094ec4668e5-FRA
expires: Mon, 02 Jan 2023 04:15:37 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 04C8 12 KB
791 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;0,900;1,400&display=swap

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

135ddf3be68cbef0e9cceae5236cc19c7d000626bfb1eeb22f2848b16bc956d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 04:15:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 12 Jan 2022 04:15:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 12 Jan 2022 04:15:37 GMT

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ Frame 04C8 70 KB
4 KB 31ms
14ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3481180
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4216
timing-allow-origin: *
last-modified: Mon, 07 Sep 2020 12:33:38 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f5628a2-11846"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MM9AI2hTAj%2BdDenaUBFGdvA0vDK0yjnJ9VLvHBBKMxWeBCeSmi%2BzLswChK0nCr0RZCKKwRewbjPjV2K7AbIhaPxM2vFkyMTC6CooO4Zb9AZ4z6NJmE0z6Fd0JcBXzbIFIe2SHuGFUHht7uwFVOuaJzMJ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6cc39094ec3f68e5-FRA
expires: Mon, 02 Jan 2023 04:15:37 GMT

GET
H2 200 app.5289ed73.css
app.groove.cm/groovevideo/css/ Frame 04C8 43 KB
8 KB 16ms
16ms Stylesheet
text/css 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/css/app.5289ed73.css
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e93c88b87ebb29a55695fad7b336a693c2da57a78ef0829c8bcc66b567789ba3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jan 2022 17:54:05 GMT
server: cloudflare
age: 651
etag: W/"61ddc43d-acdc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P3NCQKryFLSNZHrZ3FuRyoR4yM4vDtVI4wEZ3BveeI%2Bp696ySqOJPp26wBPgJXVyFoHskJRdYfGFRvUNd8c0zUU9ypdAOll93cqd9LFvAOgaLsQMizXlzT9AuE6ewbPJo5zfQ%2B5F%2F51uRGbZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc39094db5a4e7f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 chunk-vendors.7d18e09b.css
app.groove.cm/groovevideo/css/ Frame 04C8 2 MB
210 KB 23ms
22ms Stylesheet
text/css 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/css/chunk-vendors.7d18e09b.css
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49652c9fbd54b6e0e1bd952aaa5adb97324526b4a334460898b058c4202ddaad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jan 2022 17:54:05 GMT
server: cloudflare
age: 651
etag: W/"61ddc43d-1e279f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4qqQKJkr2TrQy08YWiSAZGtUGmDHPMcq%2F1iYomz0fCLvfBp1MfT7SjFsr1Dx%2FcI55sdFRj%2FgErVeh6NGyLcQRGeVPAf000fnCm7qfntX%2FLu6d961AmP1Oc4zzEFVfIXmCfVfIiuYCdF6A0pX"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc39094db5b4e7f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 app.5792b017.js Show response
app.groove.cm/groovevideo/js/ Frame 04C8 1 MB
264 KB 26ms
26ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/js/app.5792b017.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c01fc95f5b644528d7595a313e7c153e331514b3892008b3227df9ee2a6d49f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jan 2022 17:54:05 GMT
server: cloudflare
age: 651
etag: W/"61ddc43d-15cb81"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ygSs1X0BfZ2ichGkyUqHQnpqlnZ%2F5YkGvXpD6UL8ZZUgzRoq3FPfa3QXeT35K7UoS2oQoaVAFXteU6NKjp0fFssNZrhZDiEfmtI3HlQVygJRdPSFWu%2Fo%2Fz3xAhUTekR1rBB1ZewvtrTS%2B7Ca"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc39094db5c4e7f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 chunk-vendors.eaa3258b.js Show response
app.groove.cm/groovevideo/js/ Frame 04C8 7 MB
2 MB 34ms
34ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8737e0289a1be4f4d49e23da346de700dab5f3b9529aac5ceb63e7703c573409

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jan 2022 17:54:05 GMT
server: cloudflare
age: 651
etag: W/"61ddc43d-6c32ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FblgMqLzajC0JtJJlGqHGACupWsdsH4l%2FzJC9ECtrimHOTAjAc8zu%2B0oEeboBVgVDZAEdBpHrWfmPcS2%2FKt8KuuJrWcBGTlVFVHetKgz0LmUHnCy52aBsRJ1rJVpLVHDLlsCrvwitLJTbtFZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc39094db5d4e7f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 widget.min.js Show response
cdn.productstash.io/js/ Frame 04C8 23 KB
6 KB 30ms
8ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.productstash.io/js/widget.min.js?v=0.8

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

BunnyCDN-DE1-756 /

Resource Hash

8796e1b1f79080cbb8112a0cf3d1d6cb6ff8dd4b096a323b1486d1702f41020d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 12/27/2021 05:59:36
cdn-pullzone: 173232
content-encoding: br
vary: Accept-Encoding, Accept-Encoding
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Tue, 21 Dec 2021 17:21:40 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"5c36-17dde0354a0"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: application/javascript; charset=UTF-8
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: 4d479e809c19218875e474398dabb619
cdn-requestcountrycode: RO
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame FA74 200 KB
70 KB 54ms
26ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5e41e344732c26e848088aff18808ebb8c250d2b166c00a7db45574be63bb421

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70785
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 12 Jan 2022 04:15:37 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame FA74 714 KB
136 KB 18ms
17ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/css/chunk-vendors.7d18e09b.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8615f60f1519e184f3a22fab7142efe31143e1a7c7ae08c43774d2384c2e9161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 03:53:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 12 Jan 2022 04:15:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 12 Jan 2022 04:15:37 GMT

GET
BLOB 200
OK 04e7281c-ab76-41c7-ae1f-efb10b745ed0
https://app.groove.cm/ Frame FA74 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/04e7281c-ab76-41c7-ae1f-efb10b745ed0
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 04C8 200 KB
69 KB 36ms
19ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5e41e344732c26e848088aff18808ebb8c250d2b166c00a7db45574be63bb421

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70785
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 12 Jan 2022 04:15:37 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 04C8 714 KB
136 KB 37ms
36ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/css/chunk-vendors.7d18e09b.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8615f60f1519e184f3a22fab7142efe31143e1a7c7ae08c43774d2384c2e9161

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 04:15:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 12 Jan 2022 04:15:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 12 Jan 2022 04:15:37 GMT

GET
BLOB 200
OK 04b32bdc-5679-4051-ab21-42c56446c23d
https://app.groove.cm/ Frame 04C8 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/04b32bdc-5679-4051-ab21-42c56446c23d
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H2 200 jquery-ui.css
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ Frame 2473 36 KB
9 KB 29ms
7ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 01:39:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8422
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Jan 2023 01:39:43 GMT

GET
H2 200 fonts8.css
fs22.formsite.com/include/form/ Frame 2473 20 KB
5 KB 203ms
202ms Stylesheet
text/css 18.213.184.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/fonts8.css?796339930573
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.184.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-184-107.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9221b2c07e1ad6a168982f0fbb342131b2e96c0ebe5902d98653d3a546a34632

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
last-modified: Thu, 21 Oct 2021 13:46:26 GMT
server: Apache
etag: "4e63-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4202
expires: Wed, 19 Jan 2022 04:15:38 GMT

GET
H2 200 screen8.css
fs22.formsite.com/include/form/ Frame 2473 20 KB
9 KB 103ms
102ms Stylesheet
text/css 18.213.184.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/screen8.css?796339930573
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.184.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-184-107.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 6b223bb6c3fb8210034350b25e704c74c30d87756cdda5432b4649483e366e78

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "4f2f-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 8161
expires: Wed, 19 Jan 2022 04:15:38 GMT

GET
H2 200 responsive8.css
fs22.formsite.com/include/form/ Frame 2473 3 KB
1 KB 103ms
102ms Stylesheet
text/css 18.213.184.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/responsive8.css?796339930573
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.184.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-184-107.compute-1.amazonaws.com
Software: Apache /
Resource Hash: faa7999a9bc916746448d20ba389c7360faea9bc01a9e53fc08275e565cbf399

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "bb2-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 876
expires: Wed, 19 Jan 2022 04:15:38 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ Frame 2473 87 KB
30 KB 29ms
8ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 23:36:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16726
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 11 Jan 2023 23:36:52 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ Frame 2473 248 KB
66 KB 36ms
15ms Script
text/javascript 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 02:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7139
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Jan 2023 02:16:39 GMT

GET
H2 200 form8.js Show response
fs22.formsite.com/include/form/ Frame 2473 27 KB
8 KB 203ms
202ms Script
application/javascript 18.213.184.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/form8.js?796339930573
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.184.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-184-107.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 7b47ae80afa3203ba35b6f17e9a9c0641ac3f8f5d37b3ae9f01f06730b1e7ae6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "6c5c-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 7457
expires: Wed, 19 Jan 2022 04:15:38 GMT

GET
H2 200 embed.js Show response
fs22.formsite.com/include/form/ Frame 2473 2 KB
1 KB 203ms
203ms Script
application/javascript 18.213.184.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/embed.js
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.184.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-184-107.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9bf76c0981f3d7cb30be16f19b1419bad27dbccc3c5c5496cd1c84982e756dd8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
last-modified: Mon, 30 Mar 2020 16:25:53 GMT
server: Apache
etag: "8fe-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 855
expires: Wed, 19 Jan 2022 04:15:38 GMT

GET
H2 200 print8.css
fs22.formsite.com/include/form/ Frame 2473 375 B
764 B 102ms
101ms Stylesheet
text/css 18.213.184.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/print8.css?796339930573
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.213.184.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-184-107.compute-1.amazonaws.com
Software: Apache /
Resource Hash: fe096c1a1b3636490559c3e3d5c51dedcfed669ef95394071a765d922937dc6d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc8eLrX2OJLdKeABRcuSTk7w&2139323432&EmbedId=2139323432
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: gzip
last-modified: Mon, 01 Apr 2019 18:07:07 GMT
server: Apache
etag: "177-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 200
expires: Wed, 19 Jan 2022 04:15:39 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame FA74 166 KB
61 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VQKC5VQTH1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fd1e39ccdf72992021b26e21d3905c95f9190c6130c0590c63600c91f8db0393

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62750
x-xss-protection: 0
expires: Wed, 12 Jan 2022 04:15:38 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame FA74 49 KB
20 KB 31ms
7ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2444
date: Wed, 12 Jan 2022 03:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 12 Jan 2022 05:34:54 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame FA74 38 KB
15 KB 591ms
246ms Script
text/javascript 142.250.181.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fjr04s05-in-f2.1e100.net

Software

cafe /

Resource Hash

1fe7c9b04cd9ebd46cd5a636bd2c2b1d54054f3995db24951c0d0318ec71d70c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14835
x-xss-protection: 0
server: cafe
etag: 2630088915750441828
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 12 Jan 2022 04:15:38 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame FA74 15 KB
6 KB 37ms
8ms Script
application/javascript 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

be008c63ddefca3ce28657d3bec71467649a1cd0d6d83631ba31fe61e82bef6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 12 Jan 2022 04:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5733
x-amz-id-2: xhM4Xgc57BaeT0jdXghJCHOosjN6kvixPxAqEVyYJQ7VR8yn71UpQ2Je0qU8lOQmzWOxIu9TZ0o=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 11 Feb 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 06 Jan 2022 11:58:19 GMT
server: ATS
etag: "5e3751507a07e4eab1dc62336254faa3-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: E7NEFYZAA1G5MV0Q
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: yimss6le6oItGvrWNEatTw9Yuf3OpsiL
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 bat.js Show response
bat.bing.com/ Frame FA74 36 KB
10 KB 52ms
31ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: gzip
last-modified: Fri, 03 Dec 2021 01:53:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4A31DC641B8947378BA90BA66D1F1831 Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:38Z
etag: "0cb09ee8e7d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10468

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ Frame FA74 40 KB
13 KB 58ms
19ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/ld.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

4758ffc00e2d3413aece1a57fc3e89b9709202312386d57eb74b5c198cf6800e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 12:51:58 GMT
server: nginx
etag: W/"61b8936e-9faf"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 13 Jan 2022 04:15:38 GMT

GET
H2 200 universal-script Show response
175592.tracking.hyros.com/v1/lst/ Frame FA74 0
170 B 330ms
98ms Script
text/plain 52.70.96.75
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-96-75.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
access-control-allow-credentials: true
content-length: 0
access-control-max-age: 86400
access-control-allow-methods: GET, PUT, POST, OPTIONS, DELETE
access-control-expose-headers: Session-ID

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 04C8 166 KB
61 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VQKC5VQTH1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fd1e39ccdf72992021b26e21d3905c95f9190c6130c0590c63600c91f8db0393

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62750
x-xss-protection: 0
expires: Wed, 12 Jan 2022 04:15:38 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 04C8 49 KB
20 KB 25ms
9ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2444
date: Wed, 12 Jan 2022 03:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 12 Jan 2022 05:34:54 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 04C8 38 KB
15 KB 710ms
373ms Script
text/javascript 142.250.181.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fjr04s05-in-f2.1e100.net

Software

cafe /

Resource Hash

1fe7c9b04cd9ebd46cd5a636bd2c2b1d54054f3995db24951c0d0318ec71d70c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14835
x-xss-protection: 0
server: cafe
etag: 2630088915750441828
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 12 Jan 2022 04:15:38 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame 04C8 15 KB
6 KB 30ms
9ms Script
application/javascript 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

be008c63ddefca3ce28657d3bec71467649a1cd0d6d83631ba31fe61e82bef6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 12 Jan 2022 04:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5733
x-amz-id-2: xhM4Xgc57BaeT0jdXghJCHOosjN6kvixPxAqEVyYJQ7VR8yn71UpQ2Je0qU8lOQmzWOxIu9TZ0o=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 11 Feb 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 06 Jan 2022 11:58:19 GMT
server: ATS
etag: "5e3751507a07e4eab1dc62336254faa3-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: E7NEFYZAA1G5MV0Q
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: yimss6le6oItGvrWNEatTw9Yuf3OpsiL
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 bat.js Show response
bat.bing.com/ Frame 04C8 36 KB
11 KB 43ms
29ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:37 GMT
content-encoding: gzip
last-modified: Fri, 03 Dec 2021 01:53:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0CA5AC24F49849B8A1169BF8B26FC9DF Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:38Z
etag: "0cb09ee8e7d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10468

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ Frame 04C8 40 KB
13 KB 68ms
36ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/ld.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

4758ffc00e2d3413aece1a57fc3e89b9709202312386d57eb74b5c198cf6800e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 12:51:58 GMT
server: nginx
etag: W/"61b8936e-9faf"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 13 Jan 2022 04:15:38 GMT

GET
H2 200 universal-script Show response
175592.tracking.hyros.com/v1/lst/ Frame 04C8 0
169 B 327ms
101ms Script
text/plain 52.70.96.75
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.70.96.75 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-96-75.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
access-control-allow-credentials: true
content-length: 0
access-control-max-age: 86400
access-control-allow-methods: GET, PUT, POST, OPTIONS, DELETE
access-control-expose-headers: Session-ID

OPTIONS
H/1.1 204
No Content ping
api.loopedin.io/v1/users/ Frame 0
0 119ms
30ms Preflight 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: Cowboy
Connection: keep-alive
Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
X-Dns-Prefetch-Control: off
Expect-Ct: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer
X-Xss-Protection: 0
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Headers: Content-Type,Authorization
Content-Length: 0
Date: Wed, 12 Jan 2022 04:15:38 GMT
Via: 1.1 vegur

GET
H2 200 iframe_api Show response
www.youtube.com/ Frame FA74 980 B
1 KB 47ms
25ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7cba4888800d0b93e3bbec3967bfbdc8a66b4fec3d3e1afecfa2015dd0de42a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"
expires: Wed, 12 Jan 2022 04:15:38 GMT

GET
H3 200 matomo.js Show response
matomo.groovetech.io/ Frame FA74 100 KB
33 KB 17ms
17ms Script
application/javascript 2606:4700:3034::ac43:b25c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b25c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68fed142b211b51c4d2e9b610dd4d09bc4812739b5beaa63535d88e38e90a946

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 21 Jul 2020 21:11:02 GMT
server: cloudflare
age: 1905
etag: W/"19167-5aafa0f820d0f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QBjXdOZYrxvoliuqyUPwjoSIaJk5nb7gtfIarCB%2B1ip%2F%2F5laZkXOftYOQaYgu91jTBjSOP%2B3BGcKcWrZaM5TezePZEUdU2xwcyVTV%2BEvD9%2FCr3tmReT7MCSmdVcaZeOWjWhlbXo%2BXlOWkN3b4OVMO715tA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc390990825703f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
BLOB 200
OK a29eb6c0-47a4-4b08-a6b6-5996222cf5c9 Show response
https://app.groove.cm/ Frame FA74 97 B
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/a29eb6c0-47a4-4b08-a6b6-5996222cf5c9
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07a3bc19329a99fa0b7ec7482092a84232ce73dadf684903f2b046f287ff7bb9

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 97
Content-Type: text/javascript

POST
H/1.1 200
OK ping Show response
api.loopedin.io/v1/users/ Frame FA74 3 B
1 KB 30ms
30ms Fetch
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Wed, 12 Jan 2022 04:15:38 GMT
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
X-Frame-Options: SAMEORIGIN
Etag: W/"3-n5rwKVhboBTgfNORDKl2z1YWBhY"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 48
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1641960956
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H/1.1 200
OK app-config Show response
api.loopedin.io/ Frame FA74 525 B
2 KB 125ms
33ms XHR
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/app-config?product_id=f634edf5-70e7-429d-8c94-c26dfaeaee26&timestamp=0&public=true&user=public&domain=app.groove.cm

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

2d4fd9284f07de9bf7456fa126660dfe493e2e3c7faf5f7d5c8ab6dcb9b52a35

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Wed, 12 Jan 2022 04:15:38 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=15552000; includeSubDomains
Vary: Accept-Encoding
Content-Length: 525
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
Etag: W/"20d-IqsYcYx6mEJIl8/aTyvwwKH+3G8"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 49
Access-Control-Allow-Methods: GET
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1641960956
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H2 200 notification.png
cdn.productstash.io/images/ Frame FA74 1 KB
2 KB 7ms
6ms Image
image/png 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.productstash.io/images/notification.png

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

BunnyCDN-DE1-756 /

Resource Hash

87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 12/27/2021 13:11:50
cdn-pullzone: 173232
content-length: 1156
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Tue, 21 Dec 2021 17:21:40 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"484-17dde0354a0"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: image/png
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: 1da02771c50875eb911017171b23b276
accept-ranges: bytes
cdn-requestcountrycode: RO
cdn-status: 200
cdn-requestpullsuccess: True

OPTIONS
H/1.1 204
No Content ping
api.loopedin.io/v1/users/ Frame 0
0 30ms
30ms Preflight 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: Cowboy
Connection: keep-alive
Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
X-Dns-Prefetch-Control: off
Expect-Ct: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer
X-Xss-Protection: 0
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Headers: Content-Type,Authorization
Content-Length: 0
Date: Wed, 12 Jan 2022 04:15:38 GMT
Via: 1.1 vegur

GET
H3 200 iframe_api Show response
www.youtube.com/ Frame 04C8 980 B
513 B 38ms
23ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7cba4888800d0b93e3bbec3967bfbdc8a66b4fec3d3e1afecfa2015dd0de42a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"
expires: Wed, 12 Jan 2022 04:15:38 GMT

GET
H3 200 matomo.js Show response
matomo.groovetech.io/ Frame 04C8 100 KB
33 KB 18ms
18ms Script
application/javascript 2606:4700:3034::ac43:b25c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b25c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68fed142b211b51c4d2e9b610dd4d09bc4812739b5beaa63535d88e38e90a946

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 21 Jul 2020 21:11:02 GMT
server: cloudflare
age: 1905
etag: W/"19167-5aafa0f820d0f-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FB%2FCPofKG3neQQUUCcmXiIszCvbqpNRXKaC%2FCF9QJ0ikmsSnugHimVfm7w%2BqNQFokmICwFwqwQm%2FDk5XterHV7Dk29k6BZZHaN8ybc4ZZ4epTSlCbuJPpff57VM8%2B4hUCqbmYbK0v3OkQVVMEJT78Tl96A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc3909c1d79703f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
BLOB 200
OK c56c79c6-7bbc-4713-b2f3-af8c7b4f4202 Show response
https://app.groove.cm/ Frame 04C8 98 B
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/c56c79c6-7bbc-4713-b2f3-af8c7b4f4202
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31c853024abc997cbe04e2715c52afdfb18face995146d57178495667334b04c

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 98
Content-Type: text/javascript

GET
H2 200 notification.png
cdn.productstash.io/images/ Frame 04C8 1 KB
2 KB 7ms
7ms Image
image/png 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.productstash.io/images/notification.png

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

Software

BunnyCDN-DE1-756 /

Resource Hash

87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 756
x-dns-prefetch-control: off
cdn-cachedat: 12/27/2021 13:11:50
cdn-pullzone: 173232
content-length: 1156
x-xss-protection: 1; mode=block
server: BunnyCDN-DE1-756
last-modified: Tue, 21 Dec 2021 17:21:40 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"484-17dde0354a0"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: image/png
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: c781864c0aac7c1d395fe4076a2fe590
accept-ranges: bytes
cdn-requestcountrycode: RO
cdn-status: 200
cdn-requestpullsuccess: True

POST
H/1.1 200
OK ping Show response
api.loopedin.io/v1/users/ Frame 04C8 3 B
1 KB 30ms
30ms Fetch
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Wed, 12 Jan 2022 04:15:38 GMT
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
X-Frame-Options: SAMEORIGIN
Etag: W/"3-n5rwKVhboBTgfNORDKl2z1YWBhY"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 46
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1641960956
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H/1.1 200
OK app-config Show response
api.loopedin.io/ Frame 04C8 525 B
2 KB 33ms
33ms XHR
application/json 108.128.72.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/app-config?product_id=f634edf5-70e7-429d-8c94-c26dfaeaee26&timestamp=0&public=true&user=public&domain=app.groove.cm

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.128.72.146 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy /

Resource Hash

2d4fd9284f07de9bf7456fa126660dfe493e2e3c7faf5f7d5c8ab6dcb9b52a35

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Wed, 12 Jan 2022 04:15:38 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=15552000; includeSubDomains
Vary: Accept-Encoding
Content-Length: 525
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
Etag: W/"20d-IqsYcYx6mEJIl8/aTyvwwKH+3G8"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 47
Access-Control-Allow-Methods: GET
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1641960956
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H3 200 0dTEPzkLWceF7z0koJaX1A.woff2
fonts.gstatic.com/s/raleway/v22/ Frame 2473 46 KB
46 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v22/0dTEPzkLWceF7z0koJaX1A.woff2

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/include/form/fonts8.css?796339930573

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fs22.formsite.com/
Origin: https://fs22.formsite.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 23:01:21 GMT
x-content-type-options: nosniff
age: 537257
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47312
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 19:40:31 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 05 Jan 2023 23:01:21 GMT

GET
H2 200 config.js Show response
app.groove.cm/config/ Frame FA74 324 B
508 B 14ms
14ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/config/config.js
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jan 2022 19:40:01 GMT
server: cloudflare
age: 651
etag: W/"61dddd11-144"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2pzNfLlxPk764Ct5Cf6sggKRGqv6PjzwoEG6I0uMA0vrzUXUSse1bCixaJV%2BZtzmavqim3ZY3vf3cpBAzW%2B5kjYWuwdg7IlDMmSAWnw4J1qOPbe0qGydUI5mgG1yPy7wy9WVVbMLgkSgRYqQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc3909c7c8a4e7f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 10139345.json Show response
s.yimg.com/wi/config/ Frame FA74 2 B
449 B 64ms
23ms XHR
application/json 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10139345.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:01 GMT
x-content-type-options: nosniff
age: 38
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: VF5JFV3EN3D8JB9J
x-amz-id-2: sfaQX6KCzsFss9KRdNRcLScTstnWrgqzplMNmM1E8Sx4Ku+3ZnMFVCMimBQynhvItzISWh4oCRU=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 10139345.json Show response
s.yimg.com/wi/config/ Frame 04C8 2 B
37 B 113ms
72ms XHR
application/json 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10139345.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:01 GMT
x-content-type-options: nosniff
age: 38
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: VF5JFV3EN3D8JB9J
x-amz-id-2: sfaQX6KCzsFss9KRdNRcLScTstnWrgqzplMNmM1E8Sx4Ku+3ZnMFVCMimBQynhvItzISWh4oCRU=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 17533112.js Show response
bat.bing.com/p/action/ Frame 04C8 682 B
735 B 159ms
158ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/17533112.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 302a3f44949b3ee709c665a8974077152143f44db6c6113e3a27a0bb16328cf6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CDB353F52937490FA1F3C4F585185C45 Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:38Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 584

GET
H2 204 0
bat.bing.com/action/ Frame 04C8 0
173 B 31ms
31ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=17533112&Ver=2&mid=124ed617-f385-487a-a360-54818cd1de09&sid=4c86dd70735e11ecbf7597bbc7992fb1&vid=4c86efb0735e11ecac7ef5a4cf1ddf90&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=GrooveFunnels&p=https%3A%2F%2Fercreliefclaim.com%2F&r=&lt=1480&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=209548
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B8ADB3E831554E1F8356356A03F0CA73 Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:38Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 17533112.js Show response
bat.bing.com/p/action/ Frame FA74 684 B
707 B 235ms
235ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/17533112.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: f15a73ddacc7e7d4940bfea2d2395e7cfe290e470746b1dc668955d728d53e0c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 96EBEC234B86403E90F8ADADF8A13FA5 Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:38Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 587

GET
H2 204 0
bat.bing.com/action/ Frame FA74 0
95 B 29ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=17533112&Ver=2&mid=3401ab40-24e4-4f23-a084-2708f6c363d5&sid=4c86dd70735e11ecbf7597bbc7992fb1&vid=4c86efb0735e11ecac7ef5a4cf1ddf90&vids=0&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=GrooveFunnels&p=https%3A%2F%2Fercreliefclaim.com%2F&r=&lt=996&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=189934
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 73347AC8A1684C7A9E29C47EA2F63DD1 Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:38Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/f93a7034/www-widgetapi.vflset/ Frame FA74 149 KB
48 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/f93a7034/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56ffacf7e1adcff39289ad8604b9978aac8dffcf73c7356ba3c3d2577742e6c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 20:06:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29346
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49397
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 01:13:45 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 11 Jan 2023 20:06:33 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A535 9 KB
4 KB 53ms
18ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=ercreliefclaim.com&origin=onetag

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/ld.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

133be2ab152b1c9f408e9a597430361539cf3b8255a0a92f8a8a8a885e079702

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2720
date: Wed, 12 Jan 2022 04:15:38 GMT
content-length: 4161
strict-transport-security: max-age=31536000; preload;

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/ Frame FA74 2 KB
2 KB 40ms
18ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/?random=1641960939021&cv=9&fst=1641960939021&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1a0&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Fercreliefclaim.com%2F&tiba=GrooveFunnels&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e54c391d022c09cd1d8ec4646ae2da81355829eb0b845a17a9999efb5472a7b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1044
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 config.js Show response
app.groove.cm/config/ Frame 04C8 324 B
474 B 13ms
13ms Script
application/javascript 2606:4700:3033::ac43:8b0d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/config/config.js
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8b0d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 11 Jan 2022 19:40:01 GMT
server: cloudflare
age: 652
etag: W/"61dddd11-144"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W33PJ3f8uczASnBGcejWvzQW%2F66TDhlyGGbaT1KLMje3WAaPFVALy610VfmdtkUxRGiINwY4MpctCm4cBp5qOO7iOBTEdlkly0ICG2NWLLeIzEaeEQPptGV1qBBRHP%2FFSFIvckepSWIQQUsn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cc3909cecf14e7f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 9D79 9 KB
4 KB 47ms
17ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=ercreliefclaim.com&origin=onetag

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/ld.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

133be2ab152b1c9f408e9a597430361539cf3b8255a0a92f8a8a8a885e079702

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2032
date: Wed, 12 Jan 2022 04:15:38 GMT
content-length: 4161
strict-transport-security: max-age=31536000; preload;

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/ Frame 04C8 2 KB
1 KB 37ms
19ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/?random=1641960939026&cv=9&fst=1641960939026&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1a0&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Fercreliefclaim.com%2F&tiba=GrooveFunnels&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32dd1533262473cc601d61517978b478a48be4d659f992bc42608a137fff0aeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1047
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/f93a7034/www-widgetapi.vflset/ Frame 04C8 149 KB
48 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/f93a7034/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56ffacf7e1adcff39289ad8604b9978aac8dffcf73c7356ba3c3d2577742e6c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 11 Jan 2022 20:06:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29346
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49397
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 01:13:45 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 11 Jan 2023 20:06:33 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame FA74 43 B
716 B 101ms
32ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Wed%2C%2012%20Jan%202022%2004%3A15%3A39%20GMT&n=0&b=GrooveFunnels&.yp=10139345&f=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&e=https%3A%2F%2Fercreliefclaim.com%2F&enc=UTF-8&yv=1.11.0&isIframe=1&tagmgr=gtm

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Wed, 12 Jan 2022 04:15:39 GMT

GET
H3 200 fetch-with-permalink Show response
v1.gdapis.com/api/groovevideo/ Frame FA74 2 KB
2 KB 160ms
159ms XHR
application/json 2606:4700:3034::ac43:d90a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:d90a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash: 91dd55b0b01d4232eb158271f55fdc0f468ae88dff12672e77d90ca64f618c89

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
x-auth-provider: auth0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PHP/7.3.24
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 599
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FzAuFNIW2V6KmySs%2B8ddDnZ%2BJdjq5oFcJgF9GVD3jmaoG6PR4Z0CcSYv9QQjctz%2FYc3lePRHiEOfrxhuvVh2YTsZfhgdM40JPm4LHC63ZCfy7nAdJe7pXBaWOZiWLP03qIYATKQPtleltkV3"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma
cache-control: no-cache, private
x-ratelimit-limit: 600
cf-ray: 6cc3909e2aac4ea9-FRA

OPTIONS
H3 204 fetch-with-permalink
v1.gdapis.com/api/groovevideo/ Frame 0
0 165ms
154ms Preflight
text/html 2606:4700:3034::ac43:d90a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:d90a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-auth-provider
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.3.24
cache-control: no-cache, private
access-control-allow-methods: POST, GET, OPTIONS, PUT, PATCH, DELETE
access-control-allow-headers: Content-Type, X-Auth-Token, Origin, Authorization, *
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g4qce6FrQXp0jAqPksC7HQ1nzclQ5YtAepPnTAg69BN6biAc7T8bos2nuEHdNVwqzeTJx901TC47SEcW2qCxfKP49V%2BqrKcIeW97vBp6HaqW1U1fiUeusauSrnlcHPHI00eXVYqcXfZwwBsV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6cc3909d29984ea9-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

OPTIONS
H3 204 fetch-with-permalink
v1.gdapis.com/api/groovevideo/ Frame 0
0 342ms
342ms Preflight
text/html 2606:4700:3034::ac43:d90a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=7KE4VhYEZBAF7a6M9DFD&id=75176
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:d90a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-auth-provider
Origin: https://app.groove.cm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.3.24
cache-control: no-cache, private
access-control-allow-methods: POST, GET, OPTIONS, PUT, PATCH, DELETE
access-control-allow-headers: Content-Type, X-Auth-Token, Origin, Authorization, *
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BR0Zy1eyuWSUnUfPf9zuvzljjRfNSh7ijI6si8gryxaI9hsOKLfIGpEs%2B3yEow8On3pyyRyS29%2BJVZN2XjFnVH5u%2BBUdqFpfD5M6rcQoR%2Fl%2FAKKtma69Kt81yDHmqE2KtBK6y1q2OR1M2DNO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6cc3909d49b14ea9-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 fetch-with-permalink Show response
v1.gdapis.com/api/groovevideo/ Frame 04C8 2 KB
1 KB 147ms
147ms XHR
application/json 2606:4700:3034::ac43:d90a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=7KE4VhYEZBAF7a6M9DFD&id=75176
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.eaa3258b.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:d90a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash: e878e156a2598d876b2f274ec391cabfae5b46ee0d127979d4751aeb6c65a6af

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
x-auth-provider: auth0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PHP/7.3.24
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gtfn5O%2F%2F13maCvyMMm%2B6ShLkm3bmdOfCh5wU3pOoeasecsG%2FJUV9mSULSXOTfNa%2F5ZUNRdkmV17qlEWIvtmFYuoz0sYYNbi6R2%2FMxHOeY4%2BRQexSLiXufxdRgOaIUpjosvG8CJtCgJGdI7Tw"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma
cache-control: no-cache, private
x-ratelimit-limit: 600
cf-ray: 6cc3909f6c014ea9-FRA

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame 04C8 43 B
329 B 49ms
32ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Wed%2C%2012%20Jan%202022%2004%3A15%3A39%20GMT&n=0&b=GrooveFunnels&.yp=10139345&f=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&e=https%3A%2F%2Fercreliefclaim.com%2F&enc=UTF-8&yv=1.11.0&isIframe=1&tagmgr=gtm

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Wed, 12 Jan 2022 04:15:39 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/646915355/ Frame FA74 42 B
108 B 599ms
253ms Image
image/gif 2a00:1450:4019:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/646915355/?random=1641960939021&cv=9&fst=1641960000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1a0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Fercreliefclaim.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=944287685&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4019:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/646915355/ Frame FA74 42 B
108 B 43ms
21ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/646915355/?random=1641960939021&cv=9&fst=1641960000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1a0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Fercreliefclaim.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=944287685&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/646915355/ Frame 04C8 42 B
548 B 597ms
251ms Image
image/gif 2a00:1450:4019:80a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/646915355/?random=1641960939026&cv=9&fst=1641960000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1a0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Fercreliefclaim.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=2842777203&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4019:80a::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/646915355/ Frame 04C8 42 B
548 B 40ms
18ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/646915355/?random=1641960939026&cv=9&fst=1641960000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1a0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&ref=https%3A%2F%2Fercreliefclaim.com%2F&tiba=GrooveFunnels&async=1&fmt=3&is_vtc=1&random=2842777203&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 matomo.php
matomo.groovetech.io/ Frame FA74 43 B
588 B 131ms
130ms Image
image/gif 2606:4700:3034::ac43:b25c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=959887&h=4&m=15&s=39&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Fercreliefclaim.com%2F&_id=8ae22067191403f1&_idts=1641960939&_idvc=1&_idn=1&_refts=1641960939&_viewts=1641960939&_ref=https%3A%2F%2Fercreliefclaim.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=202&pv_id=cDDNZc
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b25c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.16
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.16
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bbtRrunmk3c4tdsrM%2BajYMADRaDsfbZYmdJirXJBINUB5KSXlWFGXIrYxo3NFdPac6kEDc8tpZ%2F5JLZj0N892lJxsjzezYx4h2TapUPEtDC%2FucpRQ4F8bv4Py2sTg0e5CflGin1U8ZKJEutZ3eqrPV5zzA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-store
cf-ray: 6cc3909d5f9d703f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43

GET
H2

200

sid Show response
mug.criteo.com/ Frame 9D79
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=ercreliefclaim.com&lsw=1
https://mug.criteo.com/sid?cpp=ypkiv3xCTk5idzFVWTVxSDZHTUNQSm5VT2VXL0puclU4d21WUlE1cnVzNWZhSmp5Mi8rS3pWOGR1cjhwYXAzbDc1TGkxOW1ZM3B5WWYweHdHQlY4ekdlckViOG4yaGdiNGsrdDQ1VDJPc2ltR0twZ3p0cjZWUUJVSUk4cz...

470 B
656 B

46ms
16ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=ypkiv3xCTk5idzFVWTVxSDZHTUNQSm5VT2VXL0puclU4d21WUlE1cnVzNWZhSmp5Mi8rS3pWOGR1cjhwYXAzbDc1TGkxOW1ZM3B5WWYweHdHQlY4ekdlckViOG4yaGdiNGsrdDQ1VDJPc2ltR0twZ3p0cjZWUUJVSUk4czA2VHJYQmxaanY0SmlnWGoxR2FodDNwL3ZERk9lMnhucUxrSytERitxeWFvQXl2LzlZbWN1NitMMHdqYzJ6WC9pUVB3VXN1THpCQnJjbXdmc21FeUhTWDJWMWttN1dWKzV3VlVDbkR6U1RZdXpzRnk4UGw3MmFwUDkycXFLajZORWJMdW9UM3hVVFJWS3hUa0FsVi9ZUkhSNWphSzh3M0paY3FuMTVmYU9nM0tjbkxMbWRKTT18&cppv=2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

daf8595c5c1606a69a913fdcda3f231ba9a30c400b5580a61e9d2ba8c1e0ba2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 4015
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=ypkiv3xCTk5idzFVWTVxSDZHTUNQSm5VT2VXL0puclU4d21WUlE1cnVzNWZhSmp5Mi8rS3pWOGR1cjhwYXAzbDc1TGkxOW1ZM3B5WWYweHdHQlY4ekdlckViOG4yaGdiNGsrdDQ1VDJPc2ltR0twZ3p0cjZWUUJVSUk4czA2VHJYQmxaanY0SmlnWGoxR2FodDNwL3ZERk9lMnhucUxrSytERitxeWFvQXl2LzlZbWN1NitMMHdqYzJ6WC9pUVB3VXN1THpCQnJjbXdmc21FeUhTWDJWMWttN1dWKzV3VlVDbkR6U1RZdXpzRnk4UGw3MmFwUDkycXFLajZORWJMdW9UM3hVVFJWS3hUa0FsVi9ZUkhSNWphSzh3M0paY3FuMTVmYU9nM0tjbkxMbWRKTT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 3913
content-length: 567
expires: 0

GET
H2

200

sid Show response
mug.criteo.com/ Frame A535
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=ercreliefclaim.com&lsw=1
https://mug.criteo.com/sid?cpp=9UuVo3x4ZGM3Zkx2RTRPSGpnZVFtUWl0UW9VQlllbFc3Z2ljQ28yY3lhWEY5T1RDWFdMSHJpVkZNL0pYeTZSNkFlYytLcHhmNkorY2Z6SWhBTTFqNk1NMFYwamJXeEZUVU43dkUxYnZrL0JudTZuRVNtNW9Ec0RpdTBoTD...

451 B
649 B

47ms
16ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=9UuVo3x4ZGM3Zkx2RTRPSGpnZVFtUWl0UW9VQlllbFc3Z2ljQ28yY3lhWEY5T1RDWFdMSHJpVkZNL0pYeTZSNkFlYytLcHhmNkorY2Z6SWhBTTFqNk1NMFYwamJXeEZUVU43dkUxYnZrL0JudTZuRVNtNW9Ec0RpdTBoTDVTa2o5YlRNcmtsMDhyRklGMkR1aXhQS1VUVXhyNDVoY256UEtmV2ZHQlZObkN1MnhuM01oZWpFcjMvTjVvd2pmaXJtWkdGOWJxb2pQdlZaWnVYMG5qL2JzUFVtNUZmR0t5L0RFeUZGNHFLRVQzd1ZPbFlLYkFVZmd4R2NyQUU0MXR5bDBYemJCblp1WHVRWUNBelp6clpjbnJKNFY4Qk5qZEJFWEo1WUJFUW1SN204N3VVWT18&cppv=2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

074b2f3f9c92dbc37294ddd78a8cdf967cab0e6a57121608baa58b38deef2ce0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 4966
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=9UuVo3x4ZGM3Zkx2RTRPSGpnZVFtUWl0UW9VQlllbFc3Z2ljQ28yY3lhWEY5T1RDWFdMSHJpVkZNL0pYeTZSNkFlYytLcHhmNkorY2Z6SWhBTTFqNk1NMFYwamJXeEZUVU43dkUxYnZrL0JudTZuRVNtNW9Ec0RpdTBoTDVTa2o5YlRNcmtsMDhyRklGMkR1aXhQS1VUVXhyNDVoY256UEtmV2ZHQlZObkN1MnhuM01oZWpFcjMvTjVvd2pmaXJtWkdGOWJxb2pQdlZaWnVYMG5qL2JzUFVtNUZmR0t5L0RFeUZGNHFLRVQzd1ZPbFlLYkFVZmd4R2NyQUU0MXR5bDBYemJCblp1WHVRWUNBelp6clpjbnJKNFY4Qk5qZEJFWEo1WUJFUW1SN204N3VVWT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1856
content-length: 567
expires: 0

GET
H3 200 matomo.php
matomo.groovetech.io/ Frame 04C8 43 B
590 B 228ms
227ms Image
image/gif 2606:4700:3034::ac43:b25c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=034773&h=4&m=15&s=39&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&urlref=https%3A%2F%2Fercreliefclaim.com%2F&_id=7ccd6ffe585aba4b&_idts=1641960939&_idvc=1&_idn=1&_refts=1641960939&_viewts=1641960939&_ref=https%3A%2F%2Fercreliefclaim.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=206&pv_id=6E8jpI
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b25c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.16
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.16
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VA3M5aA8qbpp%2FNEmXt8eimNNGyT8SKbpO3tTP4j580FGhgE0TmSygZEgl%2BtL0Xg9sZd28D0d%2Fvn9bkfxisrcZ1uFPaIYEfbT1cRGz1qam8VyNxCF5b3%2FwhzHm3gUuQYq23okDTczcbWoBw%2BGVnEKTciaAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-store
cf-ray: 6cc3909d7fc4703f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43

GET
H2 200 clarity.js Show response
d.clarity.ms/s/0.6.31/ Frame 04C8 52 KB
23 KB 317ms
94ms Script
application/javascript 40.76.174.66
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.clarity.ms/s/0.6.31/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/17533112.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
etag: "1d7ffcbff747e00"
last-modified: Sun, 02 Jan 2022 11:29:26 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H2

200

c.gif
c.clarity.ms/ Frame 04C8
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=6ADBFDAB2FFF4039A6B8B01986065AFC&RedC=c.clarity.ms&MXFR=1CA731EC969D6ACC0F7020C6929D644C
https://c.clarity.ms/c.gif?CtsSyncId=6ADBFDAB2FFF4039A6B8B01986065AFC&MUID=15C6BE3DAA1362720614AF17ABC16329

42 B
368 B

27ms
26ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=6ADBFDAB2FFF4039A6B8B01986065AFC&MUID=15C6BE3DAA1362720614AF17ABC16329
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
last-modified: Fri, 05 Nov 2021 17:19:23 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "f95a3e4769d2d71:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9347E42A9D194519841D78D03B9DC8E0 Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:39Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=6ADBFDAB2FFF4039A6B8B01986065AFC&MUID=15C6BE3DAA1362720614AF17ABC16329
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2

200

event Show response
widget.us.criteo.com/ Frame 04C8
Redirect Chain

https://sslwidget.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=79DYC19oOTJyb29abktxODRFSD...
https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=79DYC19oOTJyb29abktxODRFSD...

7 KB
8 KB

365ms
182ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=79DYC19oOTJyb29abktxODRFSDd6VnAlMkZSSTFkJTJGaGVtM3hPcGQzbzJROGFjZ29iWHRhajBab0tvNHpibnNoJTJGVjlXa2hpSjZWcjdicm8lMkY0SHc3WTR2b0IlMkZtSXBRTU5aZ2VsJTJGS004bWJjajl3QkdtaThod09nSlZOSFAwVTRDSng5a1g2VHFDQjB5JTJGJTJGMkk1bHRaZXdvc1BPTGhoMDNxYWxUa3hRYW8lMkJoZFMwZ04yejQlM0Q&tld=app.groove.cm&dtycbr=21807

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

592ec50653d19432444cde36a0911fc8cefc668596852c311f92a81affe6f499

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
content-type: application/x-javascript
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 15859326
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
location: https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=79DYC19oOTJyb29abktxODRFSDd6VnAlMkZSSTFkJTJGaGVtM3hPcGQzbzJROGFjZ29iWHRhajBab0tvNHpibnNoJTJGVjlXa2hpSjZWcjdicm8lMkY0SHc3WTR2b0IlMkZtSXBRTU5aZ2VsJTJGS004bWJjajl3QkdtaThod09nSlZOSFAwVTRDSng5a1g2VHFDQjB5JTJGJTJGMkk1bHRaZXdvc1BPTGhoMDNxYWxUa3hRYW8lMkJoZFMwZ04yejQlM0Q&tld=app.groove.cm&dtycbr=21807
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3063598
timing-allow-origin: *
content-length: 0
expires: 0

GET
H2

200

event Show response
widget.us.criteo.com/ Frame FA74
Redirect Chain

https://sslwidget.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Qcv5MV9mJTJCdmlBMFNGY3hLV1...
https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Qcv5MV9mJTJCdmlBMFNGY3hLV1...

7 KB
8 KB

294ms
108ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Qcv5MV9mJTJCdmlBMFNGY3hLV1JScmlFc1NDR1ZjTjVxZ21tYm14emp5ZVdIdmo0UWlnVWNvQ1MwOFVLOTFaVXNTMUlvZjE5dkFZYnZVY0JSYjc1JTJGUlZiY09rMTZoWjk2QUVFZGE3bXZFMjBhNHdqT2hESnpvM1ZmeXF5aGJ5UnYlMkZSN2ElMkY1aGR4NSUyQnE3SHEwWWZnUDdzQnhNQ0t4YkVrN2RraFVBSVBOeXg5RGdBZWJzJTNE&tld=app.groove.cm&dtycbr=35034

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8afb7bb38685fbecc679dcfca28b4b90f00bfb09bc2e38adb3b67a45001e3990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
content-type: application/x-javascript
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 14529882
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
location: https://widget.us.criteo.com/event?a=81296&v=5.8.1&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Fercreliefclaim.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=Qcv5MV9mJTJCdmlBMFNGY3hLV1JScmlFc1NDR1ZjTjVxZ21tYm14emp5ZVdIdmo0UWlnVWNvQ1MwOFVLOTFaVXNTMUlvZjE5dkFZYnZVY0JSYjc1JTJGUlZiY09rMTZoWjk2QUVFZGE3bXZFMjBhNHdqT2hESnpvM1ZmeXF5aGJ5UnYlMkZSN2ElMkY1aGR4NSUyQnE3SHEwWWZnUDdzQnhNQ0t4YkVrN2RraFVBSVBOeXg5RGdBZWJzJTNE&tld=app.groove.cm&dtycbr=35034
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2664793
timing-allow-origin: *
content-length: 0
expires: 0

GET
H2

200

c.gif
c.clarity.ms/ Frame FA74
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=EB266F7D5BE04455A733C8D364BC63A4&RedC=c.clarity.ms&MXFR=1D03B87FD729609012DAA955D3296EEC
https://c.clarity.ms/c.gif?CtsSyncId=EB266F7D5BE04455A733C8D364BC63A4&MUID=15C6BE3DAA1362720614AF17ABC16329

42 B
84 B

27ms
27ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=EB266F7D5BE04455A733C8D364BC63A4&MUID=15C6BE3DAA1362720614AF17ABC16329
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
last-modified: Fri, 05 Nov 2021 17:19:23 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "f95a3e4769d2d71:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: ADAFAE6B80CD4B248A621AD1E44FE2FC Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:39Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=EB266F7D5BE04455A733C8D364BC63A4&MUID=15C6BE3DAA1362720614AF17ABC16329
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2 200 clarity.js Show response
f.clarity.ms/s/0.6.31/ Frame FA74 52 KB
23 KB 302ms
94ms Script
application/javascript 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/s/0.6.31/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/17533112.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:38 GMT
content-encoding: br
etag: "1d7ffcbff747e00"
last-modified: Sun, 02 Jan 2022 11:29:26 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2 206 groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4
videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame FA74 140 KB
0 517ms
503ms Media
video/mp4 2600:9000:2156:e400:b:d801:7900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e400:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://app.groove.cm/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Range: bytes=0-

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
via: 1.1 baaf38f0a0d54e4834bf934fa5189cea.cloudfront.net (CloudFront)
last-modified: Fri, 12 Nov 2021 21:33:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
etag: "f0a1f3fafedb3b07b52afe73134ecc80"
x-cache: Miss from cloudfront
content-type: video/mp4
Content-Range: bytes 0-2626605/2626606
accept-ranges: bytes
Content-Length: 2626606
x-amz-cf-id: jB_pIc1G9B2dTmoh_j7rxB2ouS6EtqbtXkOwXwDuoiHWIpwR-ga5rA==

GET
DATA 200
OK truncated
/ Frame 04C8 4 KB
4 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aef991b2e0b693a95d41986576dd3901ea7ac03b379501b1caba966058753308

Request headers

Referer
Origin: https://app.groove.cm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 206 groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4
videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame 04C8 400 KB
0 15ms
15ms Media
video/mp4 2600:9000:2156:e400:b:d801:7900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e400:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://app.groove.cm/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 11 Jan 2022 06:33:53 GMT
via: 1.1 baaf38f0a0d54e4834bf934fa5189cea.cloudfront.net (CloudFront)
last-modified: Fri, 12 Nov 2021 16:18:22 GMT
server: AmazonS3
age: 78107
etag: "d01b8de36dff0efab6b88f31a7dbeabc"
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 0-20764396/20764397
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
Content-Length: 20764397
x-amz-cf-id: m5bN3sxfXWemXPzChyHYNrTXNm0i2nmNJudA-9uokoULDZks2evEAg==

POST
H2 204 collect Show response
d.clarity.ms/ Frame 04C8 0
91 B 194ms
194ms XHR
text/plain 40.76.174.66
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.clarity.ms/collect
Requested by: Host: d.clarity.ms
URL: https://d.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.76.174.66 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: https://app.groove.cm
date: Wed, 12 Jan 2022 04:15:39 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H2 200 / Show response
beacon-v2.helpscout.net/ Frame 04C8 293 B
622 B 63ms
16ms Script
application/javascript 143.204.98.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75176/7KE4VhYEZBAF7a6M9DFD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-125.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e9efd9319480d67a775ec014b5949a705650abec2208d5507046c44c0e1f2aa1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: gzip
last-modified: Wed, 15 Dec 2021 18:05:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
etag: "b02046db6f195fd0c48dcefe73479f99"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
cache-control: max-age=120, s-maxage=120, public
accept-ranges: bytes
content-length: 244
x-amz-cf-id: C7idXFuAiBpsqmO3kFYen2_hRKNFYIbYwFewSkS9salc5MZpXtRuNA==

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame E3D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1nMm53R0VnN3V2VEpJTmtESTBmeldxZXV3RG1vRUVsaV9yQk04UQ
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

43 B
369 B

52ms
16ms

Image
image/gif

178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 258926
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

/
partner.mediawallahscript.com/ Frame E3D5
Redirect Chain

https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-g2nwGEg7uvTJINkDI0fzWqeuwDmoEEli_rBM8Q&custom=&tag_format=img&tag_action=sync&custom=&cb=10900f04-68f2-4145-8b30-9366c0b...
https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-g2nwGEg7uvTJINkDI0fzWqeuwDmoEEli_rBM8Q&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=10900f04-68f2-414...

0
638 B

32ms
32ms

Image
text/plain

54.155.208.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-g2nwGEg7uvTJINkDI0fzWqeuwDmoEEli_rBM8Q&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=10900f04-68f2-4145-8b30-9366c0bfc8be&final=true&reqid=4d0adb80-735e-11ec-97df-93bff2e238ac&timestamp=2022-01-12T04%3A15%3A39.832Z
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Server: 54.155.208.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-155-208-14.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:39 GMT
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Server: nginx/1.18.0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Wed, 12 Jan 2022 04:15:39 GMT
Server: nginx/1.18.0
Vary: Accept, Accept-Encoding
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: /?account_id=1043&partner_id=1048&uid=k-g2nwGEg7uvTJINkDI0fzWqeuwDmoEEli_rBM8Q&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=10900f04-68f2-4145-8b30-9366c0bfc8be&final=true&reqid=4d0adb80-735e-11ec-97df-93bff2e238ac&timestamp=2022-01-12T04%3A15%3A39.832Z
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Connection: keep-alive
Content-Type: text/plain; charset=utf-8
Content-Length: 294
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 204 v1
ads.yahoo.com/cms/ Frame E3D5 0
299 B 16ms
12ms Image
text/plain 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ Frame E3D5 43 B
79 B 46ms
42ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Wed, 12 Jan 2022 04:15:39 GMT

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58301/ Frame E3D5 0
481 B 48ms
16ms Image
text/plain 18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-Nzs4Nkg7uvTJINkDI0fzWqeuwDlljw44uW_Fnw

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

ATS/9.1.0.33 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame E3D5 0
476 B 340ms
86ms Image
text/plain 70.42.32.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-7XGy9kg7uvTJINkDI0fzWqeuwDmMNi53q9FMRw
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:40 GMT
Cache-Control: no-cache
X-TraceId: 4c3d09e5554874ddaf08706c405dadfb
Content-Length: 0

GET
H2 204 t.gif
cw.addthis.com/ Frame E3D5 0
426 B 177ms
122ms Image
text/plain 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-X_PyW0g7uvTJINkDI0fzWqeuwDkZa5UasWciWQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 12 Jan 2022 04:15:39 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame E3D5 0
239 B 57ms
9ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-X_PyW0g7uvTJINkDI0fzWqeuwDkZa5UasWciWQ&expires=30
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type: image/gif

GET
H/1.1

200
OK

bounce
secure.adnxs.com/ Frame E3D5
Redirect Chain

https://secure.adnxs.com/setuid?entity=52&code=k-GB364Ug7uvTJINkDI0fzWqeuwDmzCx3I3TJEVw&seg=95287
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-GB364Ug7uvTJINkDI0fzWqeuwDmzCx3I3TJEVw%26seg%3D95287

43 B
1 KB

13ms
13ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-GB364Ug7uvTJINkDI0fzWqeuwDmzCx3I3TJEVw%26seg%3D95287

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

HTTP/1.1

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Jan 2022 04:15:39 GMT
X-Proxy-Origin: 193.27.14.20; 193.27.14.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5c17b642-a8c8-45f8-9cb2-519710b316dc
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 12 Jan 2022 04:15:39 GMT
X-Proxy-Origin: 193.27.14.20; 193.27.14.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9e002608-571c-40b6-8e8b-9ec7631bda6a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-GB364Ug7uvTJINkDI0fzWqeuwDmzCx3I3TJEVw%26seg%3D95287
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame E3D5 42 B
677 B 69ms
18ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-GwHSK0g7uvTJINkDI0fzWqeuwDmk23wO3T3ccQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug006:0:412
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

xuid
eb2.3lift.com/ Frame E3D5
Redirect Chain

https://eb2.3lift.com/xuid?mid=2711&xuid=k--Nm8YEg7uvTJINkDI0fzWqeuwDnjAixhYbWdKA&dongle=013b
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k--Nm8YEg7uvTJINkDI0fzWqeuwDnjAixhYbWdKA&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

37 B
353 B

8ms
8ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k--Nm8YEg7uvTJINkDI0fzWqeuwDnjAixhYbWdKA&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2711&xuid=k--Nm8YEg7uvTJINkDI0fzWqeuwDnjAixhYbWdKA&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
date: Wed, 12 Jan 2022 04:15:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 cksync.php
contextual.media.net/ Frame E3D5 45 B
785 B 52ms
34ms Image
image/gif 2.21.140.74
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-uA3Mtkg7uvTJINkDI0fzWqeuwDkFBHl7pv4iTg

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.74 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-74.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Wed, 12 Jan 2022 04:15:39 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Wed, 12 Jan 2022 04:15:39 GMT

GET
H/1.1

200
OK

rum
r.casalemedia.com/ Frame E3D5
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-IArNeEg7uvTJINkDI0fzWqeuwDlkRpw7BzCvYg
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-IArNeEg7uvTJINkDI0fzWqeuwDlkRpw7BzCvYg&C=1

43 B
1 KB

33ms
33ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-IArNeEg7uvTJINkDI0fzWqeuwDlkRpw7BzCvYg&C=1
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Jan 2022 04:15:39 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 12 Jan 2022 04:15:39 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 12 Jan 2022 04:15:39 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-IArNeEg7uvTJINkDI0fzWqeuwDlkRpw7BzCvYg&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 296
Expires: Wed, 12 Jan 2022 04:15:39 GMT

GET
H2 204 /
s.ad.smaato.net/c/ Frame E3D5 0
241 B 26ms
8ms Image
text/plain 2600:9000:2156:3600:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001851&dspCookie=k-R5FTDkg7uvTJINkDI0fzWqeuwDndcmVa-TrmDQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:3600:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
via: 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: BkuqjpxxMH652pzAWsnT-pHVgam6Qo5v3PwyKRaPjRjxQOPCpQXBew==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/ Frame E3D5
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-WM5b0Eg7uvTJINkDI0fzWqeuwDlFzCx3n0krOg&expires=30&user_group=5
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-WM5b0Eg7uvTJINkDI0fzWqeuwDlFzCx3n0krOg&expires=30&user_group=5

43 B
495 B

10ms
9ms

Image
image/gif

3.123.179.172
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-WM5b0Eg7uvTJINkDI0fzWqeuwDlFzCx3n0krOg&expires=30&user_group=5
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Server: 3.123.179.172 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-179-172.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-WM5b0Eg7uvTJINkDI0fzWqeuwDlFzCx3n0krOg&expires=30&user_group=5
Date: Wed, 12 Jan 2022 04:15:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 pixel_sync
trends.revcontent.com/cm/ Frame E3D5 35 B
337 B 100ms
34ms Image
image/gif 52.31.239.78
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-aV0YCUg7uvTJINkDI0fzWqeuwDkr53gc-C8ffA
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.239.78 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-239-78.eu-west-1.compute.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
x-powered-by: Express
content-length: 35
content-type: image/gif

GET
H2 200 um
criteo-sync.teads.tv/ Frame E3D5 23 B
172 B 55ms
34ms Image
image/gif 104.90.104.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-ARIDIEg7uvTJINkDI0fzWqeuwDmPr3MkJqFuYg
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.104.248 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-104-248.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 12 Jan 2022 04:15:39 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame E3D5 0
231 B 46ms
14ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-TR-ciUg7uvTJINkDI0fzWqeuwDlLVv0sWxljgQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 13158

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame E3D5 43 B
163 B 72ms
22ms Image
image/gif 185.86.138.143
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-DpPNnUg7uvTJINkDI0fzWqeuwDnW0ZH_-af8Jg
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.143 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 v1
match.sharethrough.com/sync/ Frame E3D5 68 B
263 B 25ms
9ms Image
image/png 3.65.17.160
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-4tI3mkg7uvTJINkDI0fzWqeuwDn3OPYMrOTLzw
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.17.160 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-17-160.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-length: 68
content-type: image/png

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame E3D5
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-k3dIhUg7uvTJINkDI0fzWqeuwDlZA_USoAvR_w
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-k3dIhUg7uvTJINkDI0fzWqeuwDlZA_USoAvR_w

43 B
447 B

34ms
34ms

Image
image/gif

52.31.83.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-k3dIhUg7uvTJINkDI0fzWqeuwDlZA_USoAvR_w
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Server: 52.31.83.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-83-126.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-k3dIhUg7uvTJINkDI0fzWqeuwDlZA_USoAvR_w
date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame E3D5
Redirect Chain

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg&_li_chk=true&previous_uuid=8d19f1f8c3704815929d85c015b0e925
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg

43 B
447 B

315ms
112ms

Image
image/gif

2600:1f18:444a:4680:6bbe:49e:bc45:59
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg

Protocol

HTTP/1.1

Server

2600:1f18:444a:4680:6bbe:49e:bc45:59 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:40 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: 01e5aa3a2588a3e6
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg
Date: Wed, 12 Jan 2022 04:15:39 GMT
Connection: keep-alive
trace-id: c86adc22e22df013
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/cdb/ Frame E3D5
Redirect Chain

https://gum.criteo.com/sync?c=383&r=1&a=1&u=https%3A%2F%2Fd.turn.com%2Fr%2Fdd%2Fid%2FL2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI%2Fdpuid%2F%40USERID%40%2Furl%2Fhttps%253A%252F%252Fdis.criteo.com%252Fdis%25...
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI/dpuid/XJC4FXSwM6qCQFwJzmwK5ceL25CFZVZa/url/https%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fcdb%2Fcookiematch.aspx%3F%26extid%3D%24!%7BTURN_...
https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=2910274446129970666

43 B
370 B

19ms
18ms

Image
image/gif

178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=2910274446129970666

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2059069
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=2910274446129970666
pragma: no-cache
date: Wed, 12 Jan 2022 04:15:38 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 200 1017
jadserve.postrelease.com/suid/ Frame E3D5 43 B
428 B 306ms
101ms Image
image/gif 18.209.200.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/1017?vk=k-MPE_Ykg7uvTJINkDI0fzWqeuwDmYwDtkBapppA
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.209.200.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-209-200-15.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55945/ Frame E3D5
Redirect Chain

https://pixel.advertising.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1
https://pixel.advertising.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1&verify=true
https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1&apid=UP4d140403-735e-11ec-94d2-06b6fff32ac0

0
342 B

31ms
30ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1&apid=UP4d140403-735e-11ec-94d2-06b6fff32ac0

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.0.33 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1&apid=UP4d140403-735e-11ec-94d2-06b6fff32ac0
date: Wed, 12 Jan 2022 04:15:39 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 sync
criteo-partners.tremorhub.com/ Frame E3D5 43 B
183 B 296ms
96ms Image
image/gif 2600:1f18:612b:4216:faf1:9619:7fb0:de49
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-partners.tremorhub.com/sync?UICR=k-Rl5Y5kg7uvTJINkDI0fzWqeuwDnH-J2brWBqDQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:faf1:9619:7fb0:de49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2 200 sync
sync-criteo.ads.yieldmo.com/ Frame E3D5 43 B
220 B 297ms
97ms Image
image/gif 52.0.188.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-criteo.ads.yieldmo.com/sync?id=k-u29ZZUg7uvTJINkDI0fzWqeuwDm-qlB7sJiltg&pn_id=criteo&ext=1
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.188.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-188-249.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 200 c.gif
c.bing.com/ Frame E3D5 42 B
224 B 52ms
51ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-NphEhEg7uvTJINkDI0fzWqeuwDkFI5VF1Zdx6A
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
etag: "f95a3e4769d2d71:0"
last-modified: Fri, 05 Nov 2021 17:19:23 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 45F94366B6E743818D9557697477A1E6 Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:39Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

POST
H2 204 collect Show response
f.clarity.ms/ Frame FA74 0
91 B 187ms
187ms XHR
text/plain 20.84.22.197
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://f.clarity.ms/collect
Requested by: Host: f.clarity.ms
URL: https://f.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.84.22.197 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://app.groove.cm/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: https://app.groove.cm
date: Wed, 12 Jan 2022 04:15:39 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ Frame E3D5 43 B
79 B 33ms
31ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=39872&js=no

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Wed, 12 Jan 2022 04:15:39 GMT

GET
H2 206 groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4
videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame 04C8 64 KB
0 14ms
14ms Media
video/mp4 2600:9000:2156:e400:b:d801:7900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-8d2985e0fd35262fe8daa16a82295540.mp4
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e400:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://app.groove.cm/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Range: bytes=393216-

Response headers

date: Tue, 11 Jan 2022 06:33:53 GMT
via: 1.1 baaf38f0a0d54e4834bf934fa5189cea.cloudfront.net (CloudFront)
last-modified: Fri, 12 Nov 2021 16:18:22 GMT
server: AmazonS3
age: 78107
etag: "d01b8de36dff0efab6b88f31a7dbeabc"
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 393216-20764396/20764397
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
Content-Length: 20371181
x-amz-cf-id: vXUCWdowY8RXRzxc_utva_qYvajb8zCjNtPVZ_r_KYy-vDFPsF7MAg==

GET
H2 200 vendor.bb6341bd.js Show response
beacon-v2.helpscout.net/static/js/ Frame 04C8 702 KB
196 KB 9ms
8ms Script
application/javascript 143.204.98.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/static/js/vendor.bb6341bd.js
Requested by: Host: beacon-v2.helpscout.net
URL: https://beacon-v2.helpscout.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-125.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6b857949e974fba8c4489706d6a105a686c2154ba5a51bfe499dd51e30646892

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 03:59:00 GMT
content-encoding: gzip
last-modified: Wed, 15 Dec 2021 18:05:51 GMT
server: AmazonS3
age: 1275
etag: "6824e9744103158f107a22c35ec30b2d"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
cache-control: max-age=315360000, s-maxage=7200, public
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 199785
x-amz-cf-id: naa2y5B2uOF5O1WXj1Yydm1g8py8ck3yT5g9KodwFaPApKIxbtIxuA==

GET
H2 200 main.4429cfba.js Show response
beacon-v2.helpscout.net/static/js/ Frame 04C8 264 KB
67 KB 26ms
25ms Script
application/javascript 143.204.98.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/static/js/main.4429cfba.js
Requested by: Host: beacon-v2.helpscout.net
URL: https://beacon-v2.helpscout.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-125.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 55dc6e4e1d0ecaa9a1e04d667365bef30f8be818ec6fa1e943a0a0df8f471303

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 03:00:04 GMT
content-encoding: gzip
last-modified: Wed, 15 Dec 2021 18:05:51 GMT
server: AmazonS3
age: 4536
etag: "69b831e61220b35085b39df27ccabe0b"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
cache-control: max-age=315360000, s-maxage=7200, public
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 67884
x-amz-cf-id: go5aUEhB7PeSl4aKW17CD3hseVXUCcWss6SHCpXS02yGd-A1WA5L7A==

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame E3D5
Redirect Chain

https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=5920233874700836433

43 B
370 B

24ms
24ms

Image
image/gif

178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=5920233874700836433

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 8694330
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 12 Jan 2022 04:15:39 GMT
X-Proxy-Origin: 193.27.14.20; 193.27.14.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: edcac6f6-a3ff-4692-8302-dd4c3067bb4d
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=5920233874700836433
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 matomo.php
matomo.groovetech.io/ Frame FA74 43 B
587 B 129ms
129ms Image
image/gif 2606:4700:3034::ac43:b25c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=326817&h=4&m=15&s=39&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Fercreliefclaim.com%2F&_id=73db20206eb128a1&_idts=1641960939&_idvc=1&_idn=1&_refts=1641960939&_viewts=1641960939&_ref=https%3A%2F%2Fercreliefclaim.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=202&pv_id=fcxDXz
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b25c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.24
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.24
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OVilXLy5tBes9OGpkRUsr5Ugv5nSb8x7Lr1f7OH979dIEwA%2FduCtVsTFI3qfHJ0uLxB2PJXRXAJlsl4BtUqbCSCGQqwkmIPbKYWJob21oUzCe5DtJaiK9ny9ifArsgh2v8GZJhBx2dxIeCr%2BKzS1Y1yHJw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-store
cf-ray: 6cc390a258cb703f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43

GET
H3 200 matomo.php
matomo.groovetech.io/ Frame 04C8 43 B
594 B 187ms
187ms Image
image/gif 2606:4700:3034::ac43:b25c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://matomo.groovetech.io/matomo.php?action_name=GrooveFunnels&idsite=5&rec=1&r=878714&h=4&m=15&s=39&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75176%2F7KE4VhYEZBAF7a6M9DFD&urlref=https%3A%2F%2Fercreliefclaim.com%2F&_id=0b6be046d306a776&_idts=1641960940&_idvc=1&_idn=1&_refts=1641960940&_viewts=1641960940&_ref=https%3A%2F%2Fercreliefclaim.com%2F&send_image=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=206&pv_id=IhzaRD
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:b25c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.16
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.16
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=syKNsMGXOH9E7Hg7LTLfJ8OdzerZXb%2F%2FPnvi4Hrc%2B8RnNHUGA33vnyhtOqInCVbvxXx2%2FZg9JsCsp2%2F7gGgTkaefiTFVTpkVQFD5ef1JvBtFZTh%2B38noOlj0jyth09gdfqz9towTFLiv7V5OIhknQszWXw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-store
cf-ray: 6cc390a27907703f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43

GET
H2 200 / Show response
beacon-v2.helpscout.net/ Frame FA74 293 B
619 B 7ms
7ms Script
application/javascript 143.204.98.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-125.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e9efd9319480d67a775ec014b5949a705650abec2208d5507046c44c0e1f2aa1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
content-encoding: gzip
last-modified: Wed, 15 Dec 2021 18:05:50 GMT
server: AmazonS3
age: 1
etag: "b02046db6f195fd0c48dcefe73479f99"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
cache-control: max-age=120, s-maxage=120, public
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 244
x-amz-cf-id: WPhU_OB-0JeHpxk5LS1t-ztfUqoK1p0J09pQisTcZdj7gVQS_NTNCw==

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 3D79
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1nMm53R0VnN3V2VEpJTmtESTBmeldxZXV3RG1vRUVsaV9yQk04UQ
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

43 B
369 B

17ms
16ms

Image
image/gif

178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 390707
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ Frame 3D79 43 B
375 B 34ms
32ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Wed, 12 Jan 2022 04:15:40 GMT

GET
H/1.1 200
OK setuid
secure.adnxs.com/ Frame 3D79 43 B
1017 B 14ms
13ms Image
image/gif 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/setuid?entity=52&code=k-GB364Ug7uvTJINkDI0fzWqeuwDmzCx3I3TJEVw&seg=95287

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Jan 2022 04:15:40 GMT
X-Proxy-Origin: 193.27.14.20; 193.27.14.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 30618301-2f24-4776-a803-db6d6a85b373
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 3D79 42 B
522 B 21ms
17ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-GwHSK0g7uvTJINkDI0fzWqeuwDmk23wO3T3ccQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug004:0:362
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 xuid
eb2.3lift.com/ Frame 3D79 37 B
353 B 10ms
7ms Image
image/gif 76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2711&xuid=k--Nm8YEg7uvTJINkDI0fzWqeuwDnjAixhYbWdKA&dongle=013b
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 cksync.php
contextual.media.net/ Frame 3D79 45 B
620 B 48ms
45ms Image
image/gif 2.21.140.74
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-uA3Mtkg7uvTJINkDI0fzWqeuwDkFBHl7pv4iTg

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.74 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-74.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Wed, 12 Jan 2022 04:15:40 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Wed, 12 Jan 2022 04:15:40 GMT

GET
H/1.1 200
OK rum
r.casalemedia.com/ Frame 3D79 43 B
1 KB 32ms
31ms Image
image/gif 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-IArNeEg7uvTJINkDI0fzWqeuwDlkRpw7BzCvYg
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Jan 2022 04:15:40 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 12 Jan 2022 04:15:40 GMT

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 3D79 43 B
220 B 10ms
9ms Image
image/gif 3.123.179.172
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-WM5b0Eg7uvTJINkDI0fzWqeuwDlFzCx3n0krOg&expires=30&user_group=5
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.179.172 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-179-172.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:40 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 pixel_sync
trends.revcontent.com/cm/ Frame 3D79 35 B
215 B 40ms
36ms Image
image/gif 52.31.239.78
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-aV0YCUg7uvTJINkDI0fzWqeuwDkr53gc-C8ffA
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.239.78 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-239-78.eu-west-1.compute.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
x-powered-by: Express
content-length: 35
content-type: image/gif

GET
H2 200 um
criteo-sync.teads.tv/ Frame 3D79 23 B
172 B 40ms
37ms Image
image/gif 104.90.104.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-ARIDIEg7uvTJINkDI0fzWqeuwDmPr3MkJqFuYg
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.104.248 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-104-248.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 12 Jan 2022 04:15:40 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 3D79 43 B
163 B 23ms
21ms Image
image/gif 185.86.138.143
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-DpPNnUg7uvTJINkDI0fzWqeuwDnW0ZH_-af8Jg
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.143 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:39 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 v1
match.sharethrough.com/sync/ Frame 3D79 68 B
262 B 10ms
7ms Image
image/png 3.65.17.160
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-4tI3mkg7uvTJINkDI0fzWqeuwDn3OPYMrOTLzw
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.17.160 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-17-160.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
content-length: 68
content-type: image/png

GET
H2 200 match
ad.360yield.com/ Frame 3D79 43 B
446 B 40ms
37ms Image
image/gif 52.31.83.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-k3dIhUg7uvTJINkDI0fzWqeuwDlZA_USoAvR_w
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.83.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-83-126.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 12 Jan 2022 04:15:40 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame 3D79
Redirect Chain

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg&_li_chk=true&previous_uuid=0770df2a689b420c9d504bd7ec4a6efc
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg

43 B
447 B

291ms
97ms

Image
image/gif

2600:1f18:444a:4680:6bbe:49e:bc45:59
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg

Protocol

HTTP/1.1

Server

2600:1f18:444a:4680:6bbe:49e:bc45:59 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:40 GMT
Cache-Control: no-store
Connection: keep-alive
trace-id: dbb0734845ee680c
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-eOj730g7uvTJINkDI0fzWqeuwDla9LKXvmjUGg
Date: Wed, 12 Jan 2022 04:15:39 GMT
Connection: keep-alive
trace-id: 711282a4978c3ae5
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 200 1017
jadserve.postrelease.com/suid/ Frame 3D79 43 B
427 B 104ms
101ms Image
image/gif 18.209.200.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/1017?vk=k-MPE_Ykg7uvTJINkDI0fzWqeuwDmYwDtkBapppA
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.209.200.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-209-200-15.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 sync
criteo-partners.tremorhub.com/ Frame 3D79 43 B
182 B 98ms
95ms Image
image/gif 2600:1f18:612b:4216:faf1:9619:7fb0:de49
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-partners.tremorhub.com/sync?UICR=k-Rl5Y5kg7uvTJINkDI0fzWqeuwDnH-J2brWBqDQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:faf1:9619:7fb0:de49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2 200 sync
sync-criteo.ads.yieldmo.com/ Frame 3D79 43 B
219 B 100ms
97ms Image
image/gif 52.0.188.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-criteo.ads.yieldmo.com/sync?id=k-u29ZZUg7uvTJINkDI0fzWqeuwDm-qlB7sJiltg&pn_id=criteo&ext=1
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.0.188.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-0-188-249.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

GET
H2 200 c.gif
c.bing.com/ Frame 3D79 42 B
151 B 35ms
32ms Image
image/gif 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-NphEhEg7uvTJINkDI0fzWqeuwDkFI5VF1Zdx6A
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:39 GMT
etag: "f95a3e4769d2d71:0"
last-modified: Fri, 05 Nov 2021 17:19:23 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1967CD499120435FB0FAB5D20CFB66BC Ref B: FRAEDGE1316 Ref C: 2022-01-12T04:15:40Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H2

200

397596.gif
idsync.rlcdn.com/ Frame 3D79
Redirect Chain

https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397596.gif?partner_uid=u_ZqvIikatpPxYUMi-URNF_UE_oHJrH_

42 B
417 B

35ms
14ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397596.gif?partner_uid=u_ZqvIikatpPxYUMi-URNF_UE_oHJrH_
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Jan 2022 04:15:40 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397596.gif?partner_uid=u_ZqvIikatpPxYUMi-URNF_UE_oHJrH_
date: Wed, 12 Jan 2022 04:15:40 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2667
content-length: 197
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8

GET
H/1.1 204
No Content /
partner.mediawallahscript.com/ Frame 3D79 0
638 B 34ms
32ms Image
text/plain 54.155.208.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-g2nwGEg7uvTJINkDI0fzWqeuwDmoEEli_rBM8Q&custom=&tag_format=img&tag_action=sync&custom=&cb=a383a0e8-1691-4a86-a34a-52a031813110
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.155.208.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-155-208-14.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:40 GMT
Cache-Control: private, no-cache, must-revalidate, no-store, max-age=0
Server: nginx/1.18.0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 3D79 0
461 B 10ms
8ms Image
text/plain 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58301/ Frame 3D79 0
405 B 12ms
10ms Image
text/plain 18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-Nzs4Nkg7uvTJINkDI0fzWqeuwDlljw44uW_Fnw

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.0.33 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame 3D79 0
313 B 87ms
85ms Image
text/plain 70.42.32.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-7XGy9kg7uvTJINkDI0fzWqeuwDmMNi53q9FMRw
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.191 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 12 Jan 2022 04:15:40 GMT
Cache-Control: no-cache
X-TraceId: 00eaae257ebe86723f2823fc11f4eec8
Content-Length: 0

GET
H2 204 t.gif
cw.addthis.com/ Frame 3D79 0
426 B 127ms
125ms Image
text/plain 104.75.88.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-X_PyW0g7uvTJINkDI0fzWqeuwDkZa5UasWciWQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Jan 2022 04:15:40 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 12 Jan 2022 04:15:40 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 3D79 0
239 B 8ms
8ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-X_PyW0g7uvTJINkDI0fzWqeuwDkZa5UasWciWQ&expires=30
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type: image/gif

GET
H2 204 /
s.ad.smaato.net/c/ Frame 3D79 0
241 B 9ms
8ms Image
text/plain 2600:9000:2156:3600:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001851&dspCookie=k-R5FTDkg7uvTJINkDI0fzWqeuwDndcmVa-TrmDQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:3600:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
via: 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: kLGNW8ULl-IpVmimgIk7FqVaNQQH8jlxUaVGeeMXImBnxV5i_m7gZA==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 3D79 0
230 B 16ms
14ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-TR-ciUg7uvTJINkDI0fzWqeuwDlLVv0sWxljgQ
Requested by: Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 04:15:40 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 13160

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55945/ Frame 3D79
Redirect Chain

https://pixel.advertising.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1
https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1&apid=UP4d140403-735e-11ec-94d2-06b6fff32ac0

0
229 B

10ms
9ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55945/sync?uid=k-JrNR50g7uvTJINkDI0fzWqeuwDn5stNK63lc5w&_origin=1&apid=UP4d140403-735e-11ec-94d2-06b6fff32ac0

Requested by

Host: ercreliefclaim.com
URL: https://ercreliefclaim.com/

Protocol

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS