login3.demonyins.top Open in urlscan Pro
2606:4700:3031::ac43:d8c7 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login3.demonyins.top/
Submission: On May 15 via automatic, source certstream-suspicious (May 15th 2023, 5:41:32 pm UTC) — Scanned from DE

Summary HTTP 114 Redirects Links 80 Behaviour Indicators

Summary

This website contacted 31 IPs in 3 countries across 20 domains to perform 114 HTTP transactions. The main IP is 2606:4700:3031::ac43:d8c7, located in United States and belongs to CLOUDFLARENET, US. The main domain is login3.demonyins.top.
TLS certificate: Issued by GTS CA 1P5 on April 3rd 2023. Valid for: 3 months.

This is the only time login3.demonyins.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3031::ac43:d8c7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
31	151.101.193.164 151.101.193.164	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
5	44.211.112.71 44.211.112.71	14618 (AMAZON-AES) (AMAZON-AES)
3	151.101.129.164 151.101.129.164	54113 (FASTLY) (FASTLY)
2	2600:9000:220... 2600:9000:2204:6e00:4:b37b:9440:93a1	16509 (AMAZON-02) (AMAZON-02)
3	52.222.208.154 52.222.208.154	16509 (AMAZON-02) (AMAZON-02)
6	52.222.239.116 52.222.239.116	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
5	2602:803:c004... 2602:803:c004:200::140	26667 (RUBICONPR...) (RUBICONPROJECT)
1	3.127.73.194 3.127.73.194	16509 (AMAZON-02) (AMAZON-02)
1	185.89.210.46 185.89.210.46	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.107.148.139 34.107.148.139	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
2	65.9.95.76 65.9.95.76	16509 (AMAZON-02) (AMAZON-02)
1 3	13.32.121.72 13.32.121.72	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
1 2	142.250.184.230 142.250.184.230	15169 (GOOGLE) (GOOGLE)
1	2600:9000:243... 2600:9000:243d:1600:18:1fcd:351:7bc1	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:20:... 2606:4700:20::681a:c12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.5.8.3 52.5.8.3	14618 (AMAZON-AES) (AMAZON-AES)
1	20.50.2.28 20.50.2.28	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	23.212.88.20 23.212.88.20	16625 (AKAMAI-AS) (AKAMAI-AS)
1	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
6	2606:4700:20:... 2606:4700:20::ac43:479c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
114	31

10 2606:4700:3031::ac43:d8c7 (United States)

ASN13335 (CLOUDFLARENET, US)

login3.demonyins.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 151.101.193.164 (United States)

ASN54113 (FASTLY, US)

g1.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static01.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a1.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 44.211.112.71 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-211-112-71.compute-1.amazonaws.com

a.et.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.129.164 (United States)

ASN54113 (FASTLY, US)

samizdat-graphql.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2204:6e00:4:b37b:9440:93a1 (United States)

ASN16509 (AMAZON-02, US)

rumcdn.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.208.154 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-208-154.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.222.239.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-239-116.fra56.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2602:803:c004:200::140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.127.73.194 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-73-194.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.46 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.148.139 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 139.148.107.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

nytimes-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

e20e4f5c5aeded47efaea8d600f4ca1c.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.95.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-76.prg50.r.cloudfront.net

dd.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.121.72 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-72.fra60.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f6.1e100.net

5290727.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:243d:1600:18:1fcd:351:7bc1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:c12 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.5.8.3 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-8-3.compute-1.amazonaws.com

pnytimes.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.50.2.28 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

collector.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.212.88.20 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-88-20.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.223.111.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:20::ac43:479c (United States)

ASN13335 (CLOUDFLARENET, US)

platform.iteratehq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
iteratehq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	nyt.com g1.nyt.com — Cisco Umbrella Rank: 9950 static01.nyt.com — Cisco Umbrella Rank: 7579 a1.nyt.com — Cisco Umbrella Rank: 8598	771 KB
11	nytimes.com a.et.nytimes.com — Cisco Umbrella Rank: 6616 samizdat-graphql.nytimes.com — Cisco Umbrella Rank: 6927 Failed als-svc.nytimes.com Failed www.nytimes.com — Cisco Umbrella Rank: 4493 dd.nytimes.com — Cisco Umbrella Rank: 11192 purr.nytimes.com Failed a.nytimes.com Failed meter-svc.nytimes.com Failed	135 KB
10	demonyins.top login3.demonyins.top	729 KB
9	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 310 aax.amazon-adsystem.com — Cisco Umbrella Rank: 406	63 KB
8	googlesyndication.com e20e4f5c5aeded47efaea8d600f4ca1c.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 107 tpc.googlesyndication.com — Cisco Umbrella Rank: 143	41 KB
6	iteratehq.com platform.iteratehq.com — Cisco Umbrella Rank: 7828 iteratehq.com — Cisco Umbrella Rank: 6848	32 KB
6	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 205 5290727.fls.doubleclick.net — Cisco Umbrella Rank: 10637	152 KB
5	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 491	4 KB
3	brandmetrics.com cdn.brandmetrics.com — Cisco Umbrella Rank: 3226 collector.brandmetrics.com — Cisco Umbrella Rank: 3645	18 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 164	844 B
3	google.com adservice.google.com — Cisco Umbrella Rank: 83 www.google.com — Cisco Umbrella Rank: 2	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 39	21 KB
2	openx.net nytimes-d.openx.net — Cisco Umbrella Rank: 13133 u.openx.net — Cisco Umbrella Rank: 683	512 B
2	media.net prebid.media.net — Cisco Umbrella Rank: 1430 cs.media.net — Cisco Umbrella Rank: 1560	1 KB
2	3lift.com tlx.3lift.com — Cisco Umbrella Rank: 533 eb2.3lift.com — Cisco Umbrella Rank: 389	725 B
2	geoedge.be rumcdn.geoedge.be — Cisco Umbrella Rank: 1720	116 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	154 KB
1	chartbeat.net pnytimes.chartbeat.net — Cisco Umbrella Rank: 7989	201 B
1	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 1680	24 KB
1	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 232	862 B
114	20

	Domain	Requested by
18	static01.nyt.com	login3.demonyins.top
10	g1.nyt.com	login3.demonyins.top g1.nyt.com
10	login3.demonyins.top	login3.demonyins.top rumcdn.geoedge.be
6	aax.amazon-adsystem.com	c.amazon-adsystem.com
5	fastlane.rubiconproject.com	www.nytimes.com
5	a.et.nytimes.com	login3.demonyins.top
4	iteratehq.com	platform.iteratehq.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	securepubads.g.doubleclick.net	rumcdn.geoedge.be securepubads.g.doubleclick.net
3	tpc.googlesyndication.com	rumcdn.geoedge.be
3	sb.scorecardresearch.com	1 redirects login3.demonyins.top
3	c.amazon-adsystem.com	login3.demonyins.top c.amazon-adsystem.com
3	samizdat-graphql.nytimes.com	login3.demonyins.top
2	platform.iteratehq.com	login3.demonyins.top platform.iteratehq.com
2	cdn.brandmetrics.com	www.googletagmanager.com rumcdn.geoedge.be
2	a1.nyt.com	login3.demonyins.top www.googletagmanager.com
2	5290727.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	dd.nytimes.com	login3.demonyins.top dd.nytimes.com
2	adservice.google.com	rumcdn.geoedge.be 5290727.fls.doubleclick.net
2	rumcdn.geoedge.be	login3.demonyins.top rumcdn.geoedge.be
2	www.googletagmanager.com	login3.demonyins.top www.googletagmanager.com
1	www.google.com	rumcdn.geoedge.be
1	eb2.3lift.com	login3.demonyins.top
1	u.openx.net	login3.demonyins.top
1	cs.media.net	login3.demonyins.top
1	collector.brandmetrics.com	cdn.brandmetrics.com
1	pnytimes.chartbeat.net	login3.demonyins.top
1	static.chartbeat.com	login3.demonyins.top
1	e20e4f5c5aeded47efaea8d600f4ca1c.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	nytimes-d.openx.net	www.nytimes.com
1	prebid.media.net	www.nytimes.com
1	ib.adnxs.com	www.nytimes.com
1	tlx.3lift.com	www.nytimes.com
1	www.nytimes.com	login3.demonyins.top
0	meter-svc.nytimes.com Failed	login3.demonyins.top
0	a.nytimes.com Failed	login3.demonyins.top
0	purr.nytimes.com Failed	login3.demonyins.top
0	als-svc.nytimes.com Failed	login3.demonyins.top
114	39

This site contains links to these domains. Also see Links.

Domain
www.nytimes.com
cn.nytimes.com
cooking.nytimes.com
theathletic.com
nytimes.com
help.nytimes.com
www.nytco.com
nytmediakit.com
www.tbrandstudio.com

Subject Issuer	Validity	Valid
*.demonyins.top GTS CA 1P5	`2023-04-03` - `2023-07-02`	3 months	crt.sh
nytimes.com Thawte RSA CA 2018	`2023-03-22` - `2024-04-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
a.et.nytimes.com R3	`2023-03-17` - `2023-06-15`	3 months	crt.sh
gw.geoedge.be Amazon RSA 2048 M01	`2023-02-21` - `2023-10-10`	8 months	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
prebid.media.net GTS CA 1D4	`2023-05-09` - `2023-08-07`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
dd.nytimes.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-08` - `2024-04-06`	a year	crt.sh
*.scorecardresearch.com Amazon RSA 2048 M02	`2023-03-01` - `2024-01-28`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2022-05-06` - `2023-06-03`	a year	crt.sh
brandmetrics.com GTS CA 1P5	`2023-05-10` - `2023-08-08`	3 months	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2022-12-19` - `2023-12-30`	a year	crt.sh
*.brandmetrics.com Go Daddy Secure Certificate Authority - G2	`2023-05-10` - `2024-06-10`	a year	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-02-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-06` - `2024-05-04`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://login3.demonyins.top/
Frame ID: FA0150F41B5540C6A423D74AE94A4554
Requests: 102 HTTP requests in this frame

Frame: https://e20e4f5c5aeded47efaea8d600f4ca1c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 70F5F18D8F4897A36AB5CC2271E2C2C2
Requests: 1 HTTP requests in this frame

Frame: https://5290727.fls.doubleclick.net/activityi;dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demonyins.top%2F
Frame ID: 62EB8647675504836C29EF1FF8B34ECB
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 19078CE686B235431495E981C0BADB2B
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 7C9FF4C15B6A1C5B4B629684F554EEDD
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The New York Times - Breaking News, US News, World News and VideosGroupGroupGroup

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Datadome (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

114
Requests

93 %
HTTPS

47 %
IPv6

20
Domains

39
Subdomains

31
IPs

3
Countries

2263 kB
Transfer

6268 kB
Size

18
Cookies

80 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nytimes.com/es/
Title: Español

Search URL Search Domain Scan URL

URL: https://cn.nytimes.com/
Title: 中文

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/section/todayspaper
Title: Today’s Paper

Search URL Search Domain Scan URL

URL: https://cooking.nytimes.com/
Title: Cooking

Search URL Search Domain Scan URL

URL: https://theathletic.com/
Title: The Athletic

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/wirecutter/
Title: Wirecutter

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/crosswords
Title: Games

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/15/upshot/migrations-college-super-cities.html
Title: College-Educated Workers Are Leaving Coastal Cities, Analysis ShowsThe college graduates who fill white-collar jobs are migrating away from the country’s most expensive major metros — and have been since before the pandemic.10 min read<img src="https://static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/migrations-college-super-cities-promo-threeByTwoMediumAt2X-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/middleeast/turkey-election-polls-erdogan.html
Title: Analysis: Erdogan’s Grip on Power Is Loosened but Not Broken, Vote ShowsDespite a struggling economy and the opposition to Turkey’s drift toward one-man rule, President Recep Tayyip Erdogan was leading ahead of a presidential runoff.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/middleeast/turkey-election-results-erdogan-runoff.html
Title: Here are four takeaways from Turkey’s nail-biting presidential election.4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/15/world/europe/turkey-election-results.html
Title: These maps show how every province in Turkey has voted so far.

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2023/05/15/world/russia-ukraine-news
Title: Britain Promises More Missiles and Drones on Zelensky’s VisitA brief stop in England by President Volodymyr Zelensky of Ukraine on Monday came after a whirlwind trip through Europe’s capitals over the weekend.See more headlines 8+

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/business/economy/russia-airlines-sanctions-ukraine.html
Title: Russian customs data showed that millions of dollars of U.S.-made aircraft parts were sent to Russia last year.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/europe/wagner-prigozhin-bakhmut.html
Title: The Wagner leader disputed a report that he offered to betray Russia.2 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/science/environmental-dna-ethics-privacy.html
Title: Your DNA Can Now Be Pulled From Thin Air. Privacy Experts Are Worried.Environmental DNA research has aided conservation, but scientists say its ability to glean information about human populations and individuals poses dangers.8 min read<img src="https://static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/15sci-dna-ethics-A-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="An artist’s illustration depicting a blue and black vortex pulling DNA helixes from a pond in a park surrounded by trees and skyscrapers." class="css-122y91a"/>Isabel Seliger

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/business/diversity-equity-inclusion-belonging.html
Title: Why Some Companies Are Opting to Use the Term ‘Diversity and Belonging’The changing terminology reflects new thinking among some consultants, who say traditional D.E.I. strategies haven’t worked out as planned.7 min read<img src="https://static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/07DEI-BELONGING-02-sub-qktb-threeByTwoMediumAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Karith Foster, the chief executive of Inversity Solutions, wears an eggplant-colored dress and waves one hand in the air as she speaks to an audience." class="css-122y91a"/>Karith Foster, chief executive of the consultancy Inversity Solutions, said an overemphasis on identity groups and a tendency to reduce people to “victim or villain” can alienate. Nick Oxford for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/nyregion/brooklyn-seltzer-boys.html
Title: Inside the Last Old-School Seltzer Shop in New YorkBrooklyn Seltzer Boys has a century-old carbonator and a museum with a spritzing station. Beat that, LaCroix.Juan Arredondo for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/north-carolina-abortion-veto-roy-cooper.html
Title: Abortion Showdown in North Carolina May Hinge on a Single VoteAfter the G.O.P.-led legislature passed a 12-week ban, the Democratic governor vetoed the bill. The Republicans could override it, if they stay unified.6 min read<img src="https://static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/00nat-nc-abortion-showdown-01-wtcq-threeByTwoMediumAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A man in a white dress shirt and light blue tie speaks at a podium. " class="css-122y91a"/>Roy Cooper, the Democratic governor of North Carolina, vetoed a bill banning abortion at 12 weeks. Kate Medley for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/nyregion/nyc-garage-collapse.html
Title: A Crumbling New York Garage Collapsed. Dozens More Have Similar Problems.The fatal failure of a building in Manhattan raised questions about parking structures across the city. Records and interviews revealed widespread issues.10 min read<img src="https://static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/00ny-collapse46-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Fallen bricks cover a car at a collapsed garage on Ann Street." class="css-122y91a"/>Dave Sanders for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/technology/eu-microsoft-activision-blizzard.html
Title: E.U. Approves Microsoft’s $69 Billion Deal for ActivisionThe green light follows objections to the blockbuster deal by American and British regulators on the grounds that it would undercut competition.4 min read<img src="https://static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Men wearing headphones are seated at a long table in front of computer screens in a dark room with purple, pink and green neon lights. " class="css-122y91a"/>Sergio Flores/Bloomberg

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/television/succession-alan-ruck.html
Title: Alan Ruck Is Ready to Leave the Roy FamilyAs “Succession” nears its end, the veteran actor is looking forward to closing the book on Connor Roy.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/arts/television/succession-recap-season-4-episode-8.html
Title: “Succession” recap: It’s election night in America. Stay away from the bodega sushi.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/television/succession-election.html
Title: Democracy went up for sale in “Succession.” In the real world, the price is usually cheaper, our critic writes.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/friars-club-last-call.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/15friars-01-zvpb-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman walks past a stone townhouse whose first floor features purple canopies." class="css-122y91a"/>Hiroko Masuike/The New York TimesIs It Last Call at New York’s Friars Club?The headquarters of the legendary entertainment fraternity is facing the threat of foreclosure as its leaders look for a buyer to help keep the party going.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/11/sports/tennis/pickleball-platform-tennis-padel.html
Title: <img src="https://static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="An overhead shot of a large outdoor facility with multiple blue courts. A palm-tree-lined road can be seen in the distance." class="css-122y91a"/>Are you on team tennis, pickleball or padel? Or all three?6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/12/science/demon-shark-new-species-australia.html
Title: <img src="https://static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/12xp-shark-01-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Apristurus ovicorrugatus, a long, gray shark with bright white eyes." class="css-122y91a"/>There’s something “spooky” about this newly discovered shark species.2 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/section/opinion
Title: Opinion

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/trump-cnn-biden-jordan-neely.html
Title: Gail Collins and Bret StephensTrump Cannot Be Unseen7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/youth-achievement-happiness.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/15gopnik-lead-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A photograph of a young pianist’s hand on a keyboard." class="css-122y91a"/>Adam GopnikWhat We Lose When We Push Our Kids to ‘Achieve’6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/france-macron-le-pen.html
Title: Mitchell Abidor and Miguel LagoHow Marine Le Pen Became France’s Voice of Reason5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/chips-incentives-biden.html
Title: Nathan M. Jensen and Steven PedigoWhy Laws Meant to Create Jobs Can Be So Destructive for Our Cities5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/letter-to-graduates-hope-despair.html
Title: <img src="https://static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/margaret-renkl-new-thumbLarge.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Margaret Renkl" class="css-122y91a"/>Margaret RenklGraduates, My Generation Wrecked So Much That’s Precious. How Can I Offer You Advice?5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/title-42-border-immigration.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/15villavicencio-ktlv-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A child looking through the gap in a rusty corrugated metal wall." class="css-122y91a"/>Karla Cornejo VillavicencioImmigrants Love America the Way It Needs to Be Loved4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/letters/ralph-nader-third-parties.html
Title: Letters From Our ReadersRalph Nader and Others Clash Over the Value of Third Parties5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/jordan-neely-killing-subway.html
Title: <img src="https://static01.nyt.com/images/2023/01/10/opinion/david-french/david-french-thumbLarge-v2.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="David French" class="css-122y91a"/>David FrenchWhen the Rule of Law Fails Us5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/sudan-medicine-doctors.html
Title: Farah StockmanLeaders Stay, Others Run5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/mothers-day-stepmother.html
Title: Rachel Louise SnyderWhat Do You Say When the Person You Love Most in the World Returns?7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/debt-limit-constitution.html
Title: Michael W. McConnellThe Case for Violating the Debt Limit Is Dangerous Nonsense4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/digital-screen-time-children.html
Title: Tish Harrison WarrenManaging Screen Time Is a Family Matter7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/11/opinion/pandemic-learning-losses-steep-but-not-permanent.html
Title: Tom Kane and Sean ReardonParents Don’t Understand How Far Behind Their Kids Are in School

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/frankenheimer-seconds-movie.html
Title: Jamelle BouieJohn Frankenheimer Pointed His Camera Toward the Things We Cannot Escape6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/trump-town-hall-cnn.html
Title: Maureen DowdAs Sun Tzu Says, ‘Know the Enemy’4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/trump-cnn-tv-news.html
Title: Bill SammonWe’re Asking the Wrong Questions About the Trump Town Hall4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/podcasts/the-daily/banning-spywear.html
Title: Listen to ‘The Daily’Inside the U.S. government’s double-edged relationship with the most powerful and notorious hacking tool.<img src="https://static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/the-daily-album-art-square320-v5.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/briefing/the-case-for-journalistic-independence-ag-sulzberger.html
Title: Read The MorningCovid coverage offers a case study of journalistic independence, David Leonhardt writes.7 min read<img src="https://static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/the-morning-icon-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/us/migrants-condition-title-42-ends.html
Title: After a Border Policy Ends, the Migration Surge Abates. For Now.Economic hardship, climate change, political instability and gang violence will continue to spur emigration to the U.S. from many corners of the world.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/health/alzheimers-mutation-gene.html
Title: Mutation Protected Man From Alzheimer’s Disease, Hinting at TreatmentA man in his early 40s showed physical signs of the illness, but didn’t develop symptoms until he was nearly 70 because of a protective gene.3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/politics/biden-monica-bertagnolli-nih.html
Title: A Cancer Surgeon and Patient Is Biden’s Pick to Lead N.I.H.President Biden said that he had selected Dr. Monica Bertagnolli to be the next director of the National Institutes of Health.3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/chicago-mayor-brandon-johnson-policing-migrants.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15nat-chicago-new-mayor-promo-ljcz/15nat-chicago-new-mayor-promo-ljcz-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>Jamie Kelter Davis for The New York TimesWhat Chicago’s New Mayor Says About the City’s Biggest ChallengesBrandon Johnson, a progressive Democrat who was sworn in today, explains how he plans to manage the nation’s third-largest city in a complicated moment.4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/style/spring-fashion-street-style.html
Title: <img src="https://static01.nyt.com/images/2023/05/14/multimedia/16STYLE-OUTSIDE-SPRING-02-zkwm/16STYLE-OUTSIDE-SPRING-02-zkwm-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman, seen from the hips up, standing on a street. She has dark curly hair that falls below her shoulders and is wearing a pink cross-body bag, a green bomber jacket, a blue, green and orange striped sweater and a chain necklace. " class="css-122y91a"/>Spring Dressing Isn’t ImpossibleThe key? Don’t worry about following rules.1 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/style/wardrobe-update-color.html
Title: <img src="https://static01.nyt.com/images/2023/05/12/multimedia/12openThread-QA-fjhm/12openThread-QA-fjhm-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Cruz Beckham, wearing sunglasses and a bright yellow and royal purple jacket; Jaden Smith, in head-to-toe camouflage print; and Justin Timberlake, wearing a Kenzo jacket the color of a martini olive, sitting in the front row of a fashion show." class="css-122y91a"/>How Do I Upgrade My Carhartt Wardrobe?A reader wants to spruce up a closet full of “drab Pacific Northwest earth tones.”3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/11/business/ana-ros-michelin-woman-chef.html
Title: <img src="https://static01.nyt.com/images/2023/04/27/multimedia/00Transforming-Chef-vkjl/00Transforming-Chef-vkjl-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman in a white chef’s outfit leans on a large wooden table with her hand on her chin. Next to her on the table is a tall plant in a pot. In the background are framed paintings on the wall. " class="css-122y91a"/>Ana Ros, One of the World’s Best ChefsShe broke through the boys’ club of fine dining, earning two Michelin stars.7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/books/anne-berest-the-postcard.html
Title: <img src="https://static01.nyt.com/images/2023/05/11/multimedia/11Berest-01-hfqg/11Berest-01-hfqg-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="The author Anne Berest is seen in profile, in a white button-down shirt. " class="css-122y91a"/>A Mysterious Postcard Sparks a NovelAnne Berest’s “The Postcard” is part Holocaust drama, part family mystery.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/books/review/henry-threadgill-easily-slip-into-another-world.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15threadgill-review-wzbl/15threadgill-review-wzbl-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A black-and-white photograph of Henry Threadgill playing the saxophone." class="css-122y91a"/>Vietnam Changed How He Heard the WorldHenry Threadgill’s memoir traces his wartime experience to his jazz career.5 min read

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519232/2023/05/15/ja-morant-gun-instagram-live-punishment/
Title: All Ja Morant Had to Do Was Learn From His Suspension. He Didn’t. Now What?After another gun-related incident, the N.B.A. star’s luck has almost certainly run out, our columnist writes.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519445/2023/05/15/dodgers-padres-nl-west-standard/
Title: Why the Dodgers, Not the Padres, Remain the StandardUntil proven otherwise, there is a separator between these two teams: One knows how to win.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519924/2023/05/15/sixers-celtics-game-7-playoffs-uncertainty/
Title: This Year Might Have Been the 76ers’ Best Chance at a Title. They Blew It.Nobody took a greater individual hit with their Game 7 performance than Joel Embiid.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4509806/2023/05/15/fourth-official-premier-league-hell/
Title: The Worst Job in Soccer: ‘It’s 90 Minutes of Hell’

Search URL Search Domain Scan URL

URL: https://theathletic.com/4474815/2023/05/15/florida-football/
Title: College Football Is in an Arms Race. One Storied Program Is Falling Behind.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4520492/2023/05/15/manchester-city-premier-league-title/
Title: Could Premier League Punishments Affect the Title Race?

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/games/wordle/index.html
Title: WordleGuess the 5-letter word with 6 chances.<img src="https://static01.nyt.com/images/2022/03/02/crosswords/alpha-wordle-icon-new/alpha-wordle-icon-new-square320-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/crosswords/wordle-review-answer-694.html
Title: Today’s Wordle ReviewOur columnist reviews the day’s puzzle. Warning: Contains spoilers!2 min read<img src="https://static01.nyt.com/images/2023/05/14/crosswords/14wordle-review-art/14wordle-review-art-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="On a muted red background in painterly strokes, three langurs ranging in tone from teal to green run and jump alongside a b-boy dancer wearing a bright magenta hoodie and army green pants. The day's Wordle number is layered on top." class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://nytimes.com/games/digits
Title: Digits | BetaChallenge yourself with a daily numbers puzzle.<img src="https://static01.nyt.com/images/2023/03/21/crosswords/alpha-digits-icon-beta/alpha-digits-icon-beta-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/puzzles/spelling-bee
Title: Spelling BeeHow many words can you make with 7 letters?<img src="https://static01.nyt.com/images/2019/04/18/homepage/spelling-bee-logo-bulletin/spelling-bee-logo-bulletin-square320-v5.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/puzzles/letter-boxed
Title: Letter BoxedCreate words using letters around the square.<img src="https://static01.nyt.com/images/2021/05/27/multimedia/alpha-letterboxed-promo-1622145789727/alpha-letterboxed-promo-1622145789727-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014792127-Copyright-notice
Title: © 2023 The New York Times Company

Search URL Search Domain Scan URL

URL: https://www.nytco.com/
Title: NYTCo

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115015385887-Contact-Us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115015727108-Accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.nytco.com/careers/
Title: Work with us

Search URL Search Domain Scan URL

URL: https://nytmediakit.com/
Title: Advertise

Search URL Search Domain Scan URL

URL: https://www.tbrandstudio.com/
Title: T Brand Studio

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/privacy/cookie-policy#how-do-i-manage-trackers
Title: Your Ad Choices

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/privacy/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014893428-Terms-of-service
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014893968-Terms-of-sale
Title: Terms of Sale

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/ca/?action=click&region=Footer&pgtype=Homepage
Title: Canada

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/international/?action=click&region=Footer&pgtype=Homepage
Title: International

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us
Title: Help

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/subscription?campaignId=37WXW
Title: Subscriptions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 83

https://5290727.fls.doubleclick.net/activityi;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demonyins.top%2F HTTP 302
https://5290727.fls.doubleclick.net/activityi;dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demonyins.top%2F

Request Chain 100

https://sb.scorecardresearch.com/c2/3005403/cs.js HTTP 302
https://sb.scorecardresearch.com/internal-c2/3005403/cs.js

114 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login3.demonyins.top/ 538 KB
96 KB 1094ms
546ms Document
text/html 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a24f932ec2d451ea6c910d90ed34cddd6a24af4ec7f434a484ee4db22871cfbd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 6
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: s-maxage=30,no-cache
cf-cache-status: DYNAMIC
cf-ray: 7c7d2be09dcc9143-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 17:41:23 GMT
last-modified: Mon, 15 May 2023 17:41:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ktSk0oaNzg%2Bvm0nvDARkjuFbgWYtnAlblFZyxmwYF3jbBwiKDXrdJjxDlMAWdrzEIaFYeEfiRvTk3gK8NfuymUzGzvAROORKe4ljXX5gdPx72Qb%2Ff2ZrgAYXsGaI%2B6ah7rKZoVQhx9uDI2IG3s5E%2FoXbiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; preload; includeSubdomains
vary: Accept-Encoding, Fastly-SSL
x-api-version: F-F-VI
x-b3-traceid: 697210c3a50d4902be03d2f88bab3f42
x-cache: HIT, HIT
x-cache-hits: 10, 1
x-cloud-trace-context: 5ee8fef7546b91242637704c56f24f7d/5838738125564676848;o=1
x-content-type-options: nosniff
x-frame-options: DENY
x-gdpr: 0
x-nyt-app-webview: 0
x-nyt-data-last-modified: Mon, 15 May 2023 17:41:13 GMT
x-nyt-edge-cache: HIT-HIT
x-nyt-route: homepage
x-origin-time: 2023-05-15 17:41:20 UTC
x-pagetype: vi-homepage
x-served-by: cache-lga21923-LGA, cache-sna10742-LGB
x-timer: S1684172483.107977,VS0,VE4
x-xss-protection: 1; mode=block

GET
H2 200 web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
g1.nyt.com/fonts/css/ 60 KB
10 KB 80ms
10ms Stylesheet
text/css 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

09bff184ea094a06e46d7f26512fd7b245304078a27f1ba8084488cbcf7704de

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Fri, 19 Jan 2024 14:25:45 GMT
date: Mon, 15 May 2023 17:41:23 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 10034138
x-guploader-uploadid: ADPycdu8r8EIkDKHQncby-VxhC4_p_retMia2725uERdqg3x4PWqarMbAFr8Ibt9W3TTJubkfCi_3gQtjgkfPrPzZrZXWJ9J46L7
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 9868
x-served-by: cache-fra-eddf8230066-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172483.311337,VS0,VE0
etag: "b79308aee772cf8921761a4fdb884fe5"
vary: Accept-Encoding
x-goog-generation: 1673991774978541
x-goog-hash: crc32c=ay5bmg==, md5=t5MIrudyz4khdhpP24hP5Q==
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 9868
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 14585

GET
H2 200 global-f449cfd9976ad673ef2b7ab5098b85be.css
login3.demonyins.top/vi-assets/static-assets/ 6 KB
3 KB 495ms
494ms Stylesheet
text/css 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/global-f449cfd9976ad673ef2b7ab5098b85be.css

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57bc281be64ff5ec8e3c2258640df6097a32f08ac5a2c346f214300eb430f176

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsIkqZ227oSkhi_DuQFG3K-bLhwXa1gCU8NN5dnwn05jZE56FGlKAHTE3mGwjBW8GspHPN_ZTL3sWhFI_lboEiuTA
x-goog-stored-content-encoding: identity
x-origin-time: 2022-10-12 15:49:59 UTC
x-served-by: cache-sna10729-LGB
x-timer: S1684172484.655719,VS0,VE1
etag: W/"e74f8b7c668251280cf3e52e20455a1c"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1665589250507895
content-type: text/css; charset=utf-8
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/global-f449cfd9976ad673ef2b7ab5098b85be.css
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 10101
expires: Thu, 12 Oct 2023 15:49:59 GMT
date: Mon, 15 May 2023 17:41:23 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 12 Oct 2022 15:40:50 GMT
server: cloudflare
x-goog-hash: crc32c=jAKqfw==, md5=50+LfGaCUSgM8+UuIEVaHA==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pM523e62sofSAYpc%2B%2FlnhIY4xlehB2Ch3yY%2F0VCngt2EeGGa7G82oV%2B6aLcZWNVX77CvNsP7Taw6pKDFNAzVO0VSW20QTju9ZGLLNpf4Em8D%2BB6rY%2FaRrWxBCpu0X%2B0gajLObFlcLQ%2FKcSzUVVWKZDghsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 5656
cf-ray: 7c7d2be44ae69143-FRA

GET
H3 200 adslot-6cfc3a3f6d8b97c7ed5d.js Show response
login3.demonyins.top/vi-assets/static-assets/ 22 KB
9 KB 535ms
535ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/adslot-6cfc3a3f6d8b97c7ed5d.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88c02f49ec94fda86796bb949e3674af90a3b642839f424a4c13e510259a49b4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdtFud2DScbQxsNseMq9LLPLoKbKs64XIgl0nTVYW-ZPFHcRI4W4fdZ38lT77yRtlZ3FHNL2hsOlw-FTL0L86gvmdA
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-09 16:20:10 UTC
x-served-by: cache-sna10740-LGB
x-timer: S1684172484.835539,VS0,VE1
etag: W/"de5aa7ec9e5831fb28f94291b754ad06"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1683591394785641
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/adslot-6cfc3a3f6d8b97c7ed5d.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 15795
expires: Wed, 08 May 2024 16:20:10 GMT
date: Mon, 15 May 2023 17:41:23 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 09 May 2023 00:16:34 GMT
server: cloudflare
x-goog-hash: crc32c=/TEQzw==, md5=3lqn7J5YMfso+UKRt1StBg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DngGYVWW7ulOxoCnofTr9cRUSDgwGh4C5Dy7a0XqQUuUVKoVqEoT2DmrWcAFkjZWKwrmr4YW1bCWWgtKNMnHXGOP66LiloLN3R4bini6WsG%2BvADbl3CDwdRNHMd7iAvE9tgCSzwdgaDMsrka2gTgTQUgHA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 22455
cf-ray: 7c7d2be5296a39c8-FRA

GET
H2 200 migrations-college-super-cities-promo-threeByTwoSmallAt2X-v3.png
static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/ 5 KB
6 KB 49ms
9ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/migrations-college-super-cities-promo-threeByTwoSmallAt2X-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d4c5b9f51bf43056dacc9054f4a0ca873b8b9ef2afb9eb445a62d5cc6c426dd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:56:21 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2701
x-guploader-uploadid: ADPycds1vaZaGuRRwVI19p1s5hZifhadsL2b4xdTVxou7JPtabON2MDUjKNW3Olg6F6Cb7NX-0VtSbOcZoI2kfGeqlo7sfvqL1Ww
x-cache: HIT, HIT
fastly-io-info: ifsz=6963 idim=600x400 ifmt=png ofsz=5138 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 5138
x-served-by: cache-iad-kiad7000107-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172484.777809,VS0,VE0
etag: "oAAnPmik7S+cpW4zkJny51Y3vnT+7aHzXrSDICAzEx8"
vary: Accept
x-goog-generation: 1684169781405530
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=HuZetw==, md5=5dZsBOhm7OlCQJwcs2yW2w==
cache-control: public, max-age=604800, stale-if-error=86400, stale-while-revalidate=30
x-goog-stored-content-length: 6963
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 15, 15

GET
H2 200 15friars-01-zvpb-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/ 27 KB
28 KB 49ms
24ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/15friars-01-zvpb-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8fd57afe26f59515704cee10d922b01c9d1aaa8257abf811490d7fdef48d1e73

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 14:03:25 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 13078
x-guploader-uploadid: ADPycdsKdhkyGaVXNlPx8_TWP_gklpqRtITwKCnC_8_KdTPqNK2RWn46qBUqzATia733SQxeUDzPo4vBLG4-rthRHC-41g
x-cache: HIT, HIT
fastly-io-info: ifsz=58196 idim=600x400 ifmt=jpeg ofsz=28020 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 28020
x-served-by: cache-iad-kiad7000088-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172484.778196,VS0,VE1
etag: "zLSutaEg7LOPioqy12EcF2ZuADfKRVR/MV4cP4UuFb4"
vary: Accept
x-goog-generation: 1684159208058553
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=vXe1Qg==, md5=sna7XdICa0MV3yzBcN3/SA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 58196
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 37, 1

GET
H2 200 11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/ 68 KB
69 KB 34ms
9ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5af3756336be117aeae1865f764ab57d5fd8384ec55be872fd9862b71047311f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 11 May 2023 14:02:48 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 358715
x-guploader-uploadid: ADPycds3IJiaxkBzqJ5VTcjfQTGianmgPdkgTCvSGu8d907FNYdMHYf2LX5EZ5SDK6WGkcaEiao-1zZo53zTdQtcjH07HA
x-cache: HIT, HIT
fastly-io-info: ifsz=126323 idim=600x400 ifmt=jpeg ofsz=69842 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 69842
x-served-by: cache-iad-kjyo7100082-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172484.778006,VS0,VE0
etag: "HpOrjgklDZPyIY+tBN++vannKxDEhastw8795X2ynto"
vary: Accept
x-goog-generation: 1683813610590802
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=h72b8w==, md5=zIXwAVlosHSMTh/cMiKBCA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 126323
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 37, 16

GET
H2 200 12xp-shark-01-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/ 9 KB
9 KB 44ms
19ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/12xp-shark-01-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

4d1fa762c4ceaff06454053eb6b793bb211ef208329085b9073ecdffc90ccd31

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Fri, 12 May 2023 10:37:59 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 284604
x-guploader-uploadid: ADPycdvmG54jO3g7BrAh6piCQ5vgP3ipBqbl-lRZXgCptDizkELuhSXttN5gu7_28Y8JNsJMY88PTaz8elohZ5eHiEAMBg
x-cache: HIT, HIT
fastly-io-info: ifsz=31223 idim=600x401 ifmt=jpeg ofsz=8948 odim=600x401 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 8948
x-served-by: cache-iad-kcgs7200083-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172484.778553,VS0,VE0
etag: "zb5NLricPNuu23pF3Ka0EAFlQaleZgG3MNFZHiN2h0Y"
vary: Accept
x-goog-generation: 1683887404987381
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=+Vy6Cw==, md5=bEE6TPSYv/aoTAYTe/3LiQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 31223
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 11, 18

GET
H3 200 vendor-b261f5b50fd0c857de07.js Show response
login3.demonyins.top/vi-assets/static-assets/ 173 KB
50 KB 725ms
723ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/vendor-b261f5b50fd0c857de07.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5d4f80afc66fb8d60756e7daaf477e986ca9cd0f25325420e28baadd15c0e87

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdvvM3qJhPs3K9OO8vMI9HU0GiqfZNkdQ-YYPpgeGmLxJJzjZEBRgMiHDr-MtGtJaDgbI_CMgX-uOm7hKVe-XFptauX8Z11-
x-goog-stored-content-encoding: identity
x-origin-time: 2023-03-28 18:40:27 UTC
x-served-by: cache-sna10732-LGB
x-timer: S1684172484.195588,VS0,VE1
etag: W/"0e1f964af1f8b128478e4eda19557589"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1680028418821973
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendor-b261f5b50fd0c857de07.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 34222
expires: Wed, 27 Mar 2024 18:39:41 GMT
date: Mon, 15 May 2023 17:41:24 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 28 Mar 2023 18:33:38 GMT
server: cloudflare
x-goog-hash: crc32c=RBkcUw==, md5=Dh+WSvH4sShHjk7aGVV1iQ==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mXwctbn7XSkCXvLI2BN8YS05NgbyI%2FmutmEnh68V2ZqfIHNtC617%2FdLvj1cPVLFeSEnS%2F4L1PBx7SHucFWB3mPUSt33p0RR5VoemohsGm2V33bP%2F9vGCgU%2BaoJAeKI1z8d7XXfXZxSuPId4B0OD859AHdg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 177285
cf-ray: 7c7d2be77cfe39c8-FRA

GET
H3 200 home-eec6ea674dcf0eaf7d99.js Show response
login3.demonyins.top/vi-assets/static-assets/ 126 KB
38 KB 710ms
709ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/home-eec6ea674dcf0eaf7d99.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75233efd627abe6467968bc77764815e4039bd6f8391196716d8b0e16274df8b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsUixxI06ubQPi5neC8O39XDYiTrVwmut96QQOBerZ6-h04cKvKdZZ30d3VJYUyZFi8pgbwChna4Rd_vDV4hlwDk0a8Ewd0
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-15 15:36:12 UTC
x-served-by: cache-sna10749-LGB
x-timer: S1684172484.194380,VS0,VE1
etag: W/"0a29421703521881f558d8447f92a666"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1684164958533057
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/home-eec6ea674dcf0eaf7d99.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 398
expires: Tue, 14 May 2024 15:36:12 GMT
date: Mon, 15 May 2023 17:41:24 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 15 May 2023 15:35:58 GMT
server: cloudflare
x-goog-hash: crc32c=Ct1gRw==, md5=CilCFwNSGIH1WNhEf5KmZg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=imE9hzLFzN286zU2vNoTPAVWRenVkoCZgj8pFnzY7cMAtp%2FPKcduyNZzv3gS4G86rhYFqkWZtNBh0xVE4qEn0wrJFoWnRJp3eOU2KtJEHPmwxuH5OcqPiBJLGCEH%2BjS7gT4jSQgULFzDaoB2%2F7WfAC47AQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 129273
cf-ray: 7c7d2be77d0039c8-FRA

GET
H3 200 main-1ad4ce4767d07fda924f.js Show response
login3.demonyins.top/vi-assets/static-assets/ 1 MB
397 KB 681ms
679ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecd6da8a31f4ac7a6e09220679d1ff16e9e808522935a0b26c8d0cfe3dd6d5ea

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycds7Y0JFQ3SYUirErJM8-bSP0FQLnaJIyi8kW1DkeGopdkvKdUX4QLPpER_OjlA-Ufbld2CokzZarSpVbF3VMhq13w
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-15 15:36:05 UTC
x-served-by: cache-sna10728-LGB
x-timer: S1684172484.166393,VS0,VE1
etag: W/"e6a18ada99f396749121cb58a7b0480a"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1684164901170648
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 6
expires: Tue, 14 May 2024 15:36:05 GMT
date: Mon, 15 May 2023 17:41:24 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 15 May 2023 15:35:01 GMT
server: cloudflare
x-goog-hash: crc32c=KPr/9g==, md5=5qGK2pnzlnSRIctYp7BICg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EK9K1qskKtngiwLswjXkqtGP3PT52ZV6BUIE%2FFizz4evb%2Fu8Du%2Bie%2Bp7szx66xmCLK8LAQaIzkC1vyNFLYQ675XKcVYWTMaBgYyIZs9tfFIa4L45fvAGqPu4sxG5X9YR%2BIk0PU6CpKMvkr8bcgbHdxHHRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 1454644
cf-ray: 7c7d2be77d0139c8-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 406 KB
110 KB 54ms
28ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

75e954358ec7280b0740366108a85ccec6e7d2264702da7055b8fd152b9ac8eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112459
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
vary: *
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track
a.et.nytimes.com/ 0
0 364ms
125ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 180ms
126ms Preflight 151.101.129.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login3.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 0
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:41:23 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 19
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: MISS
x-nyt-meridiem: PM
x-nyt-region: RP
x-samizdat-query-exe-id: aa806b2f9fce193f
x-samizdat-query-field-errors: 0
x-served-by: cache-fra-eddf8230038-FRA
x-timer: S1684172484.797677,VS0,VE118

GET als
als-svc.nytimes.com/ 0
0

GET
H2 200 grumi-ip.js Show response
rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/ 14 KB
6 KB 74ms
15ms Script
application/javascript 2600:9000:2204:6e00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:6e00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f62c6457ddefdfd96ebc104603ccc8368e73afb6085b7b8018674cf5d3974ebe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:25:35 GMT
x-amz-version-id: ZeZbQXIiZ8B7xRijiw8G.q9OnSDyuFAm
content-encoding: br
last-modified: Mon, 27 Mar 2023 06:19:38 GMT
server: AmazonS3
via: 1.1 ac979e099d122e39d3a8fac95688a69a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
etag: W/"22b4da07003fc88ea067e3f866ea9c5a"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=14400, stale-while-revalidate=14400, immutable
age: 949
x-amz-cf-id: XZ2YosfoKv9Fc_r16g8rcy6kfpZ2mNaVi3fjOrR-FccH966RoAmXAA==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 230 KB
57 KB 72ms
11ms Script
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bf5de2a37e1b850ca9cc3b1a55bccd36def2be3524d0c5acb67b61f26aac8a96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:33:24 GMT
content-encoding: gzip
via: 1.1 1877c1d3c1c0435e896415d580d52c52.cloudfront.net (CloudFront), 1.1 e026b2802d48048e9935caadbecf124e.cloudfront.net (CloudFront)
last-modified: Wed, 10 May 2023 21:23:07 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P3
age: 480
etag: W/"e6af4658ab1a6fdde1f0066b27d5372e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: s1ytGFGoEP5Ty9lIumKrgwG_Zq4yCdQR6qplIG8eTENTOAQnJMCjCA==

GET
H2 200 prebid7.43.0b.js Show response
www.nytimes.com/ads/ 248 KB
80 KB 49ms
10ms Script
text/javascript 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nytimes.com/ads/prebid7.43.0b.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5a463100955fc30302bbd7079dcf03e75d66a0b148a56ee0f9578d05cc96a418

Security Headers

Name

Value

Content-Security-Policy

upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;

Strict-Transport-Security

max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: gzip
age: 551561
x-guploader-uploadid: ADPycdsuljV5IlCKdnf4odvcNt93Xu1fmnoEpY7z2jNgQvhvuLSvvIb2HDEZsnAPHmlUBXU5r90JMTGCpUtTEMnKtX_fmQ
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-25 08:28:41 UTC
x-served-by: cache-fra-eddf8230066-FRA
x-timer: S1684172484.791648,VS0,VE1
etag: "b1c0bb337eb2ca2772e3f66ea859162e"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1680615397749795
content-type: text/javascript
access-control-allow-origin: *
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/ads/prebid7.43.0b.js
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-nyt-app-webview: 0
x-nyt-route: ads-static-assets
x-nyt-edge-cache: HIT
x-cache-hits: 120
expires: Tue, 25 Apr 2023 08:28:40 GMT
date: Mon, 15 May 2023 17:41:23 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
content-length: 80465
last-modified: Tue, 04 Apr 2023 13:36:37 GMT
server: UploadServer
x-goog-hash: crc32c=J7VdOQ==, md5=scC7M36yyidy4/ZuqFkWLg==
x-gdpr: 1
x-goog-stored-content-length: 253681
accept-ranges: bytes

GET
H2 200 franklin-normal-700.91eaf6b5642463af4091160b4bbfdfcb.woff2
g1.nyt.com/fonts/family/franklin/ 20 KB
20 KB 27ms
9ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-700.91eaf6b5642463af4091160b4bbfdfcb.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

b5221e0636a97505ae38720d4ef182d35be5fb47d2628428db4fc918ab7ee30e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Sat, 21 Oct 2023 06:23:17 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 17839087
x-guploader-uploadid: ADPycduMMv-8etBF_QLtnaI0Y5YNVqBbkrVTdfH9RKMz8tHhvF73vnZXdkMZmGe8IsVibeYizebgUyzDVX5zx-V8xXLjJAX92dbf
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 20276
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 03 May 2022 17:15:51 GMT
server: UploadServer
x-timer: S1684172484.782820,VS0,VE0
etag: "91eaf6b5642463af4091160b4bbfdfcb"
x-goog-generation: 1651598151054057
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=teZvhg==, md5=ker2tWQkY69AkRYLS7/fyw==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 20276
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 9480

GET
H2 200 franklin-normal-500.0f4aea3d462cdb64748629efcbbf36bc.woff2
g1.nyt.com/fonts/family/franklin/ 19 KB
20 KB 28ms
10ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-500.0f4aea3d462cdb64748629efcbbf36bc.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

0b904723c5938b523c9ae329ba2b763681cb1de225c8f202d11012cbfd533f1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Sat, 21 Oct 2023 06:23:14 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 17839088
x-guploader-uploadid: ADPycdsQTVOzJvstvw9XibUb4r2EavGRoaYpno293g3PdRfhg_D53G9hTMPATQ5aSm7lUd2THAv77APBGIg9DF3ycFI57g
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 19816
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 03 May 2022 17:15:51 GMT
server: UploadServer
x-timer: S1684172484.783403,VS0,VE0
etag: "0f4aea3d462cdb64748629efcbbf36bc"
x-goog-generation: 1651598151017654
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=bdL0Mw==, md5=D0rqPUYs22R0hinvy782vA==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 19816
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 9488

GET
H2 200 cheltenham-normal-700.530cfb72378419eedb60da7e266ad5f1.woff2
g1.nyt.com/fonts/family/cheltenham/ 28 KB
28 KB 35ms
18ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-700.530cfb72378419eedb60da7e266ad5f1.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

564385e5dd8a1058fd759445c33b2c554d409528496b9d91533eeb079f6415de

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Sat, 21 Oct 2023 06:23:14 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 17839088
x-guploader-uploadid: ADPycdsd36fGJZTLSQtxa1LwTDIyVyefSgjAqkWjk5eM43gSsqZ00q5udZG8PMr2eVyiHayJkhxqa6WKkMdfawRADHJVb-9gB8jP
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 28276
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 03 May 2022 17:15:49 GMT
server: UploadServer
x-timer: S1684172484.783412,VS0,VE0
etag: "530cfb72378419eedb60da7e266ad5f1"
x-goog-generation: 1651598149856995
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=O9qQIA==, md5=Uwz7cjeEGe7bYNp+JmrV8Q==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 28276
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 837

GET
H2 200 imperial-normal-400.6131cd77b6e216c7693ed925f4309ffc.woff2
g1.nyt.com/fonts/family/imperial/ 26 KB
27 KB 27ms
10ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/imperial/imperial-normal-400.6131cd77b6e216c7693ed925f4309ffc.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

b32e3879c83af441e675efa49587cb894bdd3c10420475f79879fbfb7a69766b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 25 Jan 2024 00:32:20 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 9565743
x-guploader-uploadid: ADPycdu8EQpQm3V7zdMFkJ8XgnencwVnT2B2YUBtaf-sewkAiBh8gRLsetmgM9V27ohK7R6xXMuURFc3DzPNRarYrc9Kgw
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26504
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172484.783307,VS0,VE0
etag: "6131cd77b6e216c7693ed925f4309ffc"
x-goog-generation: 1673991776736810
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=ZzOuxA==, md5=YTHNd7biFsdpPtkl9DCf/A==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26504
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 9242

GET
H2 200 cheltenham-normal-300.7ea91ebd036309e1fe756ee3aab272da.woff2
g1.nyt.com/fonts/family/cheltenham/ 27 KB
27 KB 35ms
18ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-300.7ea91ebd036309e1fe756ee3aab272da.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e444fdaa833e612d239cf21a335b8322ad8cb7c7ba697ec978bdb454f5059519

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 25 Jan 2024 00:37:40 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 9565424
x-guploader-uploadid: ADPycdt38TCVFQs07sap3a_qPNNQhOB-oNJNkUm_5NonsSEFt4KS8xlMhMrghM6zQ_O5kimI_tkdWYmaGFdi_deDSjYNLGG5VM4c
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 27260
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172484.783333,VS0,VE0
etag: "7ea91ebd036309e1fe756ee3aab272da"
x-goog-generation: 1673991775007595
x-goog-hash: crc32c=rNQ9pA==, md5=fqkevQNjCeH+dW7jqrJy2g==
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 27260
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 1818

GET
DATA 200
OK truncated
/ 148 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73bd4d0f8a3ec1a6b0ec41f111a2b46ba4c242d4dc7bdf0817c4af97a6dfa48e

Request headers

Referer
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 cheltenham-small-italic-400.cdfa0ec29cca8c2d2f54c79d898e15c1.woff2
g1.nyt.com/fonts/family/cheltenham-small/ 23 KB
24 KB 8ms
7ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-small/cheltenham-small-italic-400.cdfa0ec29cca8c2d2f54c79d898e15c1.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

7dcbc19c68e87e4b23f85027e02ac7f3c89fa259973ec92bbe27e49ad002bf47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 01 May 2024 08:32:20 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1156143
x-guploader-uploadid: ADPycdvAlCgOiB-jUhxKme68l7ujmMr995gDVbm1cT5XNnNIt1ZGg9IG8XG-x-qu0KNPpUbVFx-mkPjhuY1Mt8sVJeEy
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 24028
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172484.843016,VS0,VE0
etag: "cdfa0ec29cca8c2d2f54c79d898e15c1"
x-goog-generation: 1673991775386814
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=2JQyuQ==, md5=zfoOwpzKjC0vVMediY4VwQ==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 24028
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 4

GET
H2 200 cheltenham-normal-200.40ccfe2cc61a71e6617e56162d49b896.woff2
g1.nyt.com/fonts/family/cheltenham/ 26 KB
26 KB 9ms
9ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-200.40ccfe2cc61a71e6617e56162d49b896.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

4f837869b80c34ed1a128362a6ed24ff5ebdae743dc55eb3c183ae9c8b5f4ca3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 30 Apr 2024 23:46:34 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1187689
x-guploader-uploadid: ADPycdsieML4XuwXFGqb9edZuCzrTUFlXDh-P9aDq6_mj1SAPBD_xFNAu5ycd1rrBhr_13xBo5niJr93aODWEUAWKo5O
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26448
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172484.843188,VS0,VE0
etag: "40ccfe2cc61a71e6617e56162d49b896"
x-goog-generation: 1673991775015704
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=kUZRqw==, md5=QMz+LMYaceZhflYWLUm4lg==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26448
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 2674

GET
H2 200 cheltenham-small-normal-700.1a0b316424cdebd18086b8dbbc768eef.woff2
g1.nyt.com/fonts/family/cheltenham-small/ 23 KB
23 KB 9ms
9ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-small/cheltenham-small-normal-700.1a0b316424cdebd18086b8dbbc768eef.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

9a43ab8056183a8efcf0e882990c2601381a735e02bba004439e010055c55d47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 20 Mar 2024 01:08:13 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 4811590
x-guploader-uploadid: ADPycdv5FLzvZAHLoSkzzAwtki4oKIrljUG2a0tdTaMAqDXtUeMPAEYq4plbBshmD1RTuNVB0Q8e5iZi8i1rn80UdubSJv7o4XQ2
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 23704
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172484.844057,VS0,VE0
etag: "1a0b316424cdebd18086b8dbbc768eef"
x-goog-generation: 1673991775396405
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=FTq84Q==, md5=GgsxZCTN69GAhrjbvHaO7w==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 23704
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 18

GET
H2 200 cheltenham-text-cond-normal-700.7e78f9e7e6c2e02d82592c4466929fa3.woff2
g1.nyt.com/fonts/family/cheltenham-text-cond/ 28 KB
29 KB 9ms
9ms Font
application/octet-stream 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-text-cond/cheltenham-text-cond-normal-700.7e78f9e7e6c2e02d82592c4466929fa3.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1ecb1f9522433be3adfad377816095c7d5b27d02c1efbbbb793e341b829d83d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login3.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 24 Apr 2024 03:07:37 GMT
date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1780427
x-guploader-uploadid: ADPycdsuHnCngxuV92uCr6KfwhXTgp0bNy4NESzb5fDKO57AkWLb6s1nij7tl1k_fl96eXP9E06pV1Pyyvp2xNCCh8ryKQ
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 28868
x-served-by: cache-fra-eddf8230112-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172484.844158,VS0,VE0
etag: "7e78f9e7e6c2e02d82592c4466929fa3"
x-goog-generation: 1673991775506403
x-goog-hash: crc32c=UQFt6w==, md5=fnj55+bC4C2CWSxEZpKfow==
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 28868
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 18

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/ 368 KB
110 KB 17ms
17ms Script
text/javascript 2600:9000:2204:6e00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi.js
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:6e00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f63504a15a3289297bad1f9a745f4b832949f3156e76b36888defd7948b532eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:25:34 GMT
x-amz-version-id: K_BiY69MkQWIGXQ0IJYllFiclR8cuOtm
content-encoding: br
last-modified: Mon, 15 May 2023 17:06:25 GMT
server: AmazonS3
via: 1.1 ac979e099d122e39d3a8fac95688a69a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS50-C1
etag: W/"2ef186073651e0fd07f0cae2fa5d9d1f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age: 950
x-amz-cf-id: jhxUI-VtndLw_F3Ot1Q4tsGC1dw_285Tvt8TZjt7PBRg7IL-aDsS5A==

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
305 B 111ms
110ms XHR
text/plain 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3030&u=https%3A%2F%2Flogin3.demonyins.top
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:23 GMT
via: 1.1 e026b2802d48048e9935caadbecf124e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-cache: Miss from cloudfront
access-control-allow-origin: https://login3.demonyins.top
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: jyNg5ux9ft3aH9AiDQ3v9QD9_8GjzxmBGTivC9Fu7lWLh1HV0YoKLg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 443ms
425ms XHR
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:25 GMT
x-amz-version-id: yHpogsakS7iCluwAmUa6Y9ccBYm32d5h
content-encoding: gzip
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
last-modified: Thu, 11 May 2023 21:16:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: p4jOBlyVFxQw_uxCsvg0_Ih6Y-QScd8DkzqPUA-X6ox5FBINDjMGVA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
507 B 267ms
186ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin3.demonyins.top%2F&pid=1o8iEmlT1FZnn&cb=0&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-top_hp_web%22%7D%2C%7B%22sd%22%3A%22top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22top_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:24 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 7831c78db9d585e32d354900cc00dca6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: 2DS6ZWT9A14H5Y9ZPTQN
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: I5x7j3UHg2jvMPEbllzGzjTS6T2hmsYPOo6wNt2FVfo4caZ4IWl4lA==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 75 KB
25 KB 159ms
71ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aad9281971ff2efa259987fc89b9fed06e1b2ec8e6f8fd4ba9e77d1214f370b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25446
x-xss-protection: 0
server: cafe
etag: 143 / 19492 / 31074557 / config-hash: 6508097778422352816
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 17:41:24 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 428 B
763 B 71ms
15ms XHR
application/json 2602:803:c004:200::140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088370&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rf=https%3A%2F%2Flogin3.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login3.demonyins.top&tg_i.page=https%3A%2F%2Flogin3.demonyins.top%2F&tg_i.invCode=nyt_home_top&tg_i.pbadslot=dfp-ad-top&tk_flint=pbjs_lite_v7.43.0&x_source.tid=ecfcd17e-495f-4b9f-b7b5-ea20d247daec&l_pb_bid_id=26976fd5c0c91f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.4877111789222468
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b219420d9f8d16fdedd17558b72179888645475f9fc33db59441444de69b4ec7

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login3.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 428
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
764 B 71ms
15ms XHR
application/json 2602:803:c004:200::140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin3.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login3.demonyins.top&tg_i.page=https%3A%2F%2Flogin3.demonyins.top%2F&tg_i.invCode=nyt_home_mid1&tg_i.pbadslot=dfp-ad-mid1&tk_flint=pbjs_lite_v7.43.0&x_source.tid=7e249e69-198b-4295-bb48-c6076e306ff3&l_pb_bid_id=3bed36bba5d2ed&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.18302327277503005
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9c3d5d946b0411b2b67e350193ea041021b391447b501b4f70b27b68bcb45009

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login3.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
994 B 65ms
10ms XHR
application/json 2602:803:c004:200::140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin3.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login3.demonyins.top&tg_i.page=https%3A%2F%2Flogin3.demonyins.top%2F&tg_i.invCode=nyt_home_mid2&tg_i.pbadslot=dfp-ad-mid2&tk_flint=pbjs_lite_v7.43.0&x_source.tid=846ad214-603a-4c95-879a-e5e62e1d50b7&l_pb_bid_id=44ae4893a82e84&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6694111793159563
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0a9b16835a323b30af16ab963fc3229ffb5023465a8a22295456fadacd8bea06

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login3.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
765 B 69ms
14ms XHR
application/json 2602:803:c004:200::140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin3.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login3.demonyins.top&tg_i.page=https%3A%2F%2Flogin3.demonyins.top%2F&tg_i.invCode=nyt_home_mid3&tg_i.pbadslot=dfp-ad-mid3&tk_flint=pbjs_lite_v7.43.0&x_source.tid=05a9c2c6-cbe7-4436-86d2-2d422a32076c&l_pb_bid_id=5b0e90889bd2&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.07155234731380333
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 54ab5d8c909ecbee87adaaa441ad529f7f1316ef8e73ffc551168257db6ad8d6

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login3.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 434 B
767 B 85ms
30ms XHR
application/json 2602:803:c004:200::140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088374&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin3.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login3.demonyins.top&tg_i.page=https%3A%2F%2Flogin3.demonyins.top%2F&tg_i.invCode=nyt_home_bottom&tg_i.pbadslot=dfp-ad-bottom&tk_flint=pbjs_lite_v7.43.0&x_source.tid=32a4af37-508c-4d1c-a5f5-fb814ec8eaa1&l_pb_bid_id=611d45fd7b3469&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8077304921043171
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 12bfc2ffa5b648fa994d79f30e1ff2efd0cf0810c8b1b7a89e5190c125eeaaa7

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login3.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 434
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
585 B 49ms
13ms XHR
application/json 3.127.73.194
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.43.0&referrer=https%3A%2F%2Flogin3.demonyins.top%2F&tmax=10000

Requested by

Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.127.73.194 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-127-73-194.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
accept-ch: sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile
x-auction-status: 3, 3, 3, 3, 3
content-type: application/json; charset=utf-8
access-control-allow-origin: https://login3.demonyins.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 53 B
862 B 75ms
18ms XHR
application/json 185.89.210.46
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.2 /

Resource Hash

a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 17:41:24 GMT
AN-X-Request-Uuid: 39356323-aeea-4b56-a6d5-d3f88b1ae4e1
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://login3.demonyins.top
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 37.58.58.245; 37.58.58.245; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 53
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 338 B
607 B 197ms
141ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU4WQK98
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: d222643460fb2014590d9c0e8a686df7fdf660d9bb7dbb210a6833d77b406e79

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 17:41:24 GMT

GET
H2 200 arj Show response
nytimes-d.openx.net/w/1.0/ 73 B
381 B 125ms
29ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://nytimes-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Flogin3.demonyins.top%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=ecfcd17e-495f-4b9f-b7b5-ea20d247daec%2C7e249e69-198b-4295-bb48-c6076e306ff3%2C846ad214-603a-4c95-879a-e5e62e1d50b7%2C05a9c2c6-cbe7-4436-86d2-2d422a32076c%2C32a4af37-508c-4d1c-a5f5-fb814ec8eaa1&nocache=1684172483974&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250&divids=dfp-ad-top%2Cdfp-ad-mid1%2Cdfp-ad-mid2%2Cdfp-ad-mid3%2Cdfp-ad-bottom&aucs=dfp-ad-top%2Cdfp-ad-mid1%2Cdfp-ad-mid2%2Cdfp-ad-mid3%2Cdfp-ad-bottom&auid=544112060%2C544112063%2C544112063%2C544112063%2C544112062&tps=aW52Y29kZT1ueXRfaG9tZV90b3A%3D%2CaW52Y29kZT1ueXRfaG9tZV9taWQx%2CaW52Y29kZT1ueXRfaG9tZV9taWQy%2CaW52Y29kZT1ueXRfaG9tZV9taWQz%2CaW52Y29kZT1ueXRfaG9tZV9ib3R0b20%3D
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 20416193294dc07cc4721b86a356570347bd7487986d905e2b017d25761f75b9

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:24 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://login3.demonyins.top
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/ 403 KB
125 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98a3ab26574717a95d200c12658c4dbbb28109a057cc52f8a100e6da2b645963

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 21:19:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73307
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127561
x-xss-protection: 0
server: cafe
etag: 1000764176958695900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 13 May 2024 21:19:37 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 42 B
70 B 81ms
43ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=login3.demonyins.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e5677139e2fc679b9a6c084b8b10912b96965576ab915f006f63ff516b13ccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
x-xss-protection: 0
expires: Mon, 15 May 2023 17:41:24 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
506 B 45ms
44ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin3.demonyins.top%2F&pid=1o8iEmlT1FZnn&cb=1&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-top_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:24 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 7831c78db9d585e32d354900cc00dca6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: R5QEFMPZMHYBM94C327A
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: XtXvcs2-pthgQXZup0gAxmoLcv9wWGIFa6aMxAY88YV5FGVQD4ZMyg==

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 69ms
18ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=login3.demonyins.top

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 678 B
376 B 51ms
51ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3617088193055267&correlator=1883961422579617&eid=31073865%2C31074543%2C31074557&output=ldjh&gdfp_req=1&vrg=202305100101&ptt=17&impl=fif&iu_parts=29390238%2Cnyt%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C970x90%7C970x250%7C1605x300&fluid=height&ifi=1&adks=2496155832&sfv=1-0-40&prev_scp=div%3Ddfp-ad-top%26pos%3Dtop%26amznbid%3D1%26amznp%3D1%26request_time%3D997&cust_params=als_test_clientside%3Dreqfailed_reqfailed_reqfailed_20230515174124%26edn%3Dus%26test%3Dprojectvi%26ver%3Dvi%26typ%3Dhp%26prop%3Dnyt%26plat%3Dweb%26abra_dfp%3D%26sov%3D1%26page_view_id%3DxcwJfMypjZ1Sr-o9xH12lMG3%26purr%3Dfull%26vp%3Dlarge%26uap%3Dbrowser&sc=1&cookie_enabled=1&abxe=1&dt=1684172484228&lmt=1684172473&dlt=1684172483239&idt=929&adxs=0&adys=15&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Flogin3.demonyins.top%2F&frm=20&vis=1&psz=1600x0&msz=1600x0&fws=4&ohw=1600&ga_vid=104318613.1684172484&ga_sid=1684172484&ga_hid=1689569312&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c4af2f25b86d38f27b1447e7809ddff54183e088f594433df1edf8ed8f4eff0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:24 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 346
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
e20e4f5c5aeded47efaea8d600f4ca1c.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 70F5 6 KB
3 KB 91ms
15ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e20e4f5c5aeded47efaea8d600f4ca1c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login3.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:41:24 GMT
expires: Tue, 14 May 2024 17:41:24 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js Show response
login3.demonyins.top/vi-assets/static-assets/ 45 KB
16 KB 598ms
597ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bf215be986357511cfca58e796434dbf348ee60f21d785a5ec54a1b2bf86aad

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdtCV-PKxiVphIO8DI9lDxPjrmytMOvu0OpHui-fUvU1cE8oD-DWNyyDkJTv4XVb6Q_kxW-HjCfklDLSlYsLKtMDVL8zWA3f
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-25 13:31:49 UTC
x-served-by: cache-sna10743-LGB
x-timer: S1684172486.557331,VS0,VE1
etag: W/"43c291b8f09c16e8d0f62d9520c31af0"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1682344117620870
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 527
expires: Wed, 24 Apr 2024 13:31:49 GMT
date: Mon, 15 May 2023 17:41:25 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 24 Apr 2023 13:48:37 GMT
server: cloudflare
x-goog-hash: crc32c=TXHOfA==, md5=Q8KRuPCcFujQ9i2VIMMa8A==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hX6VFq8hBqA6SAMvDDL%2FmrvzrQQ6rsjvQwY%2FnpmaNa6VKE9kV9SubHsXq1eCTL9e89whlrXdqCpD0gsFxm0XJjVusRm0OSF1qSWcLWC4OqJlcDD83aB675%2FQakyxdMVQe2vSLxSwuYqiQeRyWImFGB0SDg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 46523
cf-ray: 7c7d2befb8f639c8-FRA

GET
H3 200 vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js Show response
login3.demonyins.top/vi-assets/static-assets/ 21 KB
6 KB 513ms
512ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdbc97a6eafca5758332d9df4182243e2cace6a3960898b1b603652c689a88da

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdtjFhRw4EhX_w4vHvZUOyWCxIxMPb1A8u12Nm8dalss6NTLdHEYlxSjxHMYoPaE2ZekBd09-99_PcI7hrmT5KxcMUR0vspd
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-02 07:36:06 UTC
x-served-by: cache-sna10735-LGB
x-timer: S1684172486.506440,VS0,VE1
etag: W/"1e07834fc5f5299ca69c83a2dfb0dded"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1682993519974109
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 298
expires: Wed, 01 May 2024 07:36:06 GMT
date: Mon, 15 May 2023 17:41:25 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 02 May 2023 02:13:51 GMT
server: cloudflare
x-goog-hash: crc32c=blhS2g==, md5=HgeDT8X1KZymnIOi37Dd7Q==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oaN%2BhpXaLTv9obwrxXwHAg8R%2BWlCv98qcjYto2b%2BtD%2BcUSndAqQ4anYgvcrARcl9ZcKCk62WmLIygQfOBNL9eDAzojBMEMmSbVRWlyKVwZfAEP%2BWQzM%2Fu77xLEABbBulgJO1PTmO%2FVcvqcyaEWedNw49Cw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 21721
cf-ray: 7c7d2befb8f739c8-FRA

GET
H3 200 vendors~home-7fa14ae6eded78270c01.js Show response
login3.demonyins.top/vi-assets/static-assets/ 535 KB
112 KB 732ms
731ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/vi-assets/static-assets/vendors~home-7fa14ae6eded78270c01.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

766e2c94d35a881dfa209017c895c44c47b20b6aa215f27f2f455a83d1a7304f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdvb3dt1AVtdeD8gjhBg0Qs9kq1uTWStqC5xgH3CQuxECnyWgFMwW0yv_oSUCnbFY-597CnnmqWPGQL5Dt9y2J6mptiL2ZIZ
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-11 14:43:50 UTC
x-served-by: cache-sna10742-LGB
x-timer: S1684172486.523869,VS0,VE1
etag: W/"d80eeecdbf266544f4fa8d236f58eb6f"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1683816008978436
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~home-7fa14ae6eded78270c01.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 5517
expires: Fri, 10 May 2024 14:43:50 GMT
date: Mon, 15 May 2023 17:41:25 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 11 May 2023 14:40:09 GMT
server: cloudflare
x-goog-hash: crc32c=FKch7g==, md5=2A7uzb8mZUT0+o0jb1jrbw==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nW3qX1mQTsE3NYgmSJQe5%2BO9mrDmbbrNxYvjUSgv81SiJVl0owT%2BlWe7uXXa0vCxvkLexk%2FylAYSLPyh4ydgJfN1w18NqI7yqx6zmn8cJmoBhnpXNKoKMD2PzQF9%2B68x%2FYVgKZZY0bEycfNrB%2FHaKKjiaA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 548235
cf-ray: 7c7d2befb8f839c8-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 122 KB
43 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N5P6T9S&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6c1b8786304a1acf111fda059acf1a2c3e946cf226ddaa6bd52528090bbe64e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44176
x-xss-protection: 0
last-modified: Mon, 15 May 2023 16:09:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 15 May 2023 17:41:25 GMT

GET
H2 200 tags.js Show response
dd.nytimes.com/ 266 KB
55 KB 174ms
24ms Script
text/javascript 65.9.95.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.nytimes.com/tags.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-95-76.prg50.r.cloudfront.net

Software

Apache /

Resource Hash

078b159fb8403c40be85c805a1ee088fec7f3e2ad5db26ac94d22ddfd00c50cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
via: 1.1 598a1f878f2efc16baaf47787ffe82d2.cloudfront.net (CloudFront), 1.1 f631e696fd022598ec39e248ac48b192.cloudfront.net (CloudFront)
date: Mon, 15 May 2023 17:25:51 GMT
x-amz-cf-pop: FRA60-P2, PRG50-C1
age: 944
x-cache: Hit from cloudfront
content-length: 55493
last-modified: Fri, 05 May 2023 08:25:33 GMT
server: Apache
etag: "42845-5faee086486b0-gzip"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3600, public
accept-ranges: bytes
x-amz-cf-id: nDYyqVv0Jv1kwkTDNarHaYbD2CuAWi9DSLTG7tAwiNN3vjNf5dYimw==
expires: Mon, 15 May 2023 18:25:41 GMT

GET
H2 204 b
sb.scorecardresearch.com/ 0
227 B 47ms
9ms Image
text/plain 13.32.121.72
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=2&c2=3005403&ns__t=1684172485138&ns_c=UTF-8&c8=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&c7=https%3A%2F%2Flogin3.demonyins.top%2F&c9=
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-72.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:25 GMT
via: 1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P1
x-amz-cf-id: f3JayqNrsUCLZfm-RNfvHZ78N8AgDPjOdxYkMnDzjoaYPi4ff6B5VQ==
x-cache: Miss from cloudfront

POST
H2 200 / Show response
dd.nytimes.com/js/ 240 B
626 B 115ms
67ms XHR
application/json 65.9.95.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.nytimes.com/js/

Requested by

Host: dd.nytimes.com
URL: https://dd.nytimes.com/tags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-95-76.prg50.r.cloudfront.net

Software

DataDome /

Resource Hash

099de5e54c910062f87382c88de47487f2f93fabf158f60d495127e5593fcb3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:25 GMT
via: 1.1 b031f43146c9801101822eabdc464390.cloudfront.net (CloudFront)
strict-transport-security: max-age=63072000; includeSubDomains; preload
server: DataDome
x-amz-cf-pop: PRG50-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 240
x-amz-cf-id: O6PHwCFvkxApDUWh_4z70PCx4BdB8fv7CZcKb_hTRNkDcgqT7gldcQ==
expires: 0

POST
H2 200 track
a.et.nytimes.com/ 0
0 124ms
124ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 8ms
8ms Preflight 151.101.129.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login3.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 2
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:41:26 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: HIT
x-cache-hits: 1
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 19
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: HIT
x-nyt-meridiem: PM
x-nyt-region: RP
x-samizdat-query-exe-id: a0427e9c12a81659
x-samizdat-query-field-errors: 0
x-served-by: cache-fra-eddf8230038-FRA
x-timer: S1684172486.165741,VS0,VE1

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 11ms
11ms Preflight 151.101.129.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.129.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login3.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 3
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:41:26 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: HIT
x-cache-hits: 2
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 19
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: HIT
x-nyt-meridiem: PM
x-nyt-region: RP
x-samizdat-query-exe-id: a97c87199553942b
x-samizdat-query-field-errors: 0
x-served-by: cache-fra-eddf8230038-FRA
x-timer: S1684172486.461413,VS0,VE1

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET
H3 200 market Show response
login3.demonyins.top/api/ 516 B
1 KB 512ms
512ms XHR
application/json 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login3.demonyins.top/api/market

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ac11e09b9bce018e4c4006c32a4c723f8bc41fba73bede8078572c625b1f9f4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:26 GMT
content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-F-X
age: 58
x-cache: HIT, HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-origin-time: 2023-05-15 17:40:28 UTC
x-served-by: cache-lga21927-LGA, cache-sna10738-LGB
server: cloudflare
x-timer: S1684172487.746339,VS0,VE1
vary: Accept-Encoding, Fastly-SSL
x-frame-options: DENY
content-type: application/json; charset=utf-8
access-control-allow-origin: *
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/api/market
x-cloud-trace-context: df5be0786fd786f0b1e6f8b23f20e455/13490382108105574728;o=1
cache-control: s-maxage=60,(null)
x-nyt-route: market
x-nyt-app-webview: 0
x-gdpr: 0
x-nyt-edge-cache: HIT-HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ikd07b0PxiAXkgSkp2IkF5kwRPwAzQ0Z7nEoDyxtz1%2BhRigctVux9xS0ccD%2BZ1m27PUxLxHuOqaDf%2BrhfX%2FG1xn71i5viO%2BWtgmeLyGLl8wGxrlZIzAdP09Gxosm2BeIT%2FupPeO4ZzJ2HsA4bmakn%2FNUsA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7c7d2bf77bb739c8-FRA
x-cache-hits: 18, 2

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 58ms
57ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin3.demonyins.top%2F&pid=1o8iEmlT1FZnn&cb=2&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid1%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid1_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 7831c78db9d585e32d354900cc00dca6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: 7B3GKQMY0BYQGS0RAFE6
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: zdvh2VWJXfmkE6o5u97NJl7iPueXn26QwVpvzShrhv6k7-TDGyv-Gg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 56ms
55ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin3.demonyins.top%2F&pid=1o8iEmlT1FZnn&cb=3&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid2%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid2_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 7831c78db9d585e32d354900cc00dca6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: 9G8SF2D69TK6KJ3XDN5C
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: fu_QBNKyn5u7AqFYaFym8vEBfkgR948LB1taJtEvsJDMv07nm1WDbg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 57ms
57ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin3.demonyins.top%2F&pid=1o8iEmlT1FZnn&cb=4&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid3%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid3_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 7831c78db9d585e32d354900cc00dca6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: W0Q4WZRDN62MJJR295VC
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: FxaQ6hcDAVOZkRmndhy10yODR4680uZmd-4x81NNUJgxxXqd5XrdgA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 56ms
56ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin3.demonyins.top%2F&pid=1o8iEmlT1FZnn&cb=5&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-bottom%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-bottom_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-239-116.fra56.r.cloudfront.net

Software

Server /

Resource Hash

111041158b9290ae7cc0c6da69d7c4f5600e8a73b4c7399d675df7f15ba7b063

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 7831c78db9d585e32d354900cc00dca6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: GYH2E8NZBZA8T333KT4F
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login3.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: DWBLsxjm8p_Bk2JN5FR5YZUKiByAi7y33Yya5v96XcSaW-0XMLfiKw==

GET purr-cache
purr.nytimes.com/v1/ 0
0

GET data-layer
a.nytimes.com/svc/nyt/ 0
0

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET meter.js
meter-svc.nytimes.com/ 0
0

GET
H2 200 15turkey-analysis-mfqh-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15turkey-analysis-mfqh/ 42 KB
43 KB 12ms
10ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15turkey-analysis-mfqh/15turkey-analysis-mfqh-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

ea4d15a211ff965dccd52c1b45fba79f7137802c5c9eaedb8922ac39f43084b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:50:48 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 3038
x-guploader-uploadid: ADPycdt7tECLWNzUgQmhm7aJiAazNCgpAzASUrldbO7xItpk9zJG1d6Sd_sYdTKVpvhQzZLdk_qZT9wdS3zuJM0M1FH9m96TgkTK
x-cache: HIT, HIT
fastly-io-info: ifsz=84718 idim=600x400 ifmt=jpeg ofsz=43296 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 43296
x-served-by: cache-iad-kjyo7100050-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.732394,VS0,VE0
etag: "mFlQssjSaYGsDP6scpTKnUwwQj9tGr0hMknU2SVmwaQ"
vary: Accept
x-goog-generation: 1684168944776482
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=AVmsLw==, md5=wv06VVVo5l+mm2wQ3uuI+w==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 84718
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 23, 6

GET
H2 200 15ukraine-briefing-britain-hp-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15ukraine-briefing-britain-hp/ 52 KB
53 KB 24ms
22ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15ukraine-briefing-britain-hp/15ukraine-briefing-britain-hp-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a99a576eb367116330b5928f8aaf72581d35a07ac5d47a2cb60034eef61c3502

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:15:35 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30352
x-guploader-uploadid: ADPycdvOJo6J6Kg_uMjDSIklBuvK9ggwejxNEIcbg0RV7W80HRf3n_8ZEs_DzPHlSQtAc2mQFKg6UBpS6kxTt-O-iY3lRuWCgMte
x-cache: HIT, HIT
fastly-io-info: ifsz=81973 idim=600x400 ifmt=jpeg ofsz=53086 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 53086
x-served-by: cache-iad-kcgs7200048-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.733633,VS0,VE2
etag: "mjex0YFIaGMauq6Z27qq2hoxCwoLi6eRCHGqkYUC7N8"
vary: Accept
x-goog-generation: 1684141861821066
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=UoW/hQ==, md5=iuJG/usWsGY3yiQD7UipfA==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 81973
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 1

GET
H2 200 15sci-dna-ethics-A-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/ 68 KB
69 KB 16ms
14ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/15sci-dna-ethics-A-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d9044bdd43082d9979c3f3b3fa873058af8bb15424484cc98cb1761c5012855e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 15:02:16 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 9551
x-guploader-uploadid: ADPycdsPgjMPw4l2gHOyIJp0hSvt1dtbrswC2WcTTqSEnSJXOBD44XL71UxQBd_8goBdqjwK-B6h-rgRuYCGA5FZ8kpbq7_I7Vxp
x-cache: HIT, HIT
fastly-io-info: ifsz=123269 idim=600x400 ifmt=jpeg ofsz=69756 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 69756
x-served-by: cache-iad-kcgs7200057-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.733155,VS0,VE0
etag: "pH2zxBFpvsIXrmS4qyQIN87EPO0lqzsbeOrH5wcVRSw"
vary: Accept
x-goog-generation: 1684162829216873
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=tNUH8g==, md5=zsrygEMi2fUGaOk0j76Tyw==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 123269
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 43, 6

GET
H2 200 07DEI-BELONGING-02-sub-qktb-threeByTwoSmallAt2X-v2.jpg
static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/ 19 KB
19 KB 24ms
22ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/07DEI-BELONGING-02-sub-qktb-threeByTwoSmallAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8d3c17714229b3f3ea111cde31221a1be9ec66e102343645193ee596102e9a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 10:54:22 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 24424
x-guploader-uploadid: ADPycdvmDL8ZgCsRvIz_Ar8ksTCbZoSyfAI6BfUrnPRbOalF0rWge_fSoyUxn-sex58YMaUWRJeKmVImM_w78evSHPYjJzzTfUfm
x-cache: HIT, HIT
fastly-io-info: ifsz=56087 idim=600x400 ifmt=jpeg ofsz=19066 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 19066
x-served-by: cache-iad-kjyo7100114-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.733091,VS0,VE3
etag: "KBtlA1V4WjHTNE5V50RLyY/u24LSmj+pPL5CLJTI+cI"
vary: Accept
x-goog-generation: 1684148059156533
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=2KTzAw==, md5=us+yx5g7w4NAonxxJSGi3Q==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 56087
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 1

GET
H2 200 00nat-nc-abortion-showdown-01-wtcq-threeByTwoSmallAt2X-v2.jpg
static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/ 29 KB
29 KB 13ms
12ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/00nat-nc-abortion-showdown-01-wtcq-threeByTwoSmallAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a363038e6f698ddb820a9011456e78e51f077fa178bd3c9392f18f9c7d94312f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 10:04:53 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 27393
x-guploader-uploadid: ADPycdtYIsWQJossjbhj4NE9a7V60nF5ZGVKOxUOLgPwuHwxvH4NtIWgiU9TtfIc046nakfEovrSMU6IYcZsdFp7WkfIliD-DEfk
x-cache: HIT, HIT
fastly-io-info: ifsz=71618 idim=600x400 ifmt=jpeg ofsz=29698 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 29698
x-served-by: cache-iad-kjyo7100022-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.733038,VS0,VE0
etag: "FDp0NuTD9QQyweOM80tqrF1pjtB1wa8AuYDWlC3Rb2E"
vary: Accept
x-goog-generation: 1684145091884843
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=Tesl+Q==, md5=658p2WygCMQ2Wh3b4dNgQQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 71618
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 29, 3

GET
H2 200 00ny-collapse46-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/ 35 KB
35 KB 14ms
13ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/00ny-collapse46-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e6365a9cb7358ac9859c94ef03b78b5a4326c485488d3d65e41bfc914ff48495

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:18:02 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30205
x-guploader-uploadid: ADPycdv-RjySkmz9WN3ne-kS8XkSmDpu2M6UEqxVZ_hJxTqgYl13bNrG7lzDqe5PHmrEAGdVI4IqhxJd8IDRqRC8IHkoCgh-wApL
x-cache: HIT, HIT
fastly-io-info: ifsz=72756 idim=600x400 ifmt=jpeg ofsz=35602 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 35602
x-served-by: cache-iad-kcgs7200126-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.733051,VS0,VE0
etag: "EBg/5enaCAm22vhecGWWQjzDtdp98AwlyJ4FV5HmEW4"
vary: Accept
x-goog-generation: 1684001402069039
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=oNOYjw==, md5=IXx5X5yvxYHyirVzj6vr4g==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 72756
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 3

GET
H2 200 00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg
static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/ 65 KB
66 KB 17ms
16ms Image
image/jpeg 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

173bfe854ae5d662b3183aff18eb7732eb38d2033d6645555cfa193cf09c558e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:08:01 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 5605
x-guploader-uploadid: ADPycduBfbTdVYXd6ddT6eiTJ_AVwsZNHY4v0irQzoriYOQehL066LQ6kZ5fnvAkH9hv9Gfp1dd_lHyQ1jIN2LbePPEs0IPcBaxO
x-cache: MISS, HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 66716
x-served-by: cache-iad-kcgs7200049-IAD, cache-fra-eddf8230066-FRA
last-modified: Mon, 15 May 2023 16:07:38 GMT
server: UploadServer
x-timer: S1684172487.745375,VS0,VE0
etag: "a68953e9f5a95550f641efdcb12f727e"
vary: Accept
x-goog-generation: 1684166858419715
content-type: image/jpeg
access-control-allow-origin: *
x-goog-hash: crc32c=0DccLQ==, md5=polT6fWpVVD2Qe/csS9yfg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 66716
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 2

GET
H2 200 15ruck2-zqvw-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15ruck2-zqvw/ 10 KB
11 KB 18ms
17ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15ruck2-zqvw/15ruck2-zqvw-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d60b320665b3e96d51b567aa07b4f548ada837085bf31ada92cd951901225fe3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:18:32 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30174
x-guploader-uploadid: ADPycdtT4oOtzqWtr1DYT7-hNJKPs3x3iguLUcEQO5FC0gS6QU9KAtqJpXpn6qzviAlIE8j5WHcOB4e3oJaUFry2X2P3gSDlY2dt
x-cache: HIT, HIT
fastly-io-info: ifsz=32537 idim=600x400 ifmt=jpeg ofsz=10262 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 10262
x-served-by: cache-iad-kjyo7100030-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.745863,VS0,VE1
etag: "Nn9Fc+ga/54Cj2NJuIvHNU20MVEJoa6AvLbZOlLaocY"
vary: Accept
x-goog-generation: 1684141210191243
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=mMH/JA==, md5=xqnKhT2J+OYca+8khFn2Tg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 32537
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 32, 1

GET
H2 200 15gopnik-lead-square320.jpg
static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/ 6 KB
6 KB 17ms
16ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/15gopnik-lead-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

ca532afa1a5a67ac9b9f209165c21b1bc6f24945cafbb85418c082bf32605e07

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:57:31 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 27836
x-guploader-uploadid: ADPycdt2bG3FXkzTWJAn1XUiCBR_hN6GrQXtPWZ1FVZEb1VXdMSMJitck006nQNw0EPt3LD2QVJZflcARRU9w1UaFXBOPw
x-cache: HIT, HIT
fastly-io-info: ifsz=20438 idim=320x320 ifmt=jpeg ofsz=5768 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 5768
x-served-by: cache-iad-kiad7000097-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.748385,VS0,VE0
etag: "+qddYcOpcEVbO/bCVPeXQafiajdnP1HWulXjJZSPyzI"
vary: Accept
x-goog-generation: 1684141211789042
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=/ljFcg==, md5=omJtgaEA0CKsZnwPOxCsMw==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 20438
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 7, 105

GET
H2 200 margaret-renkl-new-thumbLarge.png
static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/ 22 KB
23 KB 12ms
12ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/margaret-renkl-new-thumbLarge.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5ea85610c6d6b5ed83d53797e88a907d53e2034b2df7f63bca6c7277976f96f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 17 Apr 2023 16:16:27 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 28302
x-guploader-uploadid: ADPycduGwLw3BtKYXYf5u2eLeovLTJN0fFHliYaiznNmnRWGXotf_VguSFAIrL2T6B8AVhqqU_fVz1ZAAugZ-M6h500q7Pq2i8Y5
x-cache: HIT, HIT
fastly-io-info: ifsz=36961 idim=150x150 ifmt=png ofsz=22640 odim=150x150 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 22640
x-served-by: cache-iad-kjyo7100130-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.755522,VS0,VE0
etag: "hoVlFIxH7rLt0KmY17hVz55a8Xab/9s6RZJLHlnaplo"
vary: Accept
x-goog-generation: 1681313959579894
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=XC9hiQ==, md5=d6vtrjCtKDtlp1puQ08jOQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 36961
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1140, 123

GET
H2 200 15villavicencio-ktlv-square320.jpg
static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/ 11 KB
12 KB 15ms
14ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/15villavicencio-ktlv-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

03e7fba5ecb056e71e259bcad78b6d080ab0ef90a9510ad8cbc57cd29b0befda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 15:53:29 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 6477
x-guploader-uploadid: ADPycdvimGqnj-Y47l4DIQ2uo_xiQjY7fHmipyQWgGIyF5Ye0R5EzgJB0gsQeRpJdQRZ5UXEp2v2s_k1gRKmb0vbVfvxT4CsoZcQ
x-cache: HIT, HIT
fastly-io-info: ifsz=31329 idim=320x320 ifmt=jpeg ofsz=11388 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 11388
x-served-by: cache-iad-kjyo7100086-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.760965,VS0,VE3
etag: "bG9hTdIdRNlMs+IVIJs7SovdpEUwvvlclNd08GtoNYI"
vary: Accept
x-goog-generation: 1684141217907804
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=lmeGLQ==, md5=L2ogKVDcu2UBqSvV6azw6w==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 31329
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 74, 1

GET
H2 200 david-french-thumbLarge-v2.png
static01.nyt.com/images/2023/01/10/opinion/david-french/ 18 KB
19 KB 12ms
12ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/01/10/opinion/david-french/david-french-thumbLarge-v2.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

6d444d1e6f52bfe57c1180cf064cab58e6941684bf09bbe236e3578fd2e23e65

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 24 Apr 2023 04:30:50 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 47435
x-guploader-uploadid: ADPycdugQRaxhuy3NhKo7Gtk7Y8i7o7E2DfOvecUWSG15XqVk0Oenvgx82t992x0rGHgLJ5t2ZQnTEx4dMNIHUZw3sXdHzaAEzwS
x-cache: HIT, HIT
fastly-io-info: ifsz=29917 idim=150x150 ifmt=png ofsz=18472 odim=150x150 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 18472
x-served-by: cache-iad-kcgs7200099-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.760477,VS0,VE0
etag: "UHMslo9fQpXlqe4rzWoQP7xQ8lwHh2b+h+7eIbfguhw"
vary: Accept
x-goog-generation: 1679948948755521
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=Os64Sw==, md5=ik813eCgSskbkzQKQl7kCA==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 29917
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 122

GET
H2 200 the-daily-album-art-square320-v5.jpg
static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/ 4 KB
4 KB 10ms
10ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/the-daily-album-art-square320-v5.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

66debd0db62a3f53e72503a053f862b586a886e6a399fd8243b5e0180d304dec

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 24 Apr 2023 17:00:56 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2429
x-guploader-uploadid: ADPycduyRA4n-gUc82OBqk5k7l2TJuAgrd2LOEcVdOy6HB_dBl0DkF2cr1KE4clXHXKs1t9xph_H8VMqD6aUpAo8kn9ufA0M3t0n
x-cache: HIT, HIT
fastly-io-info: ifsz=15986 idim=320x320 ifmt=jpeg ofsz=3614 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 3614
x-served-by: cache-iad-kcgs7200066-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.762441,VS0,VE0
etag: "HnnVz93O4bK0D9Smvlwnf0lv96YmNmLNlX7IWtdXh7Q"
vary: Accept
x-goog-generation: 1676481259772829
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=JiXB7Q==, md5=PfDXw6toN2ZQvpOKxIlHug==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 15986
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 496, 6

GET
H2 200 the-morning-icon-square320.png
static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/ 18 KB
19 KB 9ms
9ms Image
image/webp 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/the-morning-icon-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

2e937efb936592a5daf1512eed7708ce749abc0025ce481edc94d01d4a719067

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 13 Apr 2023 07:16:16 GMT
date: Mon, 15 May 2023 17:41:26 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 477260
x-guploader-uploadid: ADPycdsetZT2qsfezPZ6fhuIPsK8Jj91KHdz4FbF1nEA3yZt8R_SlNFNT_ElxmH1Lp1vTQkgDPDf56tfHU4M7OjKGd-Z
x-cache: HIT, HIT
fastly-io-info: ifsz=28435 idim=320x320 ifmt=png ofsz=18846 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 18846
x-served-by: cache-iad-kiad7000149-IAD, cache-fra-eddf8230066-FRA
server: UploadServer
x-timer: S1684172487.764423,VS0,VE0
etag: "fvmiwkoVSucPkCQm5zWXms48Wd/eA+b71aA/zw+i3+w"
vary: Accept
x-goog-generation: 1647343871193623
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=ySN2bw==, md5=zI0rsfov1F0wMhGvqBk3Qg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 28435
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5065, 6

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 32ms
8ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 15 May 2023 16:35:39 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 3947
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 15 May 2023 18:35:39 GMT

GET
H2

200

activityi;dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~... Show response
5290727.fls.doubleclick.net/ Frame 62EB
Redirect Chain

https://5290727.fls.doubleclick.net/activityi;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=...
https://5290727.fls.doubleclick.net/activityi;dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%...

455 B
587 B

57ms
55ms

Document
text/html

142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5290727.fls.doubleclick.net/activityi;dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demonyins.top%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f6.1e100.net

Software

cafe /

Resource Hash

1415ee1adeb89a50a41c02b93b37f26b297bc4aa1fa37883d8e64959fa839748

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login3.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 249
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:41:26 GMT
expires: Mon, 15 May 2023 17:41:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:41:26 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5290727.fls.doubleclick.net/activityi;dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demonyins.top%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 chartbeat_video.js Show response
static.chartbeat.com/js/ 70 KB
24 KB 61ms
12ms Script
application/x-javascript 2600:9000:243d:1600:18:1fcd:351:7bc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_video.js
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:1600:18:1fcd:351:7bc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a4e403c7245b00375232364f36d09d16a96488154a2414d40ce211e4693ef8d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 03:24:56 GMT
content-encoding: gzip
via: 1.1 2761ce52850c9b9803b4378a87eb9e78.cloudfront.net (CloudFront)
last-modified: Thu, 08 Dec 2022 17:02:37 GMT
server: nginx
x-amz-cf-pop: DUS51-P4
age: 51390
etag: W/"639218ad-11856"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-amz-cf-id: KwS8bJ1xIYJNM31SuYWWL4MY-24fbfxjUj3NVIDoalGC_JQtAcjO3Q==
expires: Tue, 16 May 2023 03:24:56 GMT

GET
H2 200 show-ads.js Show response
a1.nyt.com/analytics/ 45 B
684 B 19ms
10ms Script
text/javascript 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.nyt.com/analytics/show-ads.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8aa1e610b22079cb84a89491850b86860036e3f2c9750a367d839b9a6a63d306

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 13 Apr 2023 05:00:40 GMT
date: Mon, 15 May 2023 17:41:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 46328
x-guploader-uploadid: ADPycduQ4dVgD4_gc-w-jr1N4uVUC2C_toCIkWUbquDhGnrcLQLbqbybeWh__r_Wk_OAEQMPGpXD9_npxgFi-wf_YXFvWQ
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 65
x-served-by: cache-fra-eddf8230066-FRA
last-modified: Wed, 22 Dec 2021 23:30:41 GMT
server: UploadServer
x-timer: S1684172487.845374,VS0,VE0
etag: "1d291da792456bd015b664ee1119a5e0"
vary: Accept-Encoding
x-goog-generation: 1640215841852360
x-goog-hash: crc32c=nM1/Pw==, md5=HSkdp5JFa9AVtmTuERml4A==
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=86400
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 45
accept-ranges: bytes
x-nyt-pagetype: nyt-dti-analytic
timing-allow-origin: *
x-cache-hits: 917

GET
H2 200 comscore-streaming.js Show response
a1.nyt.com/analytics/ 103 KB
19 KB 19ms
10ms Script
text/javascript 151.101.193.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.nyt.com/analytics/comscore-streaming.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.193.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

fe8d5a6f12533884b6896dd290e422c830e86e0228d45dbe97ac03c6e86a5b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 03 May 2023 02:30:54 GMT
date: Mon, 15 May 2023 17:41:26 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 54602
x-guploader-uploadid: ADPycduqdaSryPFkcLL2Gf1G5WmWCD8B6rg-UWgLf6QrS4KUSExlNNhn8gaGfFCWtrmSDH8asVnlja9lKT166GqBRdREOVoggEnR
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 18717
x-served-by: cache-fra-eddf8230066-FRA
last-modified: Wed, 22 Dec 2021 23:30:41 GMT
server: UploadServer
x-timer: S1684172487.845541,VS0,VE0
etag: "04e0b9556a78ce5cedf86a34e5483036"
vary: Accept-Encoding
x-goog-generation: 1640215841902856
x-goog-hash: crc32c=XkdIyw==, md5=BOC5VWp4zlzt+Go05UgwNg==
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=86400
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 105675
accept-ranges: bytes
x-nyt-pagetype: nyt-dti-analytic
timing-allow-origin: *
x-cache-hits: 548

GET
H2 200 nyt.js Show response
cdn.brandmetrics.com/tag/85a1ebf79602421aa1c2c2f24d32cb6c/ 4 KB
2 KB 56ms
19ms Script
text/javascript 2606:4700:20::681a:c12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/tag/85a1ebf79602421aa1c2c2f24d32cb6c/nyt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:c12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c21a976bd2fa363568a31c73de29c8e071abac667139623ae743dce1bda9b14

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:26 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 15 May 2023 17:28:30 GMT
server: cloudflare
age: 776
cf-polished: origSize=4725
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9oHLCrrRyNPmBItIoRInmJPoxkorduDgb0Lio5ltryDK9jqKOzgXt%2BI9U0I3uYmmkDu1Pp7RFPYyLojAk0HUSBbeCo9igdh%2BXW11k3EKRkZI80kcLt0OsyTdBcOiViBW9rhd5Uo2ftHi4w1yfGRaEGl"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c7d2bfaf9c3bb5c-FRA
request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
211 B 15ms
14ms XHR
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&aip=1&a=1689569312&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nytimes.com%2F&dr=&ul=en-us&de=UTF-8&dt=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAEABAAAAACgBM~&jid=247091707&gjid=1625908922&cid=104318613.1684172484&tid=UA-58630905-7&_gid=1034674970.1684172487&_r=1&_slc=1&gtm=45He35a0n71P528B3&cg1=homepage&cg2=null&cg3=homepage&cg4=null&cd1=https%3A%2F%2Fwww.nytimes.com%2F&cd2=https%3A%2F%2Flogin3.demonyins.top%2F&cd3=&cd9=9&cd10=null&cd13=null&cd14=null&cd15=earned&cd16=referring_links&cd21=Homepage&cd26=null&cd27=null&cd28=null&cd29=null&cd30=null&cd36=&cd42=nyt-vi&cd48=null&cd49=&cd51=nyt-vi&cd52=&cd54=null&cd57=0&cd58=0&cd59=&cd60=&cd67=0&cd95=&cd122=&cd123=&cd124=&cd125=&cd126=&cd127=&cd129=NaN&cd135=&cd139=&cd141=&cd142=&cd162=&cd163=&cd172=desktop&cd173=desktop&z=1923296884

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://login3.demonyins.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 65568.js Show response
cdn.brandmetrics.com/scripts/bundle/ 46 KB
15 KB 116ms
116ms Script
text/javascript 2606:4700:20::681a:c12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login3.demonyins.top
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:c12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 519b0247d3da7b20bd944e54ea565b097e37b91a644427e04539b86548ac3321

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 15 May 2023 17:41:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R3q1yQq07NLRXOcKMz7hN7mAopm7LD%2FqCHPIW2j13ZVY0aJLfTGWgs%2FU1ZvCKqBFMCB7aoK%2FmKQtTRvExxB6pypFNkxG2cQ0nlyJM3Pnq0i6OMKPRws83zlpXrmZSWizcJtz4K053%2F9mZtykMd8xsXCb"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c7d2bfb8a9ebb5c-FRA
request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937

GET
H2 200 ping
pnytimes.chartbeat.net/ 43 B
201 B 332ms
106ms Image
image/gif 52.5.8.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pnytimes.chartbeat.net/ping?h=nytimes.com&p=nytimes.com%2F&u=CIYKePD97EYgBeU_Ob&d=login3.demonyins.top&g=16698&g0=Homepage&g1=No%20Author&n=1&f=00001&c=0&x=0&m=0&y=11417&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&PA=https%3A%2F%2Flogin3.demonyins.top%2F&b=4870&t=Cjw7RHbMEfMD9efMDNGS3hCSS-BR&V=139&i=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&tz=0&sn=1&sv=BpZdAfCHJ58DCIGzm2CtZcpGTqDAo&sd=1&im=06672fd3&_
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.8.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-8-3.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 17:41:27 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-length: 43
expires: 0

GET
H2 200 dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=*;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demo...
adservice.google.com/ddm/fls/z/ Frame 62EB 42 B
262 B 48ms
47ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=*;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demonyins.top%2F

Requested by

Host: 5290727.fls.doubleclick.net
URL: https://5290727.fls.doubleclick.net/activityi;dc_pre=CKf4ybbv9_4CFV_AOwIdM_4INA;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3377455155474;gtm=45He35a0;auiddc=1359007702.1684172487;u17=https%3A%2F%2Flogin3.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin3.demonyins.top%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5290727.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track
a.et.nytimes.com/ 0
0 227ms
227ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 c.js Show response
collector.brandmetrics.com/ 0
143 B 136ms
21ms Script
text/javascript 20.50.2.28
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.brandmetrics.com/c.js?siteid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login3.demonyins.top&rnd=4297411
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login3.demonyins.top
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.50.2.28 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937
date: Mon, 15 May 2023 17:41:26 GMT
content-length: 0
content-type: text/javascript;charset=utf-8

GET
H/1.1 200
OK cksync.php
cs.media.net/ 60 B
426 B 59ms
26ms Image
image/gif 23.212.88.20
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.88.20 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-88-20.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 17:41:27 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 60
x-mnet-hl2: E
Expires: Mon, 15 May 2023 17:41:27 GMT

GET
H2 200 pd
u.openx.net/w/1.0/ 43 B
131 B 45ms
20ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:41:27 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 sync
eb2.3lift.com/ 37 B
140 B 276ms
14ms Image
image/gif 76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/sync?px=1&src=prebid&
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H2 200 .status
a.et.nytimes.com// 0
0 126ms
126ms Fetch
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com//.status
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept: */*
Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type: text/plain;charset=UTF-8

Response headers

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 85ms
60ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202305100101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305100101/pubads_impl.js?cb=31074557

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1062e3d884db990eecb16b3c7efdca8dee90b6046fdb7419a4b925db1ee0e67b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11316
x-xss-protection: 0

GET
H2 200 loader.js Show response
platform.iteratehq.com/ 1 KB
1 KB 55ms
15ms Script
application/javascript 2606:4700:20::ac43:479c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.iteratehq.com/loader.js

Requested by

Host: login3.demonyins.top
URL: https://login3.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:479c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8319c824c1f3f053803abef05170a1f96d506b6a6628e0d1016ea1b7e15de89

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
x-amz-version-id: sxbh0sX1Uu_9VWD90bhaukCR16JbmzF2
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains
x-amz-request-id: 056YG4AM75SJP6DB
age: 77
x-amz-server-side-encryption: AES256
x-amz-id-2: fZQfSOT22oAaj4/yRGlr2MSZa4E2vk+NrEVMtw8aFUuC60VnxkU5l8rZlipOT5jto/JqSIKsvBE=
last-modified: Wed, 10 May 2023 19:20:45 GMT
server: cloudflare
etag: W/"8c061118fbe1f3981a379fa8bf00aa91"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tKqHQx%2FuLth4AWMmhYraTiPxu%2BpC3xTFtn79TqH6gPi9W3PtURDUZKncGzBBXEDTcdIDlcfDtqTqrzPftMBLJsoaKRkQ6tKGvBpV1eccmcA4PfnfatLjnMJG0iExtMLRaik7p%2BJkbhU8RhzpqOORa%2F%2BJqko%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 7c7d2bff0c5e3a44-FRA

GET
H2

200

cs.js Show response
sb.scorecardresearch.com/internal-c2/3005403/
Redirect Chain

https://sb.scorecardresearch.com/c2/3005403/cs.js
https://sb.scorecardresearch.com/internal-c2/3005403/cs.js

0
358 B

8ms
8ms

Script
application/javascript

13.32.121.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-c2/3005403/cs.js
Protocol: H2
Server: 13.32.121.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-72.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:28:05 GMT
via: 1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront)
last-modified: Mon, 01 Mar 2021 20:41:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 802
x-amz-server-side-encryption: AES256
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 0
x-amz-cf-id: hAUfaspudL2zzElP0TD0_xf14ImCSov41Il7MznxK3b83WSYvZEtBQ==

Redirect headers

date: Mon, 15 May 2023 17:41:27 GMT
via: 1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P1
x-cache: Miss from cloudfront
location: /internal-c2/3005403/cs.js
content-length: 0
x-amz-cf-id: iw-o4U8JI_39isvWCIbl2hqTvtcr2Ck80c_ynoIwCEJ1ITckNPhlJg==

GET
H2 200 match-prod-2ba9e5cdc9d92a535fcf.js Show response
platform.iteratehq.com/ 85 KB
30 KB 21ms
20ms Script
application/javascript 2606:4700:20::ac43:479c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:479c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe8914b592cfb54f22c6e9257dbd956efeeae4909f1328233dfe706be71c34d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
x-amz-version-id: b33MITr7SVI4DDhNP4LfAri2wMAOFhLe
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains
x-amz-request-id: XC4D2T4SR9M4PNJA
age: 425960
x-amz-server-side-encryption: AES256
x-amz-id-2: c4dep+Dnz4ChKoyKo6kFtiEObB/0nrrc25T6zNnamC2jm6hcryptB1k3y+fD4/pwr6/WjZAebkk=
last-modified: Wed, 10 May 2023 19:20:43 GMT
server: cloudflare
etag: W/"74caba77682b49745a5ab63f20fc5cde"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pnCfAdN4prMs1YDWovaPInaOIQWtTp%2FU%2FV%2B0YVBh1Mm3Pp8OLdJnc70CiDGOfo9OM863jsDA%2FYPYi91Hdtu%2FZhwAyMRIhXRMkeV6XrzLIlpmREFncLdbsuu24%2Bfak%2B5UVu37mnq15n8z3ANneOJzweqmJJA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 7c7d2bff2c9b3a44-FRA

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 113ms
67ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 17:41:27 GMT

OPTIONS
H2 200 embed
iteratehq.com/api/v1/surveys/ Frame 0
0 143ms
107ms Preflight 2606:4700:20::ac43:479c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:479c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login3.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-ray: 7c7d2bff9a229c07-FRA
content-length: 0
date: Mon, 15 May 2023 17:41:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uD%2Fw16vgzqksWNFKMAH9ND8yn3I6OmihGaTPytNuhwcdri4AED6USHanSkZ%2BxKyrrVEpjaHMl7oWqGhRRrJMa5NwU%2BraCgzv0xGta7c9HtwoEuRzhojTwd7HZNIvAeRcMRwjlZ0HasMfkDk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 embed Show response
iteratehq.com/api/v1/surveys/ 300 B
546 B 102ms
102ms Fetch
application/json 2606:4700:20::ac43:479c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:479c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12f034b3fd7d6481c207100be355137c2d7e5082860ff07cfb0e34132d41a1d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNTQ0MTI5MzQxfQ.UI13nEXGs0udbZxhjyFLruAEed42XwFO4fZlCqOgY1o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
strict-transport-security: max-age=0; includeSubDomains
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jweMWQQC23qwIPE3fz6AysCqKA37O7Mmo8wxDOT16D0i7KbAKd90iL7yOxasZAiIQUWEod%2BfUyM0PBi3vjK23LGC9ZNr1P8lPb%2BLMYC3Mzgir0PD%2B5iAifEd6fWy0PMhorZKSpYFQZTECwA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7c7d2c004b519c07-FRA

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1907 13 KB
5 KB 10ms
7ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login3.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11163
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 14:35:24 GMT
expires: Tue, 14 May 2024 14:35:24 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7C9F 783 B
1 KB 40ms
17ms Document
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6c48a26af6d7894a25aa1caba19fb195d8eaa46606ee3ea9834c1074c5e22af4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5duUOyo7PqOxevdUJvapgQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login3.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-5duUOyo7PqOxevdUJvapgQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:41:27 GMT
expires: Mon, 15 May 2023 17:41:27 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 08cn5b8EVMSc5l6e1YWDk0jg24yFrQ2cZ845B_qPECM.js Show response
pagead2.googlesyndication.com/bg/ Frame 1907 37 KB
14 KB 24ms
8ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/08cn5b8EVMSc5l6e1YWDk0jg24yFrQ2cZ845B_qPECM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3c727e5bf0454c49ce65e9ed585839348e0db8c85ad0d9c67ce3907fa8f1023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 09:14:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30435
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14732
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 May 2024 09:14:12 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 7C9F 0
0 110ms
109ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202305100101&jk=3617088193055267&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1907 0
10 B 8ms
7ms Image
text/plain 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?SUi7_g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:41:27 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 embed Show response
iteratehq.com/api/v1/surveys/ 64 B
348 B 106ms
106ms Fetch
application/json 2606:4700:20::ac43:479c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:479c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea939bd13d79a17cc436d4c3e102d4060cb7ebf0e8e61918f3d034580dff02b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiI2NDYyNmVjNzE5ZGRiMDAwMDFhNjM4MTQiLCJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNjg0MTcyNDg3fQ.Y5NR7vsjJ0mJ9uyAUYF7vR6xFCmdQXpQhCvZzQ-OHYo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 17:41:28 GMT
strict-transport-security: max-age=0; includeSubDomains
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zRXdJGEXaXre1G6kItnVfuIPnCCBaUW5pnpoJueIVx3%2BlOv%2BSOu2zYCAUG3pZpzbjc%2BG0RBUmj0GfgLtvaoTC7a8gJkjbyadWxZyKK13wunxcKp93%2F0Q8RNxtWgLo7XX002471bP%2Br3k7%2FI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7c7d2c0328149c07-FRA

OPTIONS
H2 200 embed
iteratehq.com/api/v1/surveys/ Frame 0
0 110ms
110ms Preflight 2606:4700:20::ac43:479c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:479c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login3.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-ray: 7c7d2c027f3b9c07-FRA
content-length: 0
date: Mon, 15 May 2023 17:41:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vUG7%2FJGaRLJ%2BLmtDuvaw1fg8a4t9r300Y8TcwD4CxNz9PyfchNcfkC8Q0v0fw9ab59qsI9wRO7%2FvucEZgLLRKO8SarKqJzg1ToqyK3VrNOe5eqX5f7PYH2D%2BhlhSDmk326wY42NjhZXTD1c%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 116ms
115ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202305100101&jk=3617088193055267&bg=!RUalRhLNAAYldGN0BXQ7ADkAdvg8Wq0UuiPLydyzr29nxe0JaRXkmuorNsvv2LsrF3AxUMi5pli0D0FQk-JDcU8wDFuQiM5aMyICAAAATVIAAAADaAEHCgCmH32frP1yhqJjoJdKWj13SlfpA5k9t788OTXce0QsUw5MMNrLbTu1s4N2DXn5YfefdxR3b4MpuasikfLGOl7HtKZgD83X7pcmT_3r3AOS3mlWiRy1moNSW1Bex_bRXWRY73yJnJFg71qtn741andjp4ZZhH2dDjzGw64aNaLa-n-pZcmYn1rfpX9JAKl4xn2mK42yeOm45FX3bJ0CxUYayCWure79vZkCr82yqGkw7QXd6GO7XbtvQ851cH2kJkofQBv49SYLp5yI-FuZoKmuxxY3QRHcyNpXNcl8o3cM70k_NWV7nBdnjiQOgkapuTo6XxG9sqBtXDJGIoGDpAS31mRr4LljvNJdUe1xsF_IkXDm1nhvNcyXLbDecc-IQWtjQ9vysZpc1Bsl6KdGikpFAu0FAM4bpRtbAzqu9t5UJS7p1ifKJ--T5q7Qb3Nt65IvqyOEbtNGoPnG12uOMgYfUcVjrZxwdS6n1-wF4k5wxpJOF3zjeC43lA01Gzb_RbhLOM8tb0nZARSUWQvbQvL2b71lbYeQ-_WO84AbLoNp_-ii6foKMEiyB04btmt5-SDKIGVLhF0XWGkGG0MYgmX7oEIRPvyPREHQx7pTyY5EUFrTsR9Li5JWpvYUm8NX_cJl_lLyK65m6zdt3ePX0EdmTXSzDwSc_gkrcCa7nJ0jvpFP_oiqcTyaghmVZAC7SGizfCJ63fijRQD0ht4MaQ5EooWal5TldfcS6K_R2ld_vkJHjuPExeyZyRuxq2N44SuqvKWBXU0H-Kl3LdllAkBz8XpjhSzhAWrNDfNmMVZzddyDzLbP06TsPALfgVWUcdUpSfpfZ3pQ-ijA9yHkbsHHfDQCMOGcq9EW4jF2mOWAWZLpggPBM0PueqAsIs_CROzdKX-tWmP2tv-gwxK_F-i6MJbvjVCRKZoli-6FsFxg_TYs_n01zHD0Xo8l-GE7BeRPiMXCPWzKxybwVWM9xZQwcJ6HVhxDOZvh0sqzNcaMXemu_iqrug2A1yQMvM0e3hJapUnWqBo8koMHUWDuJx1K-gPOXAh5YwWI71_uzIycqj4d2lQFIJSV_E6yTQiz0wU0noy5fD6Wro_2JTikpZMPtYVJKZosTUfEPbQajsFqjYg7npqqy05Hvg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login3.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

POST
H2 200 track
a.et.nytimes.com/ 0
0 124ms
124ms Ping
text/plain 44.211.112.71
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login3.demonyins.top
URL: https://login3.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.211.112.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-211-112-71.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login3.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: als-svc.nytimes.com
URL: https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: purr.nytimes.com
URL: https://purr.nytimes.com/v1/purr-cache

Domain: a.nytimes.com
URL: https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172486339&referrer=&sourceApp=nyt-vi

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: meter-svc.nytimes.com
URL: https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin3.demonyins.top%2F&referer=https%3A%2F%2Flogin3.demonyins.top%2F&pageviewID=xcwJfMypjZ1Sr-o9xH12lMG3

Verdicts & Comments Add Verdict or Comment

132 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rubiconproject.com/	1970-01-20 20:35:08	Name: khaos Value: LHP4T9L8-N-73DB
.rubiconproject.com/	1970-01-20 20:35:08	Name: audit Value: 1\|hLZGFuTafB16EsoXcAFLELJGe4Ni1ThWK2euPP2lVg2+SmvwaNDOnltJcFI6+Su0EKfoiZP4eSBtRKIJ8DqxoBDO8P6WoNZe2jL6aH0a0w6VOlHV8UEF7g==
.nytimes.com/	1970-01-20 20:35:08	Name: nyt-a Value: GWLEB3dpxDw19Vl-W8fwQa6s
.et.nytimes.com/	1970-01-20 11:49:34	Name: sessionActive Value: true
.et.nytimes.com/	1970-01-20 20:35:08	Name: sessionIndex Value: 1\|1684172484036\|GWLEB3dpxDw19Vl-W8fwQa6s\|1684172484036
.et.nytimes.com/	1970-01-20 11:50:58	Name: et-ppvid Value: https://login3.demonyins.top/=xcwJfMypjZ1Sr-o9xH12lMG3
.demonyins.top/	1970-01-20 21:11:08	Name: __gads Value: ID=9e01af39890366ca:T=1684172484:S=ALNI_MaTrdIwzWN_eZLX_1N-1J9TdnpxSQ
.demonyins.top/	1970-01-20 21:11:08	Name: __gpi Value: UID=00000c15c4ad2b6e:T=1684172484:RT=1684172484:S=ALNI_MawZXc9f-mQtPeHsSsjEVsgVZDwlg
.login3.demonyins.top/	1970-01-20 20:35:08	Name: datadome Value: 0-ISMRcxR_sU4oMsiYf1yd2RK8QTKrQB339U2rbrU409um~t5RFupU58-qZp~x1898WbYNJ62ZzMqsmGzYoL50cH8WpAI5ad4YQXYlSt6cfHgTnY4lIBl4-df~uq8uoB
.demonyins.top/	1970-01-20 13:59:08	Name: _gcl_au Value: 1.1.1359007702.1684172487
.demonyins.top/	1970-01-20 21:25:32	Name: walley Value: GA1.2.104318613.1684172484
.demonyins.top/	1970-01-20 11:50:58	Name: walley_gid Value: GA1.2.1034674970.1684172487
.demonyins.top/	1970-01-20 11:49:32	Name: _gat_UA-58630905-7 Value: 1
.demonyins.top/	1970-01-20 21:18:20	Name: _cb Value: CIYKePD97EYgBeU_Ob
.demonyins.top/	1970-01-20 21:18:20	Name: _chartbeat2 Value: .1684172486971.1684172486971.1.BpZdAfCHJ58DCIGzm2CtZcpGTqDAo.1
.demonyins.top/	1970-01-20 11:49:34	Name: _cb_svref Value: null
.doubleclick.net/	1970-01-20 21:11:08	Name: IDE Value: AHWqTUmKZyFe4qUQvQUA-GRUiUDqBsU_Lsi8hUti81wZTMtIh37VqSD13kG55DdioCs
.demonyins.top/	1970-01-20 21:25:32	Name: iter_id Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiI2NDYyNmVjNzE5ZGRiMDAwMDFhNjM4MTQiLCJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNjg0MTcyNDg3fQ.Y5NR7vsjJ0mJ9uyAUYF7vR6xFCmdQXpQhCvZzQ-OHYo

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://login3.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login3.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login3.demonyins.top/ Message: Access to XMLHttpRequest at 'https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web' from origin 'https://login3.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login3.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login3.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login3.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login3.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login3.demonyins.top/ Message: Access to XMLHttpRequest at 'https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172486339&referrer=&sourceApp=nyt-vi' from origin 'https://login3.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172486339&referrer=&sourceApp=nyt-vi Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login3.demonyins.top/ Message: Access to fetch at 'https://purr.nytimes.com/v1/purr-cache' from origin 'https://login3.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://purr.nytimes.com/v1/purr-cache Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login3.demonyins.top/ Message: Access to XMLHttpRequest at 'https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin3.demonyins.top%2F&referer=https%3A%2F%2Flogin3.demonyins.top%2F&pageviewID=xcwJfMypjZ1Sr-o9xH12lMG3' from origin 'https://login3.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin3.demonyins.top%2F&referer=https%3A%2F%2Flogin3.demonyins.top%2F&pageviewID=xcwJfMypjZ1Sr-o9xH12lMG3 Message: Failed to load resource: net::ERR_FAILED
javascript	warning	URL: https://login3.demonyins.top/ Message: The resource https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5290727.fls.doubleclick.net
a.et.nytimes.com
a.nytimes.com
a1.nyt.com
aax.amazon-adsystem.com
adservice.google.com
als-svc.nytimes.com
c.amazon-adsystem.com
cdn.brandmetrics.com
collector.brandmetrics.com
cs.media.net
dd.nytimes.com
e20e4f5c5aeded47efaea8d600f4ca1c.safeframe.googlesyndication.com
eb2.3lift.com
fastlane.rubiconproject.com
g1.nyt.com
ib.adnxs.com
iteratehq.com
login3.demonyins.top
meter-svc.nytimes.com
nytimes-d.openx.net
pagead2.googlesyndication.com
platform.iteratehq.com
pnytimes.chartbeat.net
prebid.media.net
purr.nytimes.com
rumcdn.geoedge.be
samizdat-graphql.nytimes.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
static.chartbeat.com
static01.nyt.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.nytimes.com
a.nytimes.com
als-svc.nytimes.com
meter-svc.nytimes.com
purr.nytimes.com
samizdat-graphql.nytimes.com
13.32.121.72
142.250.184.230
151.101.129.164
151.101.193.164
185.89.210.46
20.50.2.28
23.212.88.20
2600:9000:2204:6e00:4:b37b:9440:93a1
2600:9000:243d:1600:18:1fcd:351:7bc1
2602:803:c004:200::140
2606:4700:20::681a:c12
2606:4700:20::ac43:479c
2606:4700:3031::ac43:d8c7
2a00:1450:4001:803::2002
2a00:1450:4001:806::2001
2a00:1450:4001:809::2001
2a00:1450:4001:812::200e
2a00:1450:4001:827::2002
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2004
3.127.73.194
34.107.148.139
34.98.64.218
44.211.112.71
52.222.208.154
52.222.239.116
52.5.8.3
65.9.95.76
76.223.111.18
03e7fba5ecb056e71e259bcad78b6d080ab0ef90a9510ad8cbc57cd29b0befda
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
078b159fb8403c40be85c805a1ee088fec7f3e2ad5db26ac94d22ddfd00c50cf
099de5e54c910062f87382c88de47487f2f93fabf158f60d495127e5593fcb3e
09bff184ea094a06e46d7f26512fd7b245304078a27f1ba8084488cbcf7704de
0a9b16835a323b30af16ab963fc3229ffb5023465a8a22295456fadacd8bea06
0b904723c5938b523c9ae329ba2b763681cb1de225c8f202d11012cbfd533f1f
0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16
1062e3d884db990eecb16b3c7efdca8dee90b6046fdb7419a4b925db1ee0e67b
111041158b9290ae7cc0c6da69d7c4f5600e8a73b4c7399d675df7f15ba7b063
12bfc2ffa5b648fa994d79f30e1ff2efd0cf0810c8b1b7a89e5190c125eeaaa7
12f034b3fd7d6481c207100be355137c2d7e5082860ff07cfb0e34132d41a1d4
1415ee1adeb89a50a41c02b93b37f26b297bc4aa1fa37883d8e64959fa839748
173bfe854ae5d662b3183aff18eb7732eb38d2033d6645555cfa193cf09c558e
1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3
1c4af2f25b86d38f27b1447e7809ddff54183e088f594433df1edf8ed8f4eff0
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1ecb1f9522433be3adfad377816095c7d5b27d02c1efbbbb793e341b829d83d9
20416193294dc07cc4721b86a356570347bd7487986d905e2b017d25761f75b9
2ac11e09b9bce018e4c4006c32a4c723f8bc41fba73bede8078572c625b1f9f4
2e937efb936592a5daf1512eed7708ce749abc0025ce481edc94d01d4a719067
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4d1fa762c4ceaff06454053eb6b793bb211ef208329085b9073ecdffc90ccd31
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f837869b80c34ed1a128362a6ed24ff5ebdae743dc55eb3c183ae9c8b5f4ca3
519b0247d3da7b20bd944e54ea565b097e37b91a644427e04539b86548ac3321
54ab5d8c909ecbee87adaaa441ad529f7f1316ef8e73ffc551168257db6ad8d6
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
564385e5dd8a1058fd759445c33b2c554d409528496b9d91533eeb079f6415de
57bc281be64ff5ec8e3c2258640df6097a32f08ac5a2c346f214300eb430f176
5a463100955fc30302bbd7079dcf03e75d66a0b148a56ee0f9578d05cc96a418
5af3756336be117aeae1865f764ab57d5fd8384ec55be872fd9862b71047311f
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
5e5677139e2fc679b9a6c084b8b10912b96965576ab915f006f63ff516b13ccc
5ea85610c6d6b5ed83d53797e88a907d53e2034b2df7f63bca6c7277976f96f0
6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
66debd0db62a3f53e72503a053f862b586a886e6a399fd8243b5e0180d304dec
6c48a26af6d7894a25aa1caba19fb195d8eaa46606ee3ea9834c1074c5e22af4
6d444d1e6f52bfe57c1180cf064cab58e6941684bf09bbe236e3578fd2e23e65
73bd4d0f8a3ec1a6b0ec41f111a2b46ba4c242d4dc7bdf0817c4af97a6dfa48e
75233efd627abe6467968bc77764815e4039bd6f8391196716d8b0e16274df8b
75e954358ec7280b0740366108a85ccec6e7d2264702da7055b8fd152b9ac8eb
766e2c94d35a881dfa209017c895c44c47b20b6aa215f27f2f455a83d1a7304f
7c21a976bd2fa363568a31c73de29c8e071abac667139623ae743dce1bda9b14
7dcbc19c68e87e4b23f85027e02ac7f3c89fa259973ec92bbe27e49ad002bf47
88c02f49ec94fda86796bb949e3674af90a3b642839f424a4c13e510259a49b4
8aa1e610b22079cb84a89491850b86860036e3f2c9750a367d839b9a6a63d306
8bf215be986357511cfca58e796434dbf348ee60f21d785a5ec54a1b2bf86aad
8d3c17714229b3f3ea111cde31221a1be9ec66e102343645193ee596102e9a48
8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09
8fd57afe26f59515704cee10d922b01c9d1aaa8257abf811490d7fdef48d1e73
98a3ab26574717a95d200c12658c4dbbb28109a057cc52f8a100e6da2b645963
9a43ab8056183a8efcf0e882990c2601381a735e02bba004439e010055c55d47
9c3d5d946b0411b2b67e350193ea041021b391447b501b4f70b27b68bcb45009
a24f932ec2d451ea6c910d90ed34cddd6a24af4ec7f434a484ee4db22871cfbd
a363038e6f698ddb820a9011456e78e51f077fa178bd3c9392f18f9c7d94312f
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4e403c7245b00375232364f36d09d16a96488154a2414d40ce211e4693ef8d4
a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73
a6c1b8786304a1acf111fda059acf1a2c3e946cf226ddaa6bd52528090bbe64e
a99a576eb367116330b5928f8aaf72581d35a07ac5d47a2cb60034eef61c3502
aad9281971ff2efa259987fc89b9fed06e1b2ec8e6f8fd4ba9e77d1214f370b1
b219420d9f8d16fdedd17558b72179888645475f9fc33db59441444de69b4ec7
b32e3879c83af441e675efa49587cb894bdd3c10420475f79879fbfb7a69766b
b5221e0636a97505ae38720d4ef182d35be5fb47d2628428db4fc918ab7ee30e
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bf5de2a37e1b850ca9cc3b1a55bccd36def2be3524d0c5acb67b61f26aac8a96
ca532afa1a5a67ac9b9f209165c21b1bc6f24945cafbb85418c082bf32605e07
cdbc97a6eafca5758332d9df4182243e2cace6a3960898b1b603652c689a88da
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d222643460fb2014590d9c0e8a686df7fdf660d9bb7dbb210a6833d77b406e79
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d3c727e5bf0454c49ce65e9ed585839348e0db8c85ad0d9c67ce3907fa8f1023
d4c5b9f51bf43056dacc9054f4a0ca873b8b9ef2afb9eb445a62d5cc6c426dd4
d60b320665b3e96d51b567aa07b4f548ada837085bf31ada92cd951901225fe3
d8319c824c1f3f053803abef05170a1f96d506b6a6628e0d1016ea1b7e15de89
d9044bdd43082d9979c3f3b3fa873058af8bb15424484cc98cb1761c5012855e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e444fdaa833e612d239cf21a335b8322ad8cb7c7ba697ec978bdb454f5059519
e6365a9cb7358ac9859c94ef03b78b5a4326c485488d3d65e41bfc914ff48495
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ea4d15a211ff965dccd52c1b45fba79f7137802c5c9eaedb8922ac39f43084b9
ea939bd13d79a17cc436d4c3e102d4060cb7ebf0e8e61918f3d034580dff02b9
ecd6da8a31f4ac7a6e09220679d1ff16e9e808522935a0b26c8d0cfe3dd6d5ea
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5d4f80afc66fb8d60756e7daaf477e986ca9cd0f25325420e28baadd15c0e87
f62c6457ddefdfd96ebc104603ccc8368e73afb6085b7b8018674cf5d3974ebe
f63504a15a3289297bad1f9a745f4b832949f3156e76b36888defd7948b532eb
fe8914b592cfb54f22c6e9257dbd956efeeae4909f1328233dfe706be71c34d3
fe8d5a6f12533884b6896dd290e422c830e86e0228d45dbe97ac03c6e86a5b5a

login3.demonyins.top Open in urlscan Pro 2606:4700:3031::ac43:d8c7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

114 Requests

93 %HTTPS

47 %IPv6

20 Domains

39 Subdomains

31 IPs

3 Countries

2263 kBTransfer

6268 kBSize

18 Cookies

80 Outgoing links

Redirected requests

114 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

login3.demonyins.top Open in urlscan Pro
2606:4700:3031::ac43:d8c7 Public Scan

Screenshot
Live screenshot

Full Image

114
Requests

93 %
HTTPS

47 %
IPv6

20
Domains

39
Subdomains

31
IPs

3
Countries

2263 kB
Transfer

6268 kB
Size

18
Cookies

114 HTTP transactions
1 data transactions