account.newsobserver.com Open in urlscan Pro
2a02:26f0:6c00::210:ba9a Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.newsobserver.com/news/state/north-carolina/article250722934.html?ac_cid=DM463957&ac_bid=658303512
Effective URL:
https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Submission: On June 04 via manual (June 4th 2021, 4:37:21 pm UTC) from US

Summary HTTP 124 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 47 IPs in 7 countries across 29 domains to perform 124 HTTP transactions. The main IP is 2a02:26f0:6c00::210:ba9a, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is account.newsobserver.com.
TLS certificate: Issued by DigiCert ECC Extended Validation Serv... on August 24th 2020. Valid for: 2 years.

This is the only time account.newsobserver.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 3	104.111.219.128 104.111.219.128	16625 (AKAMAI-AS) (AKAMAI-AS)
17	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba9a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
7	166.108.32.249 166.108.32.249	6118 (MCCLATCHY...) (MCCLATCHY-CORP)
1	2a02:26f0:6c0... 2a02:26f0:6c00:2b0::31c6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
7	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
7	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
6	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
5	3.250.252.43 3.250.252.43	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
4	54.165.186.74 54.165.186.74	14618 (AMAZON-AES) (AMAZON-AES)
1 2	107.178.250.234 107.178.250.234	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1 2	18.202.103.217 18.202.103.217	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:218... 2600:9000:218f:5e00:18:1fcd:34f:cdc1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
3	34.238.206.177 34.238.206.177	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::200d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	15.236.176.210 15.236.176.210	16509 (AMAZON-02) (AMAZON-02)
1 1	34.253.145.149 34.253.145.149	16509 (AMAZON-02) (AMAZON-02)
2	34.252.166.160 34.252.166.160	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
3	34.230.139.180 34.230.139.180	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2001	15169 (GOOGLE) (GOOGLE)
9 10	151.101.114.49 151.101.114.49	54113 (FASTLY) (FASTLY)
1 2	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	185.33.220.241 185.33.220.241	29990 (ASN-APPNEX) (ASN-APPNEX)
1	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
124	47

3 104.111.219.128 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-219-128.deploy.static.akamaitechnologies.com

www.newsobserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
media.mcclatchy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a02:26f0:6c00::210:ba9a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

account.newsobserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

news.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 166.108.32.249 (United States)

ASN6118 (MCCLATCHY-CORP, US)
PTR: vnet623.ejoco.com

media.mcclatchyinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:2b0::31c6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

static.mcclatchyinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.250.252.43 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-250-252-43.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mcclatchy.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.165.186.74 (United States)

ASN14618 (AMAZON-AES, US)

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.202.103.217 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-202-103-217.eu-west-1.compute.amazonaws.com

secure-us.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:218f:5e00:18:1fcd:34f:cdc1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.238.206.177 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-238-206-177.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.176.210 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

mcclatchy.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.145.149 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-145-149.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.252.166.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-166-160.eu-west-1.compute.amazonaws.com

mcclatchy.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.230.139.180 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-139-180.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

dc92b30916660fe84580e95e98422bdb.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.114.49 (Frankfurt am Main, Germany) 9 redirects

ASN54113 (FASTLY, US)

lasteventf-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.220.241 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.208.240 (United States)

ASN13335 (CLOUDFLARENET, US)

zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (United States) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	google.com www.google.com news.google.com play.google.com apis.google.com accounts.google.com adservice.google.com	105 KB
19	newsobserver.com 2 redirects www.newsobserver.com account.newsobserver.com	398 KB
11	everesttech.net 10 redirects cm.everesttech.net lasteventf-tm.everesttech.net sync-tm.everesttech.net	2 KB
11	doubleclick.net 1 redirects pubads.g.doubleclick.net stats.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	113 KB
9	gstatic.com www.gstatic.com fonts.gstatic.com ssl.gstatic.com	309 KB
8	mcclatchyinteractive.com media.mcclatchyinteractive.com static.mcclatchyinteractive.com	142 KB
6	googlesyndication.com dc92b30916660fe84580e95e98422bdb.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	25 KB
6	facebook.com www.facebook.com	604 B
5	google-analytics.com www.google-analytics.com	19 KB
5	matheranalytics.com 1 redirects js.matheranalytics.com www.i.matheranalytics.com	26 KB
5	demdex.net dpm.demdex.net mcclatchy.demdex.net	9 KB
4	omtrdc.net mcclatchy.sc.omtrdc.net mcclatchy.tt.omtrdc.net	4 KB
4	stackadapt.com tags.srv.stackadapt.com	6 KB
3	google.de www.google.de adservice.google.de	970 B
3	chartbeat.net ping.chartbeat.net	337 B
3	facebook.net connect.facebook.net	161 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com	1 KB
2	openx.net 1 redirects us-u.openx.net	469 B
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	chartbeat.com static.chartbeat.com	25 KB
2	imrworldwide.com 1 redirects secure-us.imrworldwide.com	936 B
1	pubmatic.com image2.pubmatic.com	546 B
1	qualtrics.com zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com	17 KB
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	googleadservices.com www.googleadservices.com	14 KB
1	googletagservices.com www.googletagservices.com	21 KB
1	googletagmanager.com www.googletagmanager.com	34 KB
1	mcclatchy.com media.mcclatchy.com	82 KB
124	29

	Domain	Requested by
17	account.newsobserver.com	account.newsobserver.com
9	sync-tm.everesttech.net	9 redirects
7	play.google.com	www.gstatic.com
7	www.gstatic.com	www.google.com news.google.com www.gstatic.com
7	media.mcclatchyinteractive.com	account.newsobserver.com media.mcclatchyinteractive.com
7	news.google.com	account.newsobserver.com news.google.com www.gstatic.com
6	www.facebook.com	connect.facebook.net account.newsobserver.com
5	www.google-analytics.com	media.mcclatchyinteractive.com www.google-analytics.com account.newsobserver.com
5	pubads.g.doubleclick.net	news.google.com media.mcclatchyinteractive.com account.newsobserver.com
4	tags.srv.stackadapt.com	media.mcclatchyinteractive.com tags.srv.stackadapt.com
4	dpm.demdex.net	media.mcclatchyinteractive.com account.newsobserver.com
4	www.google.com	account.newsobserver.com tpc.googlesyndication.com
3	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	www.i.matheranalytics.com	account.newsobserver.com
3	ping.chartbeat.net	account.newsobserver.com static.chartbeat.com
3	connect.facebook.net	account.newsobserver.com media.mcclatchyinteractive.com connect.facebook.net
2	sync.search.spotxchange.com	1 redirects
2	us-u.openx.net	1 redirects
2	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	cm.g.doubleclick.net	1 redirects account.newsobserver.com
2	mcclatchy.tt.omtrdc.net	media.mcclatchyinteractive.com
2	mcclatchy.sc.omtrdc.net	media.mcclatchyinteractive.com
2	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	www.google.de	account.newsobserver.com
2	accounts.google.com	apis.google.com ssl.gstatic.com
2	static.chartbeat.com	media.mcclatchyinteractive.com
2	secure-us.imrworldwide.com	1 redirects account.newsobserver.com
2	js.matheranalytics.com	1 redirects account.newsobserver.com
2	www.newsobserver.com	2 redirects
1	image2.pubmatic.com
1	zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com	media.mcclatchyinteractive.com
1	pixel.rubiconproject.com	account.newsobserver.com
1	lasteventf-tm.everesttech.net	media.mcclatchyinteractive.com
1	dc92b30916660fe84580e95e98422bdb.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	cm.everesttech.net	1 redirects
1	mcclatchy.demdex.net	media.mcclatchyinteractive.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	ssl.gstatic.com	accounts.google.com
1	www.googleadservices.com	www.googletagmanager.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	apis.google.com	account.newsobserver.com
1	www.googletagservices.com	static.mcclatchyinteractive.com
1	www.googletagmanager.com	media.mcclatchyinteractive.com
1	fonts.gstatic.com	news.google.com
1	static.mcclatchyinteractive.com	account.newsobserver.com
1	media.mcclatchy.com	account.newsobserver.com
124	50

This site contains links to these domains. Also see Links.

Domain
www.newsobserver.com

Subject Issuer	Validity	Valid
news.bellinghamherald.com DigiCert ECC Extended Validation Server CA	`2020-08-24` - `2022-08-24`	2 years	crt.sh
www.google.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.news.google.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
www.mcclatchydc.com DigiCert SHA2 Secure Server CA	`2021-02-11` - `2022-01-31`	a year	crt.sh
kidstownnc.com Entrust Certification Authority - L1K	`2021-04-28` - `2022-05-27`	a year	crt.sh
www.mcclatchy.com DigiCert SHA2 Extended Validation Server CA	`2019-11-14` - `2022-02-12`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-05-26` - `2021-08-24`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.srv.stackadapt.com Amazon	`2020-12-09` - `2022-01-07`	a year	crt.sh
js.matheranalytics.com Sectigo RSA Domain Validation Secure Server CA	`2021-03-19` - `2022-04-19`	a year	crt.sh
*.imrworldwide.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-28` - `2022-02-01`	a year	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2021-05-20` - `2022-06-03`	a year	crt.sh
*.apis.google.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2020-12-01` - `2021-12-30`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
accounts.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2020-10-29` - `2021-11-29`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 Secure Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
www.i.matheranalytics.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-28` - `2022-01-27`	2 years	crt.sh
*.everesttech.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-18` - `2022-01-18`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.qualtrics.com DigiCert SHA2 Secure Server CA	`2020-10-26` - `2021-11-26`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
*.search.spotxchange.com GeoTrust RSA CA 2018	`2021-04-08` - `2022-05-09`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Frame ID: 4B7CD474AF14615830BDF6922F831452
Requests: 92 HTTP requests in this frame

Frame: https://news.google.com/swg/_/ui/v1/serviceiframe?_=450784
Frame ID: 1C39FFF9AF91F067A6116D7BB1337580
Requests: 14 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: 339F245274041BEF2677D142D4BFD85C
Requests: 3 HTTP requests in this frame

Frame: https://mcclatchy.demdex.net/dest5.html?d_nsid=0
Frame ID: 31F75B0952B4547AE874F709804D5C47
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 527352D35D74847F78DCDEA3B227FC7C
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0855423EDDF142D0E6F40682C94C25B3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.newsobserver.com/news/state/north-carolina/article250722934.html?ac_cid=DM463957&ac_bid=65830... HTTP 301
https://www.newsobserver.com/news/state/north-carolina/article250722934.html?ac_cid=DM463957&ac_bid=65830... HTTP 302
https://account.newsobserver.com/paywall/subscriber-only?resume=250722934 Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

script /\/recaptcha\/api\.js/i

Page Statistics

124
Requests

100 %
HTTPS

53 %
IPv6

29
Domains

50
Subdomains

47
IPs

7
Countries

1516 kB
Transfer

4006 kB
Size

37
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.newsobserver.com/
Title:

Search URL Search Domain Scan URL

URL: http://www.newsobserver.com/customer-service/contact-us/
Title: CONTACT US

Search URL Search Domain Scan URL

URL: https://www.newsobserver.com/customer-service/terms-of-service/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.newsobserver.com/customer-service/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.newsobserver.com/news/state/north-carolina/article250722934.html?ac_cid=DM463957&ac_bid=658303512 HTTP 301
https://www.newsobserver.com/news/state/north-carolina/article250722934.html?ac_cid=DM463957&ac_bid=658303512 HTTP 302
https://account.newsobserver.com/paywall/subscriber-only?resume=250722934 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 59

https://js.matheranalytics.com/s/ma12095/74930332/sp.js?cb=1565 HTTP 301
https://js.matheranalytics.com/static/2_2_18-e/sp.br.js

Request Chain 61

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-203838h&cg=0&cc=1&si=https%3A//account.newsobserver.com/paywall/subscriber-only%3Fresume%3D250722934&rp=&ts=compact&rnd=1622824622720 HTTP 302
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-203838h&cg=0&cc=1&si=https%3A//account.newsobserver.com/paywall/subscriber-only%3Fresume%3D250722934&rp=&ts=compact&rnd=1622824622720&ja=1

Request Chain 86

https://cm.everesttech.net/cm/dd?d_uuid=89778188813763385642942000649698852743 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YLpWrwAAAJccaBHl

Request Chain 100

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=ODk3NzgxODg4MTM3NjMzODU2NDI5NDIwMDA2NDk2OTg4NTI3NDM= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEM71tpfcblMe-CL-FdsxlwY&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 103

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUxwV3J3QUFBSmNjYUJIbA==

Request Chain 105

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YLpWrwAAAJccaBHl&expires=90

Request Chain 108

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YLpWrwAAAJccaBHl HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YLpWrwAAAJccaBHl&C=1

Request Chain 109

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=YLpWrwAAAJccaBHl HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYLpWrwAAAJccaBHl

Request Chain 114

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YLpWrwAAAJccaBHl HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YLpWrwAAAJccaBHl

Request Chain 118

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YLpWrwAAAJccaBHl

Request Chain 120

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YLpWrwAAAJccaBHl&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YLpWrwAAAJccaBHl&img=1&__user_check__=1&sync_id=180b956b-c553-11eb-aa54-1f6fc1870206

Request Chain 122

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0&_test=YLpWsAABitmmcQA4 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YLpWsAABitmmcQA4&t=2592000&o=0&_test=YLpWsAABitmmcQA4

124 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request subscriber-only Show response
account.newsobserver.com/paywall/
Redirect Chain

http://www.newsobserver.com/news/state/north-carolina/article250722934.html?ac_cid=DM463957&ac_bid=658303512
https://www.newsobserver.com/news/state/north-carolina/article250722934.html?ac_cid=DM463957&ac_bid=658303512
https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

11 KB
5 KB

1074ms
810ms

Document
text/html

2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

/ Express

Resource Hash

61c8e530fa5c9e7bee977f6a378441d7a0780d18610ea15b591922f28e5991b1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors "none"
X-Frame-Options	Deny DENY

Request headers

:method: GET
:authority: account.newsobserver.com
:scheme: https
:path: /paywall/subscriber-only?resume=250722934
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-powered-by: Express
x-frame-options: Deny DENY
content-security-policy: frame-ancestors "none"
x-env: prod
cache-control: public, max-age=900, unique
expires: Fri, 04 Jun 2021 16:52:00 GMT
content-type: text/html; charset=utf-8
etag: W/"2bf3-lLRiVwSCRKLwOKm+d3vCD7DGjTI"
vary: Accept-Encoding
content-encoding: gzip
date: Fri, 04 Jun 2021 16:37:01 GMT
content-length: 4298
set-cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=; Domain=.newsobserver.com; Path=/; Expires=Fri, 04 Jun 2021 18:37:00 GMT; Max-Age=7199; HttpOnly

Redirect headers

server: MI
content-length: 154
content-type: text/html
location: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
x-proxy-forwarding-type: WhiteList
x-meter: d
access-control-allow-origin: *
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-headers: *
access-control-allow-credentials: false
access-control-max-age: 86400
vary: Accept-Encoding
mi-cache: HIT
mi-cache-age: 9404
x-mi-in-market: 0
etag: W/"32220-cBwg563M3BVW0Sd+Q1/hrsKEQ+U"
x-varnish: 285861680, 480529919 472645510
surrogate-control: varnish=ESI/2.1
mi-api: WPS
expires: Fri, 04 Jun 2021 16:36:59 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Fri, 04 Jun 2021 16:36:59 GMT

GET
H2 200 stg-design-c281980747.css
account.newsobserver.com/static/assets/css/ 217 KB
41 KB 14ms
11ms Stylesheet
text/css 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

6573f2d6e1e3d14006b2f72b533971b289a37e13232f16a72311037b233b63ad

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/css/stg-design-c281980747.css
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 65961
content-length: 41792
last-modified: Mon, 17 May 2021 06:29:09 GMT
server: MI
x-frame-options: DENY
etag: W/"3622b-17979039708"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 312560609 289338193
cache-control: max-age=42746
mi-cache: HIT
content-type: text/css; charset=UTF-8
expires: Sat, 05 Jun 2021 04:29:27 GMT

GET
H2 200 analytics-777670d026.js Show response
account.newsobserver.com/static/assets/js/ 529 B
634 B 22ms
18ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/analytics-777670d026.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

2871f8ff317c9b5830a535184ecbb57bcd137ceb7bd32dadd5025dda1c80a183

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/analytics-777670d026.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 65961
content-length: 323
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"211-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 317787002 305987772
cache-control: max-age=42823
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Sat, 05 Jun 2021 04:30:44 GMT

GET
H2 200 jquery-23c7c5d2d1.js Show response
account.newsobserver.com/static/assets/js/ 281 KB
83 KB 28ms
23ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/jquery-23c7c5d2d1.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/jquery-23c7c5d2d1.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 14253
content-length: 84805
last-modified: Mon, 17 May 2021 06:27:50 GMT
server: MI
x-frame-options: DENY
etag: W/"4638e-17979026270"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 305018702 294411064
cache-control: max-age=76972
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Sat, 05 Jun 2021 13:59:53 GMT

GET
H2 200 validator-934d49f204.js Show response
account.newsobserver.com/static/assets/js/ 12 KB
4 KB 36ms
33ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/validator-934d49f204.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

57c2067a66279e69365cd496d2717008640c7427d5ca8486a0d34bcc5c92cce9

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/validator-934d49f204.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 514
content-length: 3297
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"2fe3-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 303995388 298644575
cache-control: max-age=57776
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Sat, 05 Jun 2021 08:39:57 GMT

GET
H2 200 head-bundle-919c7ffbe5.js Show response
account.newsobserver.com/static/assets/js/ 5 KB
2 KB 42ms
38ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/head-bundle-919c7ffbe5.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

66271bc6e78723553964eac5949df54510199fb20b1a920c7e61533aa67ef827

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/head-bundle-919c7ffbe5.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 835
content-length: 1679
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"1397-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 299124009 299035196
cache-control: max-age=45165
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Sat, 05 Jun 2021 05:09:46 GMT

GET
H2 200 platform-1342a70133.js Show response
account.newsobserver.com/static/assets/js/ 50 KB
19 KB 47ms
44ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/platform-1342a70133.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

deff6a17f2ce135a5c9991244bc06fdf0bddfea6d337689179355837afab12c1

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/platform-1342a70133.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 14253
content-length: 18646
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"c7de-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 305121508 299221594
cache-control: max-age=83402
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Sat, 05 Jun 2021 15:47:03 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 914 B
672 B 32ms
31ms Script
text/javascript 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=loadedCaptchaCallback

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1f07061f029748690554a225b9de76e1fc18f8c7f52d0cc41631d058601b89c3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 580
x-xss-protection: 1; mode=block
expires: Fri, 04 Jun 2021 16:37:01 GMT

GET
H2 200 facebook-sdk-35ff6ad1b6.js Show response
account.newsobserver.com/static/assets/js/ 3 KB
2 KB 25ms
24ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/facebook-sdk-35ff6ad1b6.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

c612e7d769d7c249e81fc1446381bf8bd04d92a5e6961e890688482b4d89c7db

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/facebook-sdk-35ff6ad1b6.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 13933
content-length: 1816
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"da3-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 284356518 305006808
cache-control: max-age=9060
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Fri, 04 Jun 2021 19:08:01 GMT

GET
H2 200 swg.js Show response
news.google.com/swg/js/v1/ 148 KB
44 KB 39ms
6ms Script
text/javascript 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0974f50c07dbd7908fe477b26448ea1716d311a64b05ffa0d7e05cb8c133acb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:36:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45037
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 18:24:41 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 04 Jun 2021 17:26:49 GMT

GET
H2 200 google-propensity-12c3e2a430.js Show response
account.newsobserver.com/static/assets/js/ 3 KB
1 KB 54ms
52ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/google-propensity-12c3e2a430.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

ecfaa9137dd69908b593ee768005343e47f4b4ad10c51e13ef322384a1cd4ce3

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/google-propensity-12c3e2a430.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 80804
content-length: 1100
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"d1a-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 312570412 301711133
cache-control: max-age=43987
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Sat, 05 Jun 2021 04:50:08 GMT

GET
H2 200 swg-38bbebee7e.js Show response
account.newsobserver.com/static/assets/js/ 6 KB
2 KB 63ms
61ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/swg-38bbebee7e.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

b4b54ba1689cf2d4a3f9f0b141b3e0892563cc7a001d1e22362ca273f8921eda

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/swg-38bbebee7e.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 11591
content-length: 2033
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"16ff-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 305769374 284524066
cache-control: max-age=9129
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Fri, 04 Jun 2021 19:09:10 GMT

GET
H2 200 logo-781f038d56.svg
account.newsobserver.com/static/assets/images/newsobserver/ 5 KB
2 KB 45ms
44ms Image
image/svg+xml 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://account.newsobserver.com/static/assets/images/newsobserver/logo-781f038d56.svg

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

33305bb743a697eed834495cd935e402fa483cb7615610e6efbae3dedf8d37ec

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/images/newsobserver/logo-781f038d56.svg
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 524857
content-length: 2223
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-frame-options: DENY
etag: W/"147a-17979016488"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 280293726 156108670
cache-control: max-age=187827
mi-cache: HIT
content-type: image/svg+xml
expires: Sun, 06 Jun 2021 20:47:28 GMT

GET
H2 200 news-observer-digital.png
media.mcclatchy.com/creatives/device-images/digital/ 82 KB
82 KB 62ms
53ms Image
image/png 104.111.219.128
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.mcclatchy.com/creatives/device-images/digital/news-observer-digital.png
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.111.219.128 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-219-128.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: dd97d6591cf527d6d5cbfeb40d10bc1baed508fd1326b4cc2d278c90acab18a2

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
last-modified: Tue, 14 May 2019 13:45:15 GMT
server: Apache
accept-ranges: bytes
etag: "14898-588d93e27111e"
content-length: 84120
content-type: image/png

GET
H/1.1 200
OK newsobserver.js Show response
media.mcclatchyinteractive.com/misites/nao/ 2 KB
1 KB 1097ms
165ms Script
text/javascript 166.108.32.249
MCCLATCHY-CORP

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 166.108.32.249 , United States, ASN6118 (MCCLATCHY-CORP, US),
Reverse DNS: vnet623.ejoco.com
Software: Apache /
Resource Hash: 18f9e6b96e326a7aa705c687fc8893c6b2df53acce477aefe2d0239d7b82fcb5

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Sun, 29 Apr 2018 21:38:27 GMT
Server: Apache
ETag: "9f8-56b038eb73ac0"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=60
Accept-Ranges: bytes
Content-Length: 1085

GET
H/1.1 200
OK mpp_s_code.js Show response
media.mcclatchyinteractive.com/mistats/vendors/ 95 KB
32 KB 1099ms
173ms Script
text/javascript 166.108.32.249
MCCLATCHY-CORP

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 166.108.32.249 , United States, ASN6118 (MCCLATCHY-CORP, US),
Reverse DNS: vnet623.ejoco.com
Software: Apache /
Resource Hash: 5020ee1e0ecf719b05b2d80a85aeda58dc7cedba42a90a0ead5eb90618cb0537

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Wed, 07 Apr 2021 13:07:54 GMT
Server: Apache
ETag: "17c28-5bf619e69a746"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=60
Accept-Ranges: bytes
Content-Length: 32766

GET
H/1.1 200
OK mpp.js Show response
media.mcclatchyinteractive.com/mistats/vendors/ 80 KB
16 KB 1099ms
171ms Script
text/javascript 166.108.32.249
MCCLATCHY-CORP

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 166.108.32.249 , United States, ASN6118 (MCCLATCHY-CORP, US),
Reverse DNS: vnet623.ejoco.com
Software: Apache /
Resource Hash: a8cafd34ae6cb44de7ae4e5992833ffce874d232525b0e53d0dba95df9c681b7

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Fri, 04 Jun 2021 16:35:03 GMT
Server: Apache
ETag: "14034-5c3f3461583ea"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=60
Accept-Ranges: bytes
Content-Length: 15686

GET
H/1.1 200
OK finalizestats.js Show response
media.mcclatchyinteractive.com/mistats/ 63 KB
17 KB 1102ms
173ms Script
text/javascript 166.108.32.249
MCCLATCHY-CORP

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 166.108.32.249 , United States, ASN6118 (MCCLATCHY-CORP, US),
Reverse DNS: vnet623.ejoco.com
Software: Apache /
Resource Hash: e4407435be0c97132f9813181dc1c390d7404e133e4d9e9e2680a3f0e2dd1dde

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 May 2021 01:30:26 GMT
Server: Apache
ETag: "fc2e-5c2a4c5697705"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=60
Accept-Ranges: bytes
Content-Length: 17436

GET
H2 200 footer-bundle-73c0c5b919.js Show response
account.newsobserver.com/static/assets/js/ 120 KB
35 KB 13ms
12ms Script
application/javascript 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/js/footer-bundle-73c0c5b919.js

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

c5f3f9eb87e77668751a1eb38baa3c354d206324b5f79872a3eb3d0b00b6bf47

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

:path: /static/assets/js/footer-bundle-73c0c5b919.js
pragma: no-cache
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-powered-by: Express
mi-cache-age: 121
content-length: 35170
last-modified: Mon, 17 May 2021 06:27:24 GMT
server: MI
x-frame-options: DENY
etag: W/"1e176-1797901fce0"
x-robots-tag: noindex, nofollow
vary: Accept-Encoding
x-varnish: 301113284 299123759
cache-control: max-age=43987
mi-cache: HIT
content-type: application/javascript; charset=UTF-8
expires: Sat, 05 Jun 2021 04:50:08 GMT

GET
H/1.1 200
OK propensity-boot.92ed04aa6548551972ad.js Show response
static.mcclatchyinteractive.com/yozons/ 5 KB
2 KB 1110ms
802ms Script
text/javascript 2a02:26f0:6c00:2b0::31c6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.mcclatchyinteractive.com/yozons/propensity-boot.92ed04aa6548551972ad.js
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:2b0::31c6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: 9467ca48380058d5034ef3591aa81ebfaa3ca13cd2ec1e7ef66d3ccbc8101e99

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Jul 2018 14:34:44 GMT
Server: Apache
ETag: "15f8-571d3c798bb91"
Vary: Accept-Encoding
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2033

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abc71bd473626280c33470e02f94591791fd8723d5a2fa2f8d35746b89b08a86

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H2 200 mcclatchy-sans-semi-5d3948c273.woff
account.newsobserver.com/static/assets/fonts/mcclatchy/ 29 KB
29 KB 44ms
43ms Font
font/woff 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/fonts/mcclatchy/mcclatchy-sans-semi-5d3948c273.woff

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

21891543f19b0f6f617591cd5b4624a09f0d74d01b3e9836bca0af56ddea6973

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://account.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
:path: /static/assets/fonts/mcclatchy/mcclatchy-sans-semi-5d3948c273.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://account.newsobserver.com
Referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
etag: W/"7250-17979016488"
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-powered-by: Express
x-frame-options: DENY
content-type: font/woff
mi-cache-age: 418344
cache-control: max-age=98810
x-varnish: 382133748 299292744
mi-cache: HIT
x-robots-tag: noindex, nofollow
content-length: 29264
expires: Sat, 05 Jun 2021 20:03:51 GMT

GET
H2 200 mcclatchy-sans-regular-f0696dec4c.woff
account.newsobserver.com/static/assets/fonts/mcclatchy/ 29 KB
29 KB 59ms
58ms Font
font/woff 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/fonts/mcclatchy/mcclatchy-sans-regular-f0696dec4c.woff

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

7ddc1f3125c1c3c3e6cb0422f65eedddac57fc4716d5a88e4c947b0065a8ae95

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://account.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
:path: /static/assets/fonts/mcclatchy/mcclatchy-sans-regular-f0696dec4c.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://account.newsobserver.com
Referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
etag: W/"723c-17979016488"
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-powered-by: Express
x-frame-options: DENY
content-type: font/woff
mi-cache-age: 494260
cache-control: max-age=159113
x-varnish: 285873088 151096394
mi-cache: HIT
x-robots-tag: noindex, nofollow
content-length: 29244
expires: Sun, 06 Jun 2021 12:48:54 GMT

GET
H2 200 fa-solid-900-8e1ed89b6c.woff2
account.newsobserver.com/static/assets/webfonts/ 78 KB
79 KB 68ms
68ms Font
font/woff2 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/webfonts/fa-solid-900-8e1ed89b6c.woff2

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://account.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
:path: /static/assets/webfonts/fa-solid-900-8e1ed89b6c.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://account.newsobserver.com
Referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
etag: W/"139ac-17979029538"
last-modified: Mon, 17 May 2021 06:28:03 GMT
server: MI
x-powered-by: Express
x-frame-options: DENY
content-type: font/woff2
mi-cache-age: 419376
cache-control: max-age=98829
x-varnish: 381016061 307333745
mi-cache: HIT
x-robots-tag: noindex, nofollow
content-length: 80300
expires: Sat, 05 Jun 2021 20:04:10 GMT

GET
H2 200 mcclatchy-serif-semi-b299907885.woff
account.newsobserver.com/static/assets/fonts/mcclatchy/ 32 KB
32 KB 78ms
77ms Font
font/woff 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/fonts/mcclatchy/mcclatchy-serif-semi-b299907885.woff

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

088d5009d94670b11171689b4ae4cf76c0f200092de752a47a4b15c082f0d3c1

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://account.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
:path: /static/assets/fonts/mcclatchy/mcclatchy-serif-semi-b299907885.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://account.newsobserver.com
Referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
etag: W/"7e8c-17979016488"
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-powered-by: Express
x-frame-options: DENY
content-type: font/woff
mi-cache-age: 435624
cache-control: max-age=111314
x-varnish: 389677609 297587764
mi-cache: HIT
x-robots-tag: noindex, nofollow
content-length: 32396
expires: Sat, 05 Jun 2021 23:32:15 GMT

GET
H2 200 mcclatchy-serif-regular-e19cf51605.woff
account.newsobserver.com/static/assets/fonts/mcclatchy/ 31 KB
31 KB 86ms
85ms Font
font/woff 2a02:26f0:6c00::210:ba9a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://account.newsobserver.com/static/assets/fonts/mcclatchy/mcclatchy-serif-regular-e19cf51605.woff

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

MI / Express

Resource Hash

7d6ca4b910111700848845a724f4a8e0f842ab4684c1715b7a218ff162fe9e31

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

sec-fetch-mode: cors
origin: https://account.newsobserver.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ak_bmsc=539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=
:path: /static/assets/fonts/mcclatchy/mcclatchy-serif-regular-e19cf51605.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: account.newsobserver.com
referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://account.newsobserver.com
Referer: https://account.newsobserver.com/static/assets/css/stg-design-c281980747.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
etag: W/"7c84-17979016488"
last-modified: Mon, 17 May 2021 06:26:45 GMT
server: MI
x-powered-by: Express
x-frame-options: DENY
content-type: font/woff
mi-cache-age: 31621
cache-control: max-age=329841
x-varnish: 305549559 309563723
mi-cache: HIT
x-robots-tag: noindex, nofollow
content-length: 31876
expires: Tue, 08 Jun 2021 12:14:22 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 218 KB
65 KB 20ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=46e06208ab68cbc48d283c02da8bcd47&ua=modern_es6

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/static/assets/js/facebook-sdk-35ff6ad1b6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

18c2cb309f377f262ec95016ad2e975c99883ffd35e0407cf2badaa43d4f6517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://account.newsobserver.com
Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: XgXDGve1YgHOFCXsLYQgxw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 65770
x-fb-rlafr: 0
x-fb-debug: xbb8u431cr7i7vMyxlq6ilF2CcBsWahkhUSTJlAGWnEvnjr9P5pe/wBgtwJzdElwCdGPke8CWgYDkuiwY33x8w==
x-fb-trip-id: 917726464
x-fb-content-md5: 8178eefc93e5067084eac5958f0eef63
x-frame-options: DENY
date: Fri, 04 Jun 2021 16:37:01 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "05f6594ff270137ef7d430f9d3858957"
timing-allow-origin: *
expires: Thu, 02 Jun 2022 17:27:43 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/ 342 KB
133 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=loadedCaptchaCallback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33df66ca469e2de5ae4723c4944b20fd37d65daa2f095b6ec2ff0d70ed6c3d57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://account.newsobserver.com
Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:18:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1104
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136431
x-xss-protection: 0
last-modified: Tue, 25 May 2021 16:32:01 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 16:18:37 GMT

GET
H3-29 200 swg-button.css
news.google.com/swg/js/v1/ 21 KB
6 KB 35ms
8ms Stylesheet
text/css 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-button.css

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2972ab4e6f23916a402bb8b39984e6a1f80b9650c4889fabbf9b94e8cbe9184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:21:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
last-modified: Wed, 26 May 2021 22:02:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 04 Jun 2021 17:11:31 GMT

GET
H3-29 200 serviceiframe Show response
news.google.com/swg/_/ui/v1/ Frame 1C39 25 KB
8 KB 108ms
85ms Document
text/html 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/_/ui/v1/serviceiframe?_=450784

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2c417a757edfd69372f10a571e05e52ec55356e952095bbe0f6b92c16ad094eb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-+/Unklqu2oTn/Pxq8n7cIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/SubscribewithgoogleClientUi/cspreport;worker-src 'self' script-src 'nonce-+/Unklqu2oTn/Pxq8n7cIQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com;report-uri /_/SubscribewithgoogleClientUi/cspreport require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: news.google.com
:scheme: https
:path: /swg/_/ui/v1/serviceiframe?_=450784
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://account.newsobserver.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://account.newsobserver.com/

Response headers

content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-ua-compatible: IE=edge
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 04 Jun 2021 16:37:01 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
strict-transport-security: max-age=31536000
cross-origin-resource-policy: same-site
report-to: {"group":"SubscribewithgoogleClientUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/SubscribewithgoogleClientUi/external"}]}
content-security-policy: script-src 'report-sample' 'nonce-+/Unklqu2oTn/Pxq8n7cIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/SubscribewithgoogleClientUi/cspreport;worker-src 'self' script-src 'nonce-+/Unklqu2oTn/Pxq8n7cIQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com;report-uri /_/SubscribewithgoogleClientUi/cspreport require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
cross-origin-opener-policy-report-only: unsafe-none; report-to="SubscribewithgoogleClientUi"
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
set-cookie: NID=216=Xb5wlBxiI6Bfd9heiprXksKLCfji_N88mFLSs3Hf2IjYFmjDTX8lW1GyC0xWy-qo_PWHkTXD3HLUoTuNQ5sUwWpWwlrmwetK_RAK4gMHpdUZ3prNpn7Rt9diFncqyurGEiQEGITJU0l6s6IEX7rW5XDXIevUWNEFDjF3tvu4Irg; expires=Sat, 04-Dec-2021 16:37:01 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 loader.svg
news.google.com/swg/js/v1/ 0
1 KB 30ms
7ms Other
image/svg+xml 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/loader.svg

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:02:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 16 Mar 2020 18:14:05 GMT
server: sffe
age: 2047
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1049
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:52:54 GMT

GET
H2 204 data
pubads.g.doubleclick.net/subopt/ 0
0 342ms
192ms Fetch
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/subopt/data?events=newsobserver.com%3Apaywall&extrainfo=%7B%22is_active%22%3Afalse%7D&u_tz=240&v=1&cdm=account.newsobserver.com

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 04 Jun 2021 16:37:01 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: https://account.newsobserver.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 204 data
pubads.g.doubleclick.net/subopt/ 0
0 343ms
194ms Fetch
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/subopt/data?events=newsobserver.com%3Aoffers_shown&extrainfo=%7B%22is_active%22%3Afalse%7D&u_tz=240&v=1&cdm=account.newsobserver.com

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 04 Jun 2021 16:37:01 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: https://account.newsobserver.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 entitlements Show response
news.google.com/swg/_/api/v1/publication/newsobserver.com/ 2 B
58 B 169ms
154ms Fetch
application/json 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/_/api/v1/publication/newsobserver.com/entitlements

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: text/plain, application/json
Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt
strict-transport-security: max-age=31536000
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="SubscribewithgoogleClientHttp"
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://account.newsobserver.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 43ms
43ms Fetch
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=234351110366085&input_token&origin=1&redirect_uri=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&sdk=joey&wants_cookie_data=true

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=46e06208ab68cbc48d283c02da8bcd47&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: Jow/WFGAa1WXLjFYfjDN2u88Ldlw/IX7fhYG+NP9/wPL//WN5e0vdpW18VsIEGRfLmt8mT4wWyYiB3ndq61T6Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 04 Jun 2021 16:37:01 GMT
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://account.newsobserver.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 swg-button.css
news.google.com/swg/js/v1/ Frame 1C39 21 KB
6 KB 6ms
6ms Stylesheet
text/css 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/swg/js/v1/swg-button.css

Requested by

Host: news.google.com
URL: https://news.google.com/swg/_/ui/v1/serviceiframe?_=450784

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2972ab4e6f23916a402bb8b39984e6a1f80b9650c4889fabbf9b94e8cbe9184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:21:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/news-frontend
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
last-modified: Wed, 26 May 2021 22:02:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Fri, 04 Jun 2021 17:11:31 GMT

GET
H3-29 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/am=AkA/d=1/excm=_b,_tp,serviceiframeview/ed=1/dg=0/wt=2/rs=ABXTjI50d... Frame 1C39 148 KB
52 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/am=AkA/d=1/excm=_b,_tp,serviceiframeview/ed=1/dg=0/wt=2/rs=ABXTjI50djBlJZWJL35z39kyfyz-LefiWg/m=_b,_tp

Requested by

Host: news.google.com
URL: https://news.google.com/swg/_/ui/v1/serviceiframe?_=450784

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e29d2193d62bb2e5592995930724ac250010d215195e76c9c7ec5592e163c6ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 19:46:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75002
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53086
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 21:52:05 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Jun 2022 19:46:59 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v14/ Frame 1C39 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: news.google.com
URL: https://news.google.com/swg/_/ui/v1/serviceiframe?_=450784

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://news.google.com
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 22:05:01 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Apr 2019 23:42:59 GMT
server: sffe
age: 239520
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21464
x-xss-protection: 0
expires: Wed, 01 Jun 2022 22:05:01 GMT

GET
H3-29 200 m=byfTOb,lsjVmc,LEikZe Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L... Frame 1C39 36 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/am=AkA/d=1/excm=_b,_tp,serviceiframeview/ed=1/dg=0/wt=2/rs=ABXTjI50djBlJZWJL35z39kyfyz-LefiWg/m=_b,_tp

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a15a9e213368ab017cb7b81b8955f0f54932effc50a6a8a833aac91956757bea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 20:28:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72507
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13428
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 22:50:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Jun 2022 20:28:34 GMT

GET
H3-29 200 m=xUdipf,blwjVc,fKUV3e,aurFic,ws9Tlc,COQbmf,U0aPgd,zG9H6c,NwH0H,OmgaI,NpD4ec,x60fie,gychg,lfpdyf,ZfAoz,PQaYAf,lPKSwe,yDVVkb,iTsyac,KG2eXe,tfTN8c,DfBslb Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L... Frame 1C39 96 KB
32 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L.B1.O/am=AkA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,serviceiframeview/ed=1/wt=2/rs=ABXTjI5nPgcCIl6AhCmmVNBBzcv81_M_vQ/m=xUdipf,blwjVc,fKUV3e,aurFic,ws9Tlc,COQbmf,U0aPgd,zG9H6c,NwH0H,OmgaI,NpD4ec,x60fie,gychg,lfpdyf,ZfAoz,PQaYAf,lPKSwe,yDVVkb,iTsyac,KG2eXe,tfTN8c,DfBslb

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e733de4dcd0e770c31c49d62a6ec6ddc47c0a4db917f557179696afb0247478

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 20:28:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72507
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33231
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 22:50:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Jun 2022 20:28:34 GMT

GET
H2 200 pts Show response
pubads.g.doubleclick.net/subopt/ 149 B
368 B 176ms
176ms Fetch
application/json 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/subopt/pts?products=newsobserver.com&type=general&ref=&u_tz=240&v=1&cdm=account.newsobserver.com

Requested by

Host: news.google.com
URL: https://news.google.com/swg/js/v1/swg.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

b3ad2bf6a180fdb5f07d5e588f0d488d40c804e363c25ffec8b70e8926a6df99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124
x-xss-protection: 0
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://account.newsobserver.com
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 04 Jun 2021 16:37:01 GMT

POST
H3-29 200 batchexecute Show response
news.google.com/_/SubscribewithgoogleClientUi/data/ Frame 1C39 262 B
232 B 153ms
153ms XHR
application/json 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://news.google.com/_/SubscribewithgoogleClientUi/data/batchexecute?rpcids=SlvRf&f.sid=-5363060700176088526&bl=boq_subscribewithgoogleclientserver_20210602.12_p0&hl=en-US&soc-app=673&soc-platform=1&soc-device=1&_reqid=67022&rt=c

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a5673bf235995988113079a77fa870f741ad3e4f0c2da56d3c7cb3ff20350a5b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Same-Domain: 1
Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
content-disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: require-trusted-types-for 'script';report-uri /_/SubscribewithgoogleClientUi/cspreport
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="SubscribewithgoogleClientUi"
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 m=Wt6vjf,_latency,FCpbqb,WhJNk,EFQ78c,hKSk3e Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L... Frame 1C39 46 KB
17 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L.B1.O/am=AkA/d=1/exm=COQbmf,DfBslb,KG2eXe,LEikZe,NpD4ec,NwH0H,OmgaI,PQaYAf,U0aPgd,ZfAoz,_b,_tp,aurFic,blwjVc,byfTOb,fKUV3e,gychg,iTsyac,lPKSwe,lfpdyf,lsjVmc,tfTN8c,ws9Tlc,x60fie,xUdipf,yDVVkb,zG9H6c/excm=_b,_tp,serviceiframeview/ed=1/wt=2/rs=ABXTjI5nPgcCIl6AhCmmVNBBzcv81_M_vQ/m=Wt6vjf,_latency,FCpbqb,WhJNk,EFQ78c,hKSk3e

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0b69cadedb516d1f6fe40f5c8a6259e1a8d3e6ce43283f5b86bcbca86d30f33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 20:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72816
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17679
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 22:50:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Jun 2022 20:23:25 GMT

GET
H3-29 200 m=lwddkf Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L... Frame 1C39 236 B
184 B 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L.B1.O/am=AkA/d=1/exm=COQbmf,DfBslb,EFQ78c,FCpbqb,KG2eXe,LEikZe,NpD4ec,NwH0H,OmgaI,PQaYAf,U0aPgd,WhJNk,Wt6vjf,ZfAoz,_b,_latency,_tp,aurFic,blwjVc,byfTOb,fKUV3e,gychg,hKSk3e,iTsyac,lPKSwe,lfpdyf,lsjVmc,tfTN8c,ws9Tlc,x60fie,xUdipf,yDVVkb,zG9H6c/excm=_b,_tp,serviceiframeview/ed=1/wt=2/rs=ABXTjI5nPgcCIl6AhCmmVNBBzcv81_M_vQ/m=lwddkf

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

685ee1f5e122fdc218b11e4589efbbfc2c567087e94b65062b13c290aae43a6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 20:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72816
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 160
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 22:50:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Jun 2022 20:23:25 GMT

GET
H3-29 200 m=n73qwf,mI3LFb,UUJqVe,lazG7b,MpJwZc,qCSYWe,mdR7q,MI6k7c,kjKdXe Show response
www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L... Frame 1C39 796 B
468 B 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-subscribewithgoogle/_/js/k=boq-subscribewithgoogle.SubscribewithgoogleClientUi.en_US.Fq71MDrego8.es5.O/ck=boq-subscribewithgoogle.SubscribewithgoogleClientUi.iTvsICO45Pc.L.B1.O/am=AkA/d=1/exm=COQbmf,DfBslb,EFQ78c,FCpbqb,KG2eXe,LEikZe,NpD4ec,NwH0H,OmgaI,PQaYAf,U0aPgd,WhJNk,Wt6vjf,ZfAoz,_b,_latency,_tp,aurFic,blwjVc,byfTOb,fKUV3e,gychg,hKSk3e,iTsyac,lPKSwe,lfpdyf,lsjVmc,lwddkf,tfTN8c,ws9Tlc,x60fie,xUdipf,yDVVkb,zG9H6c/excm=_b,_tp,serviceiframeview/ed=1/wt=2/rs=ABXTjI5nPgcCIl6AhCmmVNBBzcv81_M_vQ/m=n73qwf,mI3LFb,UUJqVe,lazG7b,MpJwZc,qCSYWe,mdR7q,MI6k7c,kjKdXe

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

975d7d40cacf62333123be264facbc54c4191bccbd172c3588d7ffdb5c95cddb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 20:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72816
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/subscribewithgoogle-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 444
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 22:50:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Jun 2022 20:23:25 GMT

POST
H2 200 log Show response
play.google.com/ Frame 1C39 131 B
644 B 73ms
41ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:37:01 GMT

POST
H3-29 200 log Show response
play.google.com/ Frame 1C39 131 B
154 B 79ms
54ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:37:01 GMT

OPTIONS
H3-29 200 log
play.google.com/ Frame 0
0 64ms
38ms Preflight
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

H3-29

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://news.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://news.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Fri, 04 Jun 2021 16:37:01 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 04 Jun 2021 16:37:01 GMT
cache-control: private

POST
H3-29 200 log Show response
play.google.com/ Frame 1C39 131 B
154 B 67ms
41ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:37:01 GMT

OPTIONS
H3-29 200 log
play.google.com/ Frame 0
0 60ms
37ms Preflight
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

H3-29

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://news.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://news.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Fri, 04 Jun 2021 16:37:01 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 04 Jun 2021 16:37:01 GMT
cache-control: private

POST
H3-29 200 log Show response
play.google.com/ Frame 1C39 131 B
154 B 69ms
43ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://news.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 04 Jun 2021 16:37:01 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://news.google.com
cache-control: private
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:37:01 GMT

OPTIONS
H3-29 200 log
play.google.com/ Frame 0
0 58ms
37ms Preflight
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

H3-29

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://news.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://news.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Fri, 04 Jun 2021 16:37:01 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Fri, 04 Jun 2021 16:37:01 GMT
cache-control: private

GET
H/1.1 200
OK common.js Show response
media.mcclatchyinteractive.com/misites/all/ 4 KB
2 KB 166ms
165ms Script
text/javascript 166.108.32.249
MCCLATCHY-CORP

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/misites/all/common.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 166.108.32.249 , United States, ASN6118 (MCCLATCHY-CORP, US),
Reverse DNS: vnet623.ejoco.com
Software: Apache /
Resource Hash: ec2cc99b7d1be6fb64d9ce3622e5584e39002529d87a71ffad76435b800de309

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Sep 2019 13:27:05 GMT
Server: Apache
ETag: "ee5-59232dc43bc40"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=60
Accept-Ranges: bytes
Content-Length: 1412

GET
H/1.1 200
OK micb.js Show response
media.mcclatchyinteractive.com/mistats/ 136 KB
41 KB 321ms
179ms Script
text/javascript 166.108.32.249
MCCLATCHY-CORP

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/micb.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 166.108.32.249 , United States, ASN6118 (MCCLATCHY-CORP, US),
Reverse DNS: vnet623.ejoco.com
Software: Apache /
Resource Hash: 26534efa3506ce466e7b11c0e264ad1eb6b0183c5903a0e35360b0a9a4a2ffaf

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 May 2021 13:53:34 GMT
Server: Apache
ETag: "21ede-5c3a08d34dd1c"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=60
Accept-Ranges: bytes
Content-Length: 41589

GET
H3-29 200 pts Show response
pubads.g.doubleclick.net/subopt/ 149 B
150 B 282ms
197ms XHR
application/json 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/subopt/pts?products=newsobserver.com&type=general&extrainfo=null&u_tz=-120&v=1&cdm=account.newsobserver.com&c=864485

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

c491a839b930e0ac5934e629527f704e4edb17937b53c3eb3ed257bd49faf8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124
x-xss-protection: 0
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://account.newsobserver.com
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 04 Jun 2021 16:37:02 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
2 KB 248ms
64ms XHR
application/json 3.250.252.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=3B6E35F15A82BBB00A495D91%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1622824622699

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.250.252.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-250-252-43.eu-west-1.compute.amazonaws.com

Software

Resource Hash

1f31539fc32ad70a31457aec32e4df5c7b237a97476cc8ff20fce3d6d410d446

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v008-044181861.edge-irl1.demdex.com 6.3.0.20210527085910-PR_1432-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: KIh34ZPRTN0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://account.newsobserver.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 997
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK at_2.3.js Show response
media.mcclatchyinteractive.com/mistats/ 91 KB
31 KB 176ms
176ms Script
text/javascript 166.108.32.249
MCCLATCHY-CORP

General

Check archive.org

Show headers Download Go to

Full URL: https://media.mcclatchyinteractive.com/mistats/at_2.3.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 166.108.32.249 , United States, ASN6118 (MCCLATCHY-CORP, US),
Reverse DNS: vnet623.ejoco.com
Software: Apache /
Resource Hash: b8a2fbd39f5894181c5d653f15572a9bc48297d6b5fe7826d28f2c485a229001

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:02 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Oct 2020 14:36:12 GMT
Server: Apache
ETag: "16cfb-5b09cf0080f00"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=60
Accept-Ranges: bytes
Content-Length: 30988

GET
H3-29 200 fbevents.js Show response
connect.facebook.net/en_US/ 92 KB
24 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3ba5369627fc324f2d2c47f44c8da30769d2a3ccbe8110b9bd5eec9585e42a09

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 24155
x-fb-rlafr: 0
pragma: public
x-fb-debug: Lpx5GuEXP4cW2KVrGfKaPkebir9OOs+7+Wr3LIX5DfaoZvfrFpOZMHx7Yt5YQpr7JMfBxxdxrxvcGwZSrjStBg==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 04 Jun 2021 16:37:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 86 KB
34 KB 24ms
24ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848620132

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7ede11749fa9e39bb8b2e3d62d63c539376a1740354664b2beb4ff7a5b9fd4c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34566
x-xss-protection: 0
last-modified: Fri, 04 Jun 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 04 Jun 2021 16:37:02 GMT

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 13 KB
5 KB 490ms
121ms Script
text/javascript 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: a203f038afc58ab20a149d5d9076ff078c648fcbeccf3af675fdc899e3f29d9c

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 04 Jun 2021 16:37:03 GMT
Content-Encoding: gzip
Cache-Control: max-age=30
Content-Length: 4432
Connection: keep-alive
Content-Type: text/javascript

GET
H2

200

sp.br.js Show response
js.matheranalytics.com/static/2_2_18-e/
Redirect Chain

https://js.matheranalytics.com/s/ma12095/74930332/sp.js?cb=1565
https://js.matheranalytics.com/static/2_2_18-e/sp.br.js

78 KB
25 KB

55ms
55ms

Script
application/x-javascript

107.178.250.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_18-e/sp.br.js
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: f2f93fd85c2f5e6c07c80c6487a804ec6bede5bed8fe755280d87d4dfde986d0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 01:07:31 GMT
content-encoding: br
last-modified: Sat, 20 Apr 2019 20:43:13 GMT
server: nginx
age: 55771
etag: "93626701087aa6ff39ccd5278fb9fd3b"
vary: Accept-Encoding
x-cache: HIT Sat, 20 Apr 2019 22:39:14 GMT
content-type: application/x-javascript
via: 1.1 google
cache-control: public,max-age=3600
alt-svc: clear
content-length: 25418

Redirect headers

date: Fri, 04 Jun 2021 16:37:02 GMT
via: 1.1 google
server: nginx
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_18-e/sp.br.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 0-gc-euw1-10926

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 5139
date: Fri, 04 Jun 2021 15:11:23 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Fri, 04 Jun 2021 17:11:23 GMT

GET
H2

200

m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-203838h&cg=0&cc=1&si=https%3A//account.newsobserver.com/paywall/subscriber-only%3Fresume%3D250722934&rp=&ts=compact&rnd=1622824622720
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-203838h&cg=0&cc=1&si=https%3A//account.newsobserver.com/paywall/subscriber-only%3Fresume%3D250722934&rp=&ts=compact&rnd=1622824622720&ja=1

44 B
336 B

63ms
62ms

Image
image/gif

18.202.103.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-203838h&cg=0&cc=1&si=https%3A//account.newsobserver.com/paywall/subscriber-only%3Fresume%3D250722934&rp=&ts=compact&rnd=1622824622720&ja=1
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.103.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-103-217.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
server: nginx
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
server: nginx
location: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-203838h&cg=0&cc=1&si=https%3A//account.newsobserver.com/paywall/subscriber-only%3Fresume%3D250722934&rp=&ts=compact&rnd=1622824622720&ja=1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 36 KB
14 KB 27ms
26ms Script
application/x-javascript 2600:9000:218f:5e00:18:1fcd:34f:cdc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/misites/nao/newsobserver.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218f:5e00:18:1fcd:34f:cdc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ec93813683cccb74a7896a34a2ed1b2163288620f6959ae06de3ded30cf518b9

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 15:21:11 GMT
content-encoding: gzip
last-modified: Fri, 02 Apr 2021 00:04:46 GMT
server: nginx
age: 4551
etag: W/"60665f9e-8e96"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 3345a8f17bb96a1199a195b00a8d2c0f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: CDG52-P2
x-amz-cf-id: FIDuPs0b7u0GhhsUSDLPqkSgAMmZUcKP6KbisDZgnnQkGhNxyMAqqw==
expires: Sat, 05 Jun 2021 15:21:11 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 62 KB
21 KB 61ms
28ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: static.mcclatchyinteractive.com
URL: https://static.mcclatchyinteractive.com/yozons/propensity-boot.92ed04aa6548551972ad.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a19ad93b8c725e7f19dcc851248a683bffb63243553bb91f6fafd3bc41302a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "892 / 801 of 1000 / last-modified: 1622804990"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21347
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:37:02 GMT

GET
H3-29 200 activity;xsp=4385053;ord=1622824622770;
pubads.g.doubleclick.net/ 42 B
65 B 188ms
101ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;xsp=4385053;ord=1622824622770;?

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.ebk8EhJxLu4.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCP6GuLd1aTsaaFO6Zp_Rjnyu1Wv5g/ 104 KB
35 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.ebk8EhJxLu4.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCP6GuLd1aTsaaFO6Zp_Rjnyu1Wv5g/cb=gapi.loaded_0

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/static/assets/js/platform-1342a70133.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

646fda8e6ce619a137e093efd2c4f58ceaa00b594d0947ddc0db8c7b96d1e61e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 02 Jun 2021 01:15:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 07 Apr 2020 19:43:27 GMT
server: sffe
age: 228111
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35655
x-xss-protection: 0
expires: Thu, 02 Jun 2022 01:15:11 GMT

GET
H3-29 200 1081709588515684 Show response
connect.facebook.net/signals/config/ 255 KB
73 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1081709588515684?v=2.9.40&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2f3dd644bc769af8580e4cb9caa379103b9ae7d73517274788f4702fe9629f8f

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/;
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 74633
x-xss-protection: 0
pragma: public
x-fb-debug: ny9Xnp6bKMTva2dvfxd7/D54mhFTTYn0RAhHVlrRiWRym5XlRwCzpX+wcxrfoU10hYsm/iuViusYzTsbttjNdw==
x-frame-options: DENY
date: Fri, 04 Jun 2021 16:37:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 26ms
26ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=850212879&t=event&_s=1&dl=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&dh=account.newsobserver.com&ul=en-us&de=UTF-8&dt=MPP%3A%20Paywall%20Stop&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Prompt&ea=Paywall&el=News%20and%20Observer%20-%20Paywall&_u=YFDAAAABCAAAAC~&jid=216151657&gjid=1787371177&cid=836243575.1622824623&tid=UA-48279682-1&_gid=83576942.1622824623&_r=1&_slc=1&cd1=NAO&cd2=News%20and%20Observer&cd3=Other&cd4=Online%7CRegistration%7C%7C%7C&cd5=Unregistered&cd6=MPP&cd8=News%20and%20Observer%20%3A%20MPP&cd15=%3Fresume%3D250722934&cg1=News%20and%20Observer&cg2=MPP&z=155882829

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://account.newsobserver.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 26ms
26ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=850212879&t=event&_s=1&dl=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&dh=account.newsobserver.com&ul=en-us&de=UTF-8&dt=MPP%3A%20Paywall%20Stop&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Prompt&ea=Paywall&el=News%20and%20Observer%20-%20Paywall&_u=YFDAAAABCAAAAC~&jid=1070365526&gjid=1759017594&cid=836243575.1622824623&tid=UA-48280268-1&_gid=83576942.1622824623&_r=1&_slc=1&cd1=NAO&cd2=News%20and%20Observer&cd3=Other&cd4=Online%7CRegistration%7C%7C%7C&cd5=Unregistered&cd6=MPP&cd8=News%20and%20Observer%20%3A%20MPP&cd15=%3Fresume%3D250722934&cg1=News%20and%20Observer&cg2=MPP&z=799706618

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://account.newsobserver.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j90&a=850212879&t=pageview&_s=2&dl=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&dh=account.newsobserver.com&ul=en-us&de=UTF-8&dt=MPP%3A%20Paywall%20Stop&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Prompt&ea=Paywall&el=News%20and%20Observer%20-%20Paywall&_u=YFDAAAABCAAAAC~&jid=&gjid=&cid=836243575.1622824623&tid=UA-48279682-1&_gid=83576942.1622824623&cd1=NAO&cd2=News%20and%20Observer&cd3=Other&cd4=Online%7CRegistration%7C%7C%7C&cd5=Unregistered&cd6=MPP&cd8=News%20and%20Observer%20%3A%20MPP&cd15=%3Fresume%3D250722934&cg1=News%20and%20Observer&cg2=MPP&z=454160350

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Jun 2021 21:39:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68279
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j90&a=850212879&t=pageview&_s=2&dl=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&dh=account.newsobserver.com&ul=en-us&de=UTF-8&dt=MPP%3A%20Paywall%20Stop&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Prompt&ea=Paywall&el=News%20and%20Observer%20-%20Paywall&_u=YFDAAAABCAAAAC~&jid=&gjid=&cid=836243575.1622824623&tid=UA-48280268-1&_gid=83576942.1622824623&cd1=NAO&cd2=News%20and%20Observer&cd3=Other&cd4=Online%7CRegistration%7C%7C%7C&cd5=Unregistered&cd6=MPP&cd8=News%20and%20Observer%20%3A%20MPP&cd15=%3Fresume%3D250722934&cg1=News%20and%20Observer&cg2=MPP&z=2022814664

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Jun 2021 21:39:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68279
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
169 B 360ms
120ms Image
image/gif 34.238.206.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=newsobserver.com&p=%2Fpaywall%2Fsubscriber-only&u=DX6xdBBjz-xTCCe5ul&d=account.newsobserver.com&g=62447&g0=MPP&g1=News%20and%20Observer%20%3A%20MPP&n=1&f=00001&c=0&x=0&m=0&y=1200&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=4065&t=DtlM-aBV4qCSCu8DvACrbJ8_C6ypzU&V=126&i=News%20and%20Observer&tz=-120&sn=1&sv=DfaJfuBVVzUBbkW4VDqeBbQC3jDUv&sd=1&im=0603040e&_
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.238.206.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-238-206-177.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 subscriptions.js Show response
static.chartbeat.com/js/ 32 KB
10 KB 63ms
63ms Script
application/x-javascript 2600:9000:218f:5e00:18:1fcd:34f:cdc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/subscriptions.js
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218f:5e00:18:1fcd:34f:cdc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: bfee3aaae52a8e772c619f79150bb21d5e6ece8a846b966b3bd283a4a7f4ed6f

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 17:13:26 GMT
content-encoding: gzip
last-modified: Thu, 06 May 2021 23:57:21 GMT
server: nginx
age: 84216
etag: W/"60948261-7e73"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 3345a8f17bb96a1199a195b00a8d2c0f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: CDG52-P2
x-amz-cf-id: YjTO79_znpJMavmCcbkFtagKRrR5YY1rIuhdu5G38SAwQNmkicoltA==
expires: Fri, 04 Jun 2021 17:13:26 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
94 B 19ms
19ms XHR
text/plain 2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-48279682-1&cid=836243575.1622824623&jid=216151657&gjid=1787371177&_gid=83576942.1622824623&_u=YFDAAAAACAAAAC~&z=2119429935

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 04 Jun 2021 16:37:02 GMT
content-type: text/plain
access-control-allow-origin: https://account.newsobserver.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 95ms
94ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848620132

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

4da18cf3cfa4b3d576d9eda3450e2773c95ad8a660ec2998c7a7287f4191daf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13934
x-xss-protection: 0
server: cafe
etag: 6909554294999178257
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 04 Jun 2021 16:37:02 GMT

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame 339F 513 B
906 B 63ms
30ms Document
text/html 2a00:1450:4001:80e::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.ebk8EhJxLu4.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCP6GuLd1aTsaaFO6Zp_Rjnyu1Wv5g/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9d2abb3f0b32fc66768133157f17425639bab7a2088ab7946c205aae9f3be489

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-pbvtCuyOCMgvsOez6kH+2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://account.newsobserver.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=216=WC7bIS9wtidyne5tY5_Y33UPYGZILTBVhM0EIhxs5WnbnseZefoRpp59Qz4SuDgs5wDqc9xwQel2CiFXszZlP28gWnVZhuJA5uj7pZhiNTBHzJrkskIWWjvuSnmRWYdPU1MHnFsFA63JxlsDqXxrAu6VzrUQbzhYicr6blG7GLY
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://account.newsobserver.com/

Response headers

content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 04 Jun 2021 16:37:02 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-pbvtCuyOCMgvsOez6kH+2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1081709588515684&ev=PageView&dl=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&rl=&if=false&ts=1622824622871&sw=1600&sh=1200&v=2.9.40&r=stable&ec=0&o=30&fbp=fb.1.1622824622869.268246936&it=1622824622785&coo=false&exp=l1&rqm=GET

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 04 Jun 2021 16:37:02 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 8ms
7ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1081709588515684&ev=PaywallPageview&dl=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&rl=&if=false&ts=1622824622874&sw=1600&sh=1200&v=2.9.40&r=stable&ec=1&o=30&fbp=fb.1.1622824622869.268246936&it=1622824622785&coo=false&exp=l1&rqm=GET

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 04 Jun 2021 16:37:02 GMT

GET
H3-29 200 ga-audiences
www.google.com/ads/ 42 B
63 B 35ms
34ms Image
image/gif 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-48279682-1&cid=836243575.1622824623&jid=216151657&_u=YFDAAAAACAAAAC~&z=1790035964

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 33ms
33ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-48279682-1&cid=836243575.1622824623&jid=216151657&_u=YFDAAAAACAAAAC~&z=1790035964

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2021052601.js Show response
securepubads.g.doubleclick.net/gpt/ 311 KB
109 KB 88ms
86ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052601.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

sffe /

Resource Hash

bf56d0c6b86f69d3f6dfb156399577c16da981c390a16d26c7752ed85bc38ac4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 26 May 2021 08:37:30 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 111649
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:37:02 GMT

GET
H2 200 conversion_event
ping.chartbeat.net/ping/ 43 B
0 360ms
119ms Fetch
image/gif 34.238.206.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ping.chartbeat.net/ping/conversion_event?p=newsobserver.com%2Farticle250722934.html&cel=undefined&cev=undefined&cec=paywall&cet=shown&h=newsobserver.com&d=newsobserver.com&u=DX6xdBBjz-xTCCe5ul&sv=DfaJfuBVVzUBbkW4VDqeBbQC3jDUv&V=8
Requested by: Host: static.chartbeat.com
URL: https://static.chartbeat.com/js/subscriptions.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.238.206.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-238-206-177.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 3415758833-idpiframe.js Show response
ssl.gstatic.com/accounts/o/ Frame 339F 114 KB
39 KB 41ms
6ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/3415758833-idpiframe.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbd0e12b1246f6280d9cd402284261eb3e81a9b5c6e179ae5d1a20b7731a4fa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 14:44:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6758
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39736
x-xss-protection: 0
last-modified: Fri, 21 May 2021 04:38:18 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 14:44:24 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848620132/ 2 KB
1 KB 35ms
34ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848620132/?random=1622824622947&cv=9&fst=1622824622947&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa621&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&tiba=News%20and%20Observer&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3059f6734139cb1c1184b13ac4aefc2d597b854651739d0c36b446975d6de3eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1064
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dest5.html Show response
mcclatchy.demdex.net/ Frame 31F7 7 KB
3 KB 250ms
61ms Document
text/html 3.250.252.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://mcclatchy.demdex.net/dest5.html?d_nsid=0

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.250.252.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-250-252-43.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: mcclatchy.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://account.newsobserver.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=89778188813763385642942000649698852743
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://account.newsobserver.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Fri, 4 Jun 2021 16:37:03 GMT
DCS: dcs-prod-irl1-1-v008-04c3a71c2.edge-irl1.demdex.com 6.3.0.20210527085910-PR_1432-SNAPSHOT
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 27 May 2021 14:09:58 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: rrYR0JuWRCE=
transfer-encoding: chunked
Connection: keep-alive

GET
H2 200 id Show response
mcclatchy.sc.omtrdc.net/ 2 B
323 B 166ms
54ms XHR
application/x-javascript 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://mcclatchy.sc.omtrdc.net/id?d_visid_ver=5.2.0&d_fieldgroup=A&mcorgid=3B6E35F15A82BBB00A495D91%40AdobeOrg&mid=89557616945354970112885340044013946928&ts=1622824622955

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-796b78f698-l25pw
vary: Origin
x-c: main-1475.Ic74f9e.M0-497
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://account.newsobserver.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YLpWrwAAAJccaBHl
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=89778188813763385642942000649698852743
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YLpWrwAAAJccaBHl

42 B
973 B

66ms
65ms

Image
image/gif

3.250.252.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YLpWrwAAAJccaBHl

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.250.252.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-250-252-43.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v008-044181861.edge-irl1.demdex.com 6.3.0.20210527085910-PR_1432-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: xRvnW3y+RJo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YLpWrwAAAJccaBHl
Date: Fri, 04 Jun 2021 16:37:03 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
mcclatchy.tt.omtrdc.net/rest/v1/ 256 B
499 B 190ms
67ms XHR
application/json 34.252.166.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mcclatchy.tt.omtrdc.net/rest/v1/delivery?client=mcclatchy&sessionId=a2893b792bf943a09b8b49f9198f3e38&version=2.3.0
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/at_2.3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.166.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-166-160.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 3b5c86e2f30dc2271f6a80d66c16fc566befeed355ed45eb2c3e691a2c09a303

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://account.newsobserver.com
date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: gzip
access-control-allow-credentials: true
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
x-request-id: 8e618fc1999818223fa6f9f728877771
content-type: application/json;charset=UTF-8

POST
H2 200 delivery Show response
mcclatchy.tt.omtrdc.net/rest/v1/ 268 B
505 B 189ms
69ms XHR
application/json 34.252.166.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mcclatchy.tt.omtrdc.net/rest/v1/delivery?client=mcclatchy&sessionId=a2893b792bf943a09b8b49f9198f3e38&version=2.3.0
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/at_2.3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.166.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-166-160.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 63652bae3aca33ace44dbf6bd632c79ee36f1ce3dca985983cc04b6e70547948

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://account.newsobserver.com
date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: gzip
access-control-allow-credentials: true
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
x-request-id: 5f8e3d31aa0b61cf1fe3e6f373bb5584
content-type: application/json;charset=UTF-8

GET
H3-29 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame 339F 14 B
58 B 56ms
29ms XHR
application/json 2a00:1450:4001:80e::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Faccount.newsobserver.com&client_id=938840581902-cqe1u27dqfgvdum64bp58jl5h7l6ofsa.apps.googleusercontent.com

Requested by

Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/3415758833-idpiframe.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With: XmlHttpRequest

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Fri, 04 Jun 2021 17:37:03 GMT

GET
H3-29 200 /
www.google.com/pagead/1p-user-list/848620132/ 42 B
64 B 70ms
70ms Image
image/gif 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848620132/?random=1622824622947&cv=9&fst=1622822400000&num=1&bg=ffffff&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa621&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&tiba=News%20and%20Observer&async=1&fmt=3&is_vtc=1&random=2882628503&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.de/pagead/1p-user-list/848620132/ 42 B
64 B 33ms
33ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/848620132/?random=1622824622947&cv=9&fst=1622822400000&num=1&bg=ffffff&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa621&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&tiba=News%20and%20Observer&async=1&fmt=3&is_vtc=1&random=2882628503&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 484ms
120ms Image
image/gif 34.230.139.180
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&page=News%20and%20Observer&tv=js-2.2.18-e&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tid=ab917a72-5906-4b1d-b899-b0464a65d227&pid=4b6b6ae9-7019-41a4-8dc4-c251f088ef19&dtm=1622824623022&qnm=_matherq&vp=1600x1200&ds=1600x1200&tofa=1622824623&vid=1&duid=bc7a8c508385c7c9&fp=1072425006&cid=ma12095&mrk=74930332&cx=eyJhY3Rpb24iOnsidHlwZSI6InBheXdhbGwiLCJjYXRlZ29yeSI6ImJsb2NrIiwiYWN0aW9uIjoic3RvcCJ9fQ
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.139.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-139-180.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:03 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
799 B 61ms
28ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=account.newsobserver.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 61ms
27ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=account.newsobserver.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
1 KB 118ms
117ms XHR
text/plain 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1809539670553201&correlator=4411749491155317&output=ldjh&impl=fifs&eid=31061223%2C31060991%2C44743203&vrg=2021052601&ptt=17&sc=1&sfv=1-0-38&ecs=20210604&iu_parts=7675%2CRAL.site_newsobserver&enc_prev_ius=%2F0%2F1%2F&prev_iu_szs=1x1&cust_params=swgt%3Dna&cookie_enabled=1&bc=31&abxe=1&lmt=1622824623&dt=1622824623087&dlt=1622824621052&idt=2017&frm=20&biw=1600&bih=1200&oid=3&adxs=0&adys=808&adks=3223394774&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x829&msz=1600x0&ga_vid=836243575.1622824623&ga_sid=1622824623&ga_hid=850212879&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052601.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

071faf19302a3f065704e296da55906538e231207de050287a6d2c7b4dcca087

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1092
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://account.newsobserver.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
dc92b30916660fe84580e95e98422bdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 78ms
26ms Other
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dc92b30916660fe84580e95e98422bdb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052601.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 / Show response
lasteventf-tm.everesttech.net/ 0
213 B 141ms
45ms XHR
text/plain 151.101.114.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://lasteventf-tm.everesttech.net/?_les_imsOrgId=3B6E35F15A82BBB00A495D91@AdobeOrg&_les_sdid=061A6B48A2C5CB2B-6022C740AA6B178C&_les_last_search_click=&_les_rsid=mccltallmcclatchy&_les_mid=89557616945354970112885340044013946928&_les_url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934
Requested by: Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1622824623.300585,VS0,VE0
x-cache: MISS
content-type: text/plain
access-control-allow-origin: https://account.newsobserver.com
access-control-allow-credentials: true
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-hhn4057-HHN

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 83 B
310 B 121ms
120ms Stylesheet
text/css 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: dd0e535e0bc470abf4ffd5f6c88760d9f90db7957e84e20e0b7e81c01d8ee06b

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 04 Jun 2021 16:37:03 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 83
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 482ms
121ms Fetch
image/jpeg 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 04 Jun 2021 16:37:03 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEM71tpfcblMe-CL-FdsxlwY&google_cver=1
dpm.demdex.net/ Frame 31F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=ODk3NzgxODg4MTM3NjMzODU2NDI5NDIwMDA2NDk2OTg4NTI3NDM=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEM71tpfcblMe-CL-FdsxlwY&google_cver=1?gdpr=0&gdpr_consent=

42 B
973 B

65ms
65ms

Image
image/gif

3.250.252.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEM71tpfcblMe-CL-FdsxlwY&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.250.252.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-250-252-43.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v008-0897aa813.edge-irl1.demdex.com 6.3.0.20210527085910-PR_1432-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 7+dpjyiLQ6w=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEM71tpfcblMe-CL-FdsxlwY&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
2 KB 66ms
65ms XHR
application/json 3.250.252.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=3B6E35F15A82BBB00A495D91%40AdobeOrg&d_nsid=0&d_mid=89557616945354970112885340044013946928&d_coop_safe=1&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=mcid%0189557616945354970112885340044013946928&ts=1622824623290

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/micb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.250.252.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-250-252-43.eu-west-1.compute.amazonaws.com

Software

Resource Hash

eb3e37a7ff21210c2bd7a83d3cf172745b6b6237c50429023544133dec323448

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v008-0f7b348b3.edge-irl1.demdex.com 6.3.0.20210527085910-PR_1432-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: zcgqpUn7TQ0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://account.newsobserver.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 996
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 s19927985310139 Show response
mcclatchy.sc.omtrdc.net/b/ss/mccltallmcclatchy/10/JS-2.22.0/ 3 KB
3 KB 85ms
85ms Script
application/x-javascript 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://mcclatchy.sc.omtrdc.net/b/ss/mccltallmcclatchy/10/JS-2.22.0/s19927985310139?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=4%2F5%2F2021%2018%3A37%3A3%205%20-120&cid.&mcid.&id=89557616945354970112885340044013946928&.mcid&.cid&d.&nsid=0&jsonv=1&.d&sdid=061A6B48A2C5CB2B-6022C740AA6B178C&mid=89557616945354970112885340044013946928&aamlh=6&ce=UTF-8&pageName=D%3Dv4&g=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&cc=USD&ch=D%3Dv23&server=D%3Dv24&events=event7%2Cevent62%3D1353&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=D%3Dv54&v1=Unregistered&h1=NAO%7CNews%20and%20Observer%7COnline%7CRegistration%7C%7C%7C%7CMPP&c2=dev%3Aother&c3=D%3Dv7&c4=News%20and%20Observer%20%3A%20MPP&v4=MPP%3A%20Paywall%20Stop&c6=D%3Dh1&v7=Other&c10=%2Fpaywall%2Fsubscriber-only&c11=ecidfailed%3Ano%7Cecidtimeout%3Ano%7Cmicb%3Ayes%7ChasFocus%3Ayes%7Crefresh%3Ano&c12=pageview%3Anormal&v12=no%20referrer&c13=Unregistered&c14=D%3Dv16&v14=%3Fresume%3D250722934&c15=dev%3Aother&v15=New&c17=D%3Dv8&c18=D%3Dv15&c20=D%3Dv51&c21=Online&c22=Registration&v23=MPP&v24=account.newsobserver.com&c26=D%3Dv26&v26=NAO&c27=D%3Dv27&v27=News%20and%20Observer&v30=score%3A9&v31=sub_only_paywall&v32=sub_only_paywall&c33=12%3A37PM&c34=Friday&c35=D%3Dv13&c36=D%3Dv10&c39=D%3Dv14&c41=D%3Dv74&v41=Online%7CRegistration%7C%7C%7C%7CMPP&c43=D%3Dv55&c44=Entry%20Page&v45=loggedin%3Ano&v48=no_activity&c49=D%3Dv12&v49=sub_only_paywall&v50=D%3Dv0&v54=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only&v55=Entry%20Page&c56=D%3Dv45&c58=core%3Ano%7Cdl%3Ano&v71=1&v74=Vendor%3A%20MPP&v79=D%3Dmid&v84=1353&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=3B6E35F15A82BBB00A495D91%40AdobeOrg&AQE=1

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

dcf7fef893f7c8b296b6671d19a2b2577961f38f9be6803cbdf729107f5e00d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-aam-tid: K1t2h5FISJ4=
date: Fri, 04 Jun 2021 16:37:03 GMT
x-content-type-options: nosniff
x-c: main-1475.Ic74f9e.M0-497
p3p: CP="This is not a P3P policy"
content-length: 2769
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-1-v008-0b2509a86.edge-irl1.demdex.com 6.3.0.20210527085910-PR_1432-SNAPSHOT
pragma: no-cache
last-modified: Sat, 05 Jun 2021 16:37:03 GMT
server: jag
xserver: anedge-796b78f698-r6pwd
etag: 3484989341683515392-4621999832885975132
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 03 Jun 2021 16:37:03 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUxwV3J3QUFBSmNjYUJIbA==

170 B
506 B

90ms
87ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUxwV3J3QUFBSmNjYUJIbA==

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1622824623.351873,VS0,VE0
x-served-by: cache-hhn4057-HHN
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUxwV3J3QUFBSmNjYUJIbA==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1081709588515684&ev=Microdata&dl=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&rl=&if=false&ts=1622824623374&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22News%20and%20Observer%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22NewsArticle%22%2C%22isAccessibleForFree%22%3Afalse%2C%22publisher%22%3A%7B%22%40type%22%3A%22Organization%22%2C%22name%22%3A%22News%20and%20Observer%22%7D%2C%22hasPart%22%3A%7B%22%40type%22%3A%22WebPageElement%22%2C%22isAccessibleForFree%22%3Afalse%2C%22cssSelector%22%3A%22.paywalled-section%22%7D%2C%22isPartOf%22%3A%7B%22%40type%22%3A%5B%22CreativeWork%22%2C%22Product%22%5D%2C%22name%22%3A%22News%20and%20Observer%22%2C%22productID%22%3A%22newsobserver.com%3AAllRAL-5014%22%7D%7D%5D&sw=1600&sh=1200&v=2.9.40&r=stable&ec=2&o=30&fbp=fb.1.1622824622869.268246936&it=1622824622785&coo=false&es=automatic&tm=3&exp=l1&rqm=GET

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 04 Jun 2021 16:37:03 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YLpWrwAAAJccaBHl&expires=90

0
239 B

185ms
47ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YLpWrwAAAJccaBHl&expires=90
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1622824623.451238,VS0,VE0
x-served-by: cache-hhn4057-HHN
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YLpWrwAAAJccaBHl&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1081709588515684&ev=Adobe-Audience-Manager-Segment&cd[segID]=18576350&noscript=1

Requested by

Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 04 Jun 2021 16:37:03 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 121ms
120ms Image
image/gif 34.230.139.180
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&page=News%20and%20Observer&sec=MPP&prem=0&ptype=Other&auth=News%7CObserver%20%3A%20MPP&tv=js-2.2.18-e&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tid=ef4998ff-dcae-439a-a51c-4837f9a570b1&pid=4b6b6ae9-7019-41a4-8dc4-c251f088ef19&dtm=1622824623025&qnm=_matherq&vp=1600x1200&ds=1600x1200&tofa=1622824623&vid=1&duid=bc7a8c508385c7c9&fp=1072425006&cid=ma12095&mrk=74930332&cx=eyJjYXRlZ29yeSI6eyJjYXRlZ29yaWVzIjpbWyJPbmxpbmV8UmVnaXN0cmF0aW9ufHx8Il1dfSwicGVyZiI6eyJzdGFydCI6IjE2MjI4MjQ2MTg3NjQiLCJyZWRpckNudCI6IjAiLCJuYXZUeXBlIjoibGluayIsImhlYXBVIjoiMTBtYiIsImhlYXBUIjoiMTBtYiIsImZldGNoUyI6IjEyMDQiLCJkb21haW5TIjoiMTIwNSIsImRvbWFpbkUiOiIxMzc0IiwiY29ublMiOiIxMzc0IiwiY29ubkUiOiIxNDY4Iiwic3NsUyI6IjEzNzgiLCJyZXF1UyI6IjE0NjgiLCJyZXNwUyI6IjIyNzgiLCJyZXNwRSI6IjIyODAiLCJkb21Mb2FkIjoiMjI4OCIsImRvbUludGVyIjoiMzk2MyIsImRvbUxvYWRTIjoiMzk2NCIsImRvbUxvYWRFIjoiMzk2NiJ9fQ
Requested by: Host: account.newsobserver.com
URL: https://account.newsobserver.com/paywall/subscriber-only?resume=250722934
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.139.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-139-180.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:03 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YLpWrwAAAJccaBHl
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YLpWrwAAAJccaBHl&C=1

43 B
1002 B

58ms
58ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YLpWrwAAAJccaBHl&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 04 Jun 2021 16:37:03 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 04 Jun 2021 16:37:03 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 04 Jun 2021 16:37:03 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YLpWrwAAAJccaBHl&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 279
Expires: Fri, 04 Jun 2021 16:37:03 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=YLpWrwAAAJccaBHl
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYLpWrwAAAJccaBHl

43 B
1 KB

45ms
45ms

Image
image/gif

185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYLpWrwAAAJccaBHl

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 04 Jun 2021 16:37:03 GMT
X-Proxy-Origin: 37.120.194.236; 37.120.194.236; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.74:80
AN-X-Request-Uuid: 4dcab196-4ce0-4519-8727-67774c585e01
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 04 Jun 2021 16:37:03 GMT
X-Proxy-Origin: 37.120.194.236; 37.120.194.236; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.235:80
AN-X-Request-Uuid: 77e6fd32-4b85-47ff-9746-83324db6d3c3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYLpWrwAAAJccaBHl
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 55 KB
17 KB 162ms
73ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_e4ggyW07IMID52Z

Requested by

Host: media.mcclatchyinteractive.com
URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

4ba1d50cbf64e66979990c9c8c5af569ee3bcdde09e1ddc66a21f87c227b839d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 134777
cf-polished: origSize=57083
edge-control: max-age=604800
x-envoy-upstream-service-time: 10
vary: Accept-Encoding
cf-request-id: 0a797bb683000010e780161000000001
cf-bgj: minify
server: cloudflare
x-powered-by: Express
etag: W/"defb-oKChFo0ds9gEMfk1cobRjQmt/CY"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
cf-ray: 65a2956a6bc510e7-CPH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 66ms
33ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021052601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c6808e1f962e61d3803046f0a6d69182353226321ed3d0bbfbde0748455bffd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7661
x-xss-protection: 0

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
451 B 121ms
120ms XHR
text/plain 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=hXFHelqg_0qGLqDaoIkgLQ&is_js=true&landing_url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&t=News%20and%20Observer&host=https://account.newsobserver.com&sa_conv_data_css_value=%20%220-a456701a-825f-4ac9-6322-14463e73a736%24ip%2437.120.194.236%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9ebb3e5f1e59044695085bcb8610e6ce92578c2ec
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 0ecaf1ce9b0ffdc9b0c4d90c685ea025673e26adc0a2ce6c00cccd9ccba32227

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:03 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://account.newsobserver.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 138

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 60ms
26ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021052601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Fri, 04 Jun 2021 16:37:03 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YLpWrwAAAJccaBHl
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YLpWrwAAAJccaBHl

43 B
180 B

67ms
67ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YLpWrwAAAJccaBHl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.208.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
via: 1.1 google
server: OXGW/16.208.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YLpWrwAAAJccaBHl
date: Fri, 04 Jun 2021 16:37:03 GMT
via: 1.1 google
server: OXGW/16.208.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 5273 12 KB
5 KB 33ms
5ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://account.newsobserver.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://account.newsobserver.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Fri, 04 Jun 2021 14:17:07 GMT
expires: Sat, 04 Jun 2022 14:17:07 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 8396
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0855 783 B
529 B 29ms
29ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c741daf9e8841d4ca4fe3852fd3fe5875c3b8fb151085289512a4470ad3867ff

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-naASY0cqc7SfEaVTtdMpYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://account.newsobserver.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=216=WC7bIS9wtidyne5tY5_Y33UPYGZILTBVhM0EIhxs5WnbnseZefoRpp59Qz4SuDgs5wDqc9xwQel2CiFXszZlP28gWnVZhuJA5uj7pZhiNTBHzJrkskIWWjvuSnmRWYdPU1MHnFsFA63JxlsDqXxrAu6VzrUQbzhYicr6blG7GLY
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://account.newsobserver.com/

Response headers

expires: Fri, 04 Jun 2021 16:37:03 GMT
date: Fri, 04 Jun 2021 16:37:03 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-naASY0cqc7SfEaVTtdMpYg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 510
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js Show response
pagead2.googlesyndication.com/bg/ Frame 5273 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/wQPplS2CBbapxPPsKjLjCt6L9Rv2P8O8syxzKLSpyaY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 08:41:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28541
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5768
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 08:41:22 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YLpWrwAAAJccaBHl

1 B
546 B

159ms
53ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YLpWrwAAAJccaBHl
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 16:37:04 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug008:0:294
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1622824624.856577,VS0,VE0
x-served-by: cache-hhn4057-HHN
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YLpWrwAAAJccaBHl
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 120ms
120ms Image
image/gif 34.238.206.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=newsobserver.com&p=%2Fpaywall%2Fsubscriber-only&u=DX6xdBBjz-xTCCe5ul&d=account.newsobserver.com&g=62447&g0=MPP&g1=News%20and%20Observer%20%3A%20MPP&n=1&f=00001&c=0.02&x=0&m=0&y=1200&o=1600&w=1200&j=30&R=1&W=0&I=0&E=1&e=1&r=&b=4065&t=DtlM-aBV4qCSCu8DvACrbJ8_C6ypzU&V=126&tz=-120&_acct=anon&sn=2&sv=DfaJfuBVVzUBbkW4VDqeBbQC3jDUv&sd=1&im=0603040e&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.238.206.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-238-206-177.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YLpWrwAAAJccaBHl&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YLpWrwAAAJccaBHl&img=1&__user_check__=1&sync_id=180b956b-c553-11eb-aa54-1f6fc1870206

43 B
549 B

45ms
45ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YLpWrwAAAJccaBHl&img=1&__user_check__=1&sync_id=180b956b-c553-11eb-aa54-1f6fc1870206
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:04 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 129
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 04 Jun 2021 16:37:04 GMT
Server: nginx
Location: /partner?adv_id=6409&uid=YLpWrwAAAJccaBHl&img=1&__user_check__=1&sync_id=180b956b-c553-11eb-aa54-1f6fc1870206
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 10
Connection: keep-alive
Content-Length: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
39ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021052601&jk=1809539670553201&bg=!Xl2lXRnNAAY6sG-_OrA7ACkAdvg8Wm3-f6YOi8EnNt_91NR8W7wfLU44jdBa5f15FJu4WYMGf_-6ogIAAABgUgAAAA1oAQcKACeI-mFrHuWdgeSWTaKW-ux0qFB2gWQLOydByX90paE5k7KnRhhBYW-ZAkFvgp0zlAyVpJj5QfcGaw94P2Q25HOpQ2RqKfh7Di-HypCF5RwFVHFIRSO95_iFojvoKWb4RMqXJHKVYiVxKWyp3VuZ5abjxuOOvGS834BezNgR2Ryp7-bXcyQ8a0xiDTFOOeUvZ44t6-rPzA13Y7nsZhFwBVix_jjRaDa2WzgYMAxmzSq0FQroc7pSl82Zur79_Kd9gfC_74-wjTzZEYTNxsthLUfK6QWHNHiwGyf-dVRO_fdNmba8h74l6CoTnTj2WjyRElVJJ6CtB_O2jS2ETEgz44sTmyAcHZr9lRHOBzzBpv3IRkcDuS-H8-om0JlA6_GBnONlLI-dRQt9gqeCvH_C3ref0O3zdHtbBVYHJaIL0FiDu4oN6AvWrlE355EVtzTnAO1NqzyS6ZAOU-4HL0e4e4LFqqrqJKkXwjbzrMp9Vf_gdApPtx8ISkMaW0IEPQIXhmhyMmeH_mBsjmiXgPmAHlcuT9iHgoXNCb2uv6bumHmd7xP-kAguz18PHx643nysKA8pYfJ7L1lYTu0umb6S678rdH4IjqI39-n6k7_jEf95EBqDb7OZtyfWL4_1KsgodJvHxyQdM1ZYizjb70EabWGuFBU2R66_QnUwxQikHFfLI4qdNwBGvknGOUZvOAOScKWG9mAz_UyVT_N908o_ZktH87nIAr-Ns6b1dtMzY9Whshl6azy8wCg5l1iksvZjsuXvoGg-pupWAriwHVH5N_yq_E1gpJrG2nSUJsVvgnfwcfV4CbBs-0FAWnbC

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

b.php
www.facebook.com/fr/ Frame 31F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://sync-tm.everesttech.net/ct/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0&_test=YLpWsAABitmmcQA4
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YLpWsAABitmmcQA4&t=2592000&o=0&_test=YLpWsAABitmmcQA4

43 B
252 B

39ms
39ms

Image
image/gif

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=YLpWsAABitmmcQA4&t=2592000&o=0&_test=YLpWsAABitmmcQA4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mcclatchy.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
x-fb-debug: E8L03TQflx4mezN+PSVBW0yLxLU3byRXDATKx/F6/g9HaTbY8LR+1bh3CmKxkU7qfRq6osAdiJOd+NM9eC+ugw==
content-encoding: br
x-content-type-options: nosniff
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Fri, 04 Jun 2021 09:37:04 PDT
strict-transport-security: max-age=15552000; preload
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: image/gif
vary: Accept-Encoding
cache-control: public, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
expires: Fri, 04 Jun 2021 09:37:04 PDT

Redirect headers

pragma: no-cache
date: Fri, 04 Jun 2021 16:37:04 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1622824624.200595,VS0,VE0
x-served-by: cache-hhn4057-HHN
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=YLpWsAABitmmcQA4&t=2592000&o=0&_test=YLpWsAABitmmcQA4
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 120ms
120ms Image
image/gif 34.230.139.180
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pe&tv=js-2.2.18-e&tna=Mather&aid=v1&p=web&tz=Europe%2FBerlin&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&f_privb=n%2Fa&tid=e4f5bade-e282-4ce9-9706-b7078f024da4&pid=4b6b6ae9-7019-41a4-8dc4-c251f088ef19&dtm=1622824633025&qnm=_matherq&vp=1600x1200&ds=1600x1200&tofa=1622824633&vid=1&duid=afbacd5dbe30bcdb&fp=1072425006&cid=ma12095&mrk=74930332&url=https%3A%2F%2Faccount.newsobserver.com%2Fpaywall%2Fsubscriber-only%3Fresume%3D250722934&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTYyMjgyNDYxODc2NCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxMG1iIiwiaGVhcFQiOiIxMG1iIiwiZmV0Y2hTIjoiMTIwNCIsImRvbWFpblMiOiIxMjA1IiwiZG9tYWluRSI6IjEzNzQiLCJjb25uUyI6IjEzNzQiLCJjb25uRSI6IjE0NjgiLCJzc2xTIjoiMTM3OCIsInJlcXVTIjoiMTQ2OCIsInJlc3BTIjoiMjI3OCIsInJlc3BFIjoiMjI4MCIsImRvbUxvYWQiOiIyMjg4IiwiZG9tSW50ZXIiOiIzOTYzIiwiZG9tTG9hZFMiOiIzOTY0IiwiZG9tTG9hZEUiOiIzOTY2IiwiZG9tQ21wbHQiOiI0ODcxIiwibG9hZFMiOiI0ODcxIiwibG9hZEUiOiI0ODc2In19
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.139.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-139-180.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://account.newsobserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 04 Jun 2021 16:37:13 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

149 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

37 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 23:06:16	Name: demdex Value: 89778188813763385642942000649698852743
.newsobserver.com/	1970-01-19 19:30:16	Name: aam_segment Value: segID%3D13171211%2CsegID%3D13000790%2CsegID%3D20221272%2CsegID%3D20233534
.newsobserver.com/	1970-01-20 12:18:16	Name: AMCV_3B6E35F15A82BBB00A495D91%40AdobeOrg Value: -1124106680%7CMCIDTS%7C18783%7CMCMID%7C89557616945354970112885340044013946928%7CMCAAMLH-1623429423%7C6%7CMCAAMB-1623429423%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1622831823s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18790%7CMCCIDH%7C-1161915512%7CvVersion%7C5.2.0
.newsobserver.com/	1970-01-19 18:47:06	Name: mi_ppn Value: MPP%3A%20Paywall%20Stop
.newsobserver.com/	1970-01-19 19:30:16	Name: mi_nr Value: 1622824623284-New
.newsobserver.com/	1970-01-20 04:08:40	Name: __gads Value: ID=23f1e53f73815ec7:T=1622824623:S=ALNI_MZ8JgehlQhIupezFYs6HbeNOI5Cgg
.newsobserver.com/	1970-01-19 18:47:06	Name: mboxEdgeCluster Value: 37
.newsobserver.com/	1970-01-20 12:18:16	Name: _sp_id.1b7f Value: bc7a8c508385c7c9.1622824623.1.1622824623.1622824623
.newsobserver.com/	1969-12-31 23:59:59	Name: at_check Value: true
.account.newsobserver.com/	1978-01-11 21:30:57	Name: G_ENABLED_IDPS Value: google
.newsobserver.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.newsobserver.com/	1970-01-19 18:47:06	Name: _sp_flow.1b7f Value: paywall
.account.newsobserver.com/	1970-01-19 18:47:04	Name: _gat_mistats_ga_UA-48280268-1 Value: 1
account.newsobserver.com/	1970-01-19 18:47:06	Name: _cb_svref Value: null
account.newsobserver.com/	1970-01-20 04:15:52	Name: _cb Value: DX6xdBBjz-xTCCe5ul
.newsobserver.com/	1970-01-19 18:47:06	Name: _sp_ses.1b7f Value: *
account.newsobserver.com/	1970-01-20 04:15:52	Name: _cb_ls Value: 1
.newsobserver.com/	1970-01-19 18:47:06	Name: mi_rsi Value: 250722934
.newsobserver.com/	1970-01-20 04:15:52	Name: _cb Value: DX6xdBBjz-xTCCe5ul
.newsobserver.com/	1970-01-19 18:47:06	Name: mi_iv Value: true
.newsobserver.com/	1970-01-19 18:47:06	Name: _cbs Value: {%22u%22:%22DX6xdBBjz-xTCCe5ul%22%2C%22p%22:%22newsobserver.com/paywall/subscriber-only%22%2C%22d%22:%22newsobserver.com%22%2C%22s%22:%22DfaJfuBVVzUBbkW4VDqeBbQC3jDUv%22}
.newsobserver.com/	1970-01-19 19:30:16	Name: aam_uuid Value: 89778188813763385642942000649698852743
account.newsobserver.com/	1969-12-31 23:59:59	Name: resume Value: 250722934
.newsobserver.com/	1970-01-19 18:47:06	Name: mi_gps Value: 9
.newsobserver.com/	1970-01-20 12:21:09	Name: mbox Value: session#a2893b792bf943a09b8b49f9198f3e38#1622826483\|PC#a2893b792bf943a09b8b49f9198f3e38.37_0#1686069424
.account.newsobserver.com/	1970-01-19 18:47:04	Name: _gat_mistats_ga_UA-48279682-1 Value: 1
.newsobserver.com/	1970-01-20 12:19:43	Name: adcloud Value: {%22_les_v%22:%22y%2Cnewsobserver.com%2C1622826423%22}
account.newsobserver.com/	1970-01-20 04:15:52	Name: _chartbeat2 Value: .1622824622819.1622824622819.1.DfaJfuBVVzUBbkW4VDqeBbQC3jDUv.1
.account.newsobserver.com/	1970-01-19 18:48:31	Name: _gid Value: GA1.3.83576942.1622824623
.account.newsobserver.com/	1970-01-20 12:18:16	Name: _ga Value: GA1.3.836243575.1622824623
.newsobserver.com/	1970-01-19 18:47:06	Name: mi_pwsp Value: 1
.newsobserver.com/	1969-12-31 23:59:59	Name: AMCVS_3B6E35F15A82BBB00A495D91%40AdobeOrg Value: 1
.google.com/	1970-01-19 23:10:35	Name: NID Value: 216=WC7bIS9wtidyne5tY5_Y33UPYGZILTBVhM0EIhxs5WnbnseZefoRpp59Qz4SuDgs5wDqc9xwQel2CiFXszZlP28gWnVZhuJA5uj7pZhiNTBHzJrkskIWWjvuSnmRWYdPU1MHnFsFA63JxlsDqXxrAu6VzrUQbzhYicr6blG7GLY
.newsobserver.com/	1970-01-19 20:56:40	Name: _fbp Value: fb.1.1622824622869.268246936
.demdex.net/	1970-01-19 23:06:16	Name: dextp Value: 771-1-1622824623221\|144230-1-1622824623321\|144231-1-1622824623422\|144232-1-1622824623523\|144233-1-1622824623624
.newsobserver.com/	1970-01-19 19:30:16	Name: mi_s_vnmn Value: 1625416623285%26vn%3D1
.newsobserver.com/	1970-01-19 18:47:11	Name: ak_bmsc Value: 539EE72C9F917647D90EBB2AABE12099~000000000000000000000000000000~YAAQlroQAiJdYdN5AQAA7JPi1wyZojaadwrH4ZsmWSypA68An2MLLSLKjUlK57BZNjv7yXbJzl/7f4iAzkV2h0b2cdbmcr4fqJ4763M+HGNxZRV1H/DMAxvfmfa+KbKCXvX0p8gfy97vy09jE8Q6N3ZNB9Z3VVBaEAZ0Z4P8SHFdcmucwvzbIuiyybmUL29fEcdVrq0AxImCSw7i7NXDtsDYRWpxPt10WyJeM2rAlVtEkhAAbsMytfr+NYEDtZFZ0Ihimv0OG2PF0uYmehCtZ0Qcqqa2Jsu5vVkVVI/gF5Ci0dQk6B3iC9ECgK9iGqMyKwdfP4uUeAG33C7bHNbx2FVuu9215i7+QdRJCWe7DuIR1JUPArB0QtvbxgOO+B9qHIVjmLU8U2ayj0oBgjyyAq5vwXl7pFo=

22 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://account.newsobserver.com/static/assets/js/facebook-sdk-35ff6ad1b6.js(Line 22) Message: The Facebook JSSDK is more than 7 days old.
console-api	log	URL: https://news.google.com/swg/js/v1/swg.js(Line 10) Message: Subscriptions Runtime: 0.1.22.168
console-api	warning	URL: https://news.google.com/swg/js/v1/swg.js(Line 10) Message: [swg.js:setOnSubscribeResponse]: This method has been deprecated, please switch usages to 'setOnPaymentResponse'
console-api	log	URL: https://account.newsobserver.com/static/assets/js/swg-38bbebee7e.js(Line 1) Message: [swg.js] received entitlements response [object Object]
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/micb.js(Line 1363) Message: mistats bx_inactive
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1600) Message: waiting for mistats_target
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/micb.js(Line 1450) Message: mistats cb_loaded
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 24) Message: [Facebook Pixel] - You are sending a non-standard event 'PaywallPageview'. The preferred way to send these events is using trackCustom. See 'https://developers.facebook.com/docs/ads-for-websites/pixel-events/#events' for more information.
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/micb.js(Line 129) Message: mistats_gpscore: 9
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1600) Message: waiting for mistats_target
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1600) Message: waiting for mistats_target
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1600) Message: waiting for mistats_target
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1602) Message: mistats_target ready
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1602) Message: mistats_propensity ready
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1602) Message: mistats_cta_widget ready
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1602) Message: mistats_subdata ready
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/finalizestats.js(Line 1616) Message: mistats request queued
console-api	info	URL: https://static.chartbeat.com/js/subscriptions.js(Line 56) Message: Conversion Event ping fired.
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js(Line 190) Message: mistats request sent
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js(Line 137) Message: mistats request postback present
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js(Line 138) Message: mistats request succeeded
console-api	log	URL: https://media.mcclatchyinteractive.com/mistats/vendors/mpp_s_code.js(Line 803) Message: visitor.publishDestinations() result: The destination publishing iframe is already attached and loaded.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors "none"
X-Frame-Options	Deny DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.newsobserver.com
accounts.google.com
adservice.google.com
adservice.google.de
apis.google.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
dc92b30916660fe84580e95e98422bdb.safeframe.googlesyndication.com
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
js.matheranalytics.com
lasteventf-tm.everesttech.net
mcclatchy.demdex.net
mcclatchy.sc.omtrdc.net
mcclatchy.tt.omtrdc.net
media.mcclatchy.com
media.mcclatchyinteractive.com
news.google.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.rubiconproject.com
play.google.com
pubads.g.doubleclick.net
secure-us.imrworldwide.com
securepubads.g.doubleclick.net
ssl.gstatic.com
static.chartbeat.com
static.mcclatchyinteractive.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.search.spotxchange.com
tags.srv.stackadapt.com
tpc.googlesyndication.com
us-u.openx.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.i.matheranalytics.com
www.newsobserver.com
zne4ggyw07imid52z-mcclatchy.siteintercept.qualtrics.com
104.111.219.128
104.17.208.240
107.178.250.234
142.250.181.226
142.250.185.66
142.250.186.162
15.236.176.210
151.101.114.49
166.108.32.249
18.202.103.217
185.33.220.241
185.64.190.80
185.94.180.125
2.18.234.21
2600:9000:218f:5e00:18:1fcd:34f:cdc1
2a00:1450:4001:801::200e
2a00:1450:4001:802::2001
2a00:1450:4001:802::2002
2a00:1450:4001:809::2004
2a00:1450:4001:80e::200d
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2008
2a00:1450:4001:811::200e
2a00:1450:4001:812::2003
2a00:1450:4001:812::200e
2a00:1450:4001:813::2001
2a00:1450:4001:827::2003
2a00:1450:4001:827::200e
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:831::2002
2a00:1450:4001:831::2003
2a00:1450:4001:831::200e
2a00:1450:400c:c08::9c
2a02:26f0:6c00:2b0::31c6
2a02:26f0:6c00::210:ba9a
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
3.250.252.43
34.230.139.180
34.238.206.177
34.252.166.160
34.253.145.149
34.98.64.218
54.165.186.74
69.173.144.139
071faf19302a3f065704e296da55906538e231207de050287a6d2c7b4dcca087
088d5009d94670b11171689b4ae4cf76c0f200092de752a47a4b15c082f0d3c1
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ecaf1ce9b0ffdc9b0c4d90c685ea025673e26adc0a2ce6c00cccd9ccba32227
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
18c2cb309f377f262ec95016ad2e975c99883ffd35e0407cf2badaa43d4f6517
18f9e6b96e326a7aa705c687fc8893c6b2df53acce477aefe2d0239d7b82fcb5
1c6808e1f962e61d3803046f0a6d69182353226321ed3d0bbfbde0748455bffd
1e733de4dcd0e770c31c49d62a6ec6ddc47c0a4db917f557179696afb0247478
1f07061f029748690554a225b9de76e1fc18f8c7f52d0cc41631d058601b89c3
1f31539fc32ad70a31457aec32e4df5c7b237a97476cc8ff20fce3d6d410d446
21891543f19b0f6f617591cd5b4624a09f0d74d01b3e9836bca0af56ddea6973
26534efa3506ce466e7b11c0e264ad1eb6b0183c5903a0e35360b0a9a4a2ffaf
2871f8ff317c9b5830a535184ecbb57bcd137ceb7bd32dadd5025dda1c80a183
2c417a757edfd69372f10a571e05e52ec55356e952095bbe0f6b92c16ad094eb
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2f3dd644bc769af8580e4cb9caa379103b9ae7d73517274788f4702fe9629f8f
3059f6734139cb1c1184b13ac4aefc2d597b854651739d0c36b446975d6de3eb
33305bb743a697eed834495cd935e402fa483cb7615610e6efbae3dedf8d37ec
33df66ca469e2de5ae4723c4944b20fd37d65daa2f095b6ec2ff0d70ed6c3d57
3b5c86e2f30dc2271f6a80d66c16fc566befeed355ed45eb2c3e691a2c09a303
3ba5369627fc324f2d2c47f44c8da30769d2a3ccbe8110b9bd5eec9585e42a09
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4a19ad93b8c725e7f19dcc851248a683bffb63243553bb91f6fafd3bc41302a6
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ba1d50cbf64e66979990c9c8c5af569ee3bcdde09e1ddc66a21f87c227b839d
4da18cf3cfa4b3d576d9eda3450e2773c95ad8a660ec2998c7a7287f4191daf7
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5020ee1e0ecf719b05b2d80a85aeda58dc7cedba42a90a0ead5eb90618cb0537
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
57c2067a66279e69365cd496d2717008640c7427d5ca8486a0d34bcc5c92cce9
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
61c8e530fa5c9e7bee977f6a378441d7a0780d18610ea15b591922f28e5991b1
63652bae3aca33ace44dbf6bd632c79ee36f1ce3dca985983cc04b6e70547948
646fda8e6ce619a137e093efd2c4f58ceaa00b594d0947ddc0db8c7b96d1e61e
6573f2d6e1e3d14006b2f72b533971b289a37e13232f16a72311037b233b63ad
66271bc6e78723553964eac5949df54510199fb20b1a920c7e61533aa67ef827
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
685ee1f5e122fdc218b11e4589efbbfc2c567087e94b65062b13c290aae43a6e
6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7d6ca4b910111700848845a724f4a8e0f842ab4684c1715b7a218ff162fe9e31
7ddc1f3125c1c3c3e6cb0422f65eedddac57fc4716d5a88e4c947b0065a8ae95
7ede11749fa9e39bb8b2e3d62d63c539376a1740354664b2beb4ff7a5b9fd4c0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
9467ca48380058d5034ef3591aa81ebfaa3ca13cd2ec1e7ef66d3ccbc8101e99
975d7d40cacf62333123be264facbc54c4191bccbd172c3588d7ffdb5c95cddb
9d2abb3f0b32fc66768133157f17425639bab7a2088ab7946c205aae9f3be489
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a15a9e213368ab017cb7b81b8955f0f54932effc50a6a8a833aac91956757bea
a203f038afc58ab20a149d5d9076ff078c648fcbeccf3af675fdc899e3f29d9c
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5673bf235995988113079a77fa870f741ad3e4f0c2da56d3c7cb3ff20350a5b
a8cafd34ae6cb44de7ae4e5992833ffce874d232525b0e53d0dba95df9c681b7
abc71bd473626280c33470e02f94591791fd8723d5a2fa2f8d35746b89b08a86
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3ad2bf6a180fdb5f07d5e588f0d488d40c804e363c25ffec8b70e8926a6df99
b4b54ba1689cf2d4a3f9f0b141b3e0892563cc7a001d1e22362ca273f8921eda
b8a2fbd39f5894181c5d653f15572a9bc48297d6b5fe7826d28f2c485a229001
bf56d0c6b86f69d3f6dfb156399577c16da981c390a16d26c7752ed85bc38ac4
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
bfee3aaae52a8e772c619f79150bb21d5e6ece8a846b966b3bd283a4a7f4ed6f
c103e9952d8205b6a9c4f3ec2a32e30ade8bf51bf63fc3bcb32c7328b4a9c9a6
c2972ab4e6f23916a402bb8b39984e6a1f80b9650c4889fabbf9b94e8cbe9184
c491a839b930e0ac5934e629527f704e4edb17937b53c3eb3ed257bd49faf8fb
c5f3f9eb87e77668751a1eb38baa3c354d206324b5f79872a3eb3d0b00b6bf47
c612e7d769d7c249e81fc1446381bf8bd04d92a5e6961e890688482b4d89c7db
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
c741daf9e8841d4ca4fe3852fd3fe5875c3b8fb151085289512a4470ad3867ff
cbd0e12b1246f6280d9cd402284261eb3e81a9b5c6e179ae5d1a20b7731a4fa7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0b69cadedb516d1f6fe40f5c8a6259e1a8d3e6ce43283f5b86bcbca86d30f33
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
dcf7fef893f7c8b296b6671d19a2b2577961f38f9be6803cbdf729107f5e00d7
dd0e535e0bc470abf4ffd5f6c88760d9f90db7957e84e20e0b7e81c01d8ee06b
dd97d6591cf527d6d5cbfeb40d10bc1baed508fd1326b4cc2d278c90acab18a2
deff6a17f2ce135a5c9991244bc06fdf0bddfea6d337689179355837afab12c1
e29d2193d62bb2e5592995930724ac250010d215195e76c9c7ec5592e163c6ce
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4407435be0c97132f9813181dc1c390d7404e133e4d9e9e2680a3f0e2dd1dde
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
eb3e37a7ff21210c2bd7a83d3cf172745b6b6237c50429023544133dec323448
ec2cc99b7d1be6fb64d9ce3622e5584e39002529d87a71ffad76435b800de309
ec93813683cccb74a7896a34a2ed1b2163288620f6959ae06de3ded30cf518b9
ecfaa9137dd69908b593ee768005343e47f4b4ad10c51e13ef322384a1cd4ce3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0974f50c07dbd7908fe477b26448ea1716d311a64b05ffa0d7e05cb8c133acb
f2f93fd85c2f5e6c07c80c6487a804ec6bede5bed8fe755280d87d4dfde986d0

account.newsobserver.com Open in urlscan Pro 2a02:26f0:6c00::210:ba9a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

124 Requests

100 %HTTPS

53 %IPv6

29 Domains

50 Subdomains

47 IPs

7 Countries

1516 kBTransfer

4006 kBSize

37 Cookies

4 Outgoing links

Page URL History

Redirected requests

124 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

account.newsobserver.com Open in urlscan Pro
2a02:26f0:6c00::210:ba9a Public Scan

Screenshot
Live screenshot

Full Image

124
Requests

100 %
HTTPS

53 %
IPv6

29
Domains

50
Subdomains

47
IPs

7
Countries

1516 kB
Transfer

4006 kB
Size

37
Cookies

124 HTTP transactions
1 data transactions