win.gg Open in urlscan Pro
18.158.98.109 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://win.gg/news/7999/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate
Effective URL:
https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Submission: On January 10 via manual (January 10th 2022, 5:23:06 am UTC) from ZA — Scanned from IT

Summary HTTP 264 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 73 IPs in 15 countries across 70 domains to perform 264 HTTP transactions. The main IP is 18.158.98.109, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is win.gg. The Cisco Umbrella rank of the primary domain is 357480.
TLS certificate: Issued by R3 on December 16th 2021. Valid for: 3 months.

This is the only time win.gg was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 47	18.158.98.109 18.158.98.109	16509 (AMAZON-02) (AMAZON-02)
1	13.224.193.52 13.224.193.52	16509 (AMAZON-02) (AMAZON-02)
1 19	185.229.227.132 185.229.227.132	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:20e... 2600:9000:20eb:4800:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
22	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
2 2	2600:9000:21f... 2600:9000:21f3:9800:1d:c575:fcc0:21	16509 (AMAZON-02) (AMAZON-02)
2	3.248.44.18 3.248.44.18	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3036::ac43:a1d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2600:9000:20e... 2600:9000:20eb:3c00:12:b1b7:8800:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21f... 2600:9000:21f3:c800:d:3df0:6d00:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
4	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02)
1	52.35.50.171 52.35.50.171	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:303... 2606:4700:3031::6815:496e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2600:9000:21f... 2600:9000:21f3:6800:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
10	2a07:180:27b:... 2a07:180:27b:71f4:967e:7b66:dbda:fbaf	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
2	13.224.198.4 13.224.198.4	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
4	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	2a0c:5c81:513... 2a0c:5c81:5139::2	55081 (24SHELLS) (24SHELLS)
13	194.146.38.187 194.146.38.187	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
3 4	3.123.179.172 3.123.179.172	16509 (AMAZON-02) (AMAZON-02)
1 1	23.88.75.187 23.88.75.187	24940 (HETZNER-AS) (HETZNER-AS)
3 3	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	13.225.80.95 13.225.80.95	16509 (AMAZON-02) (AMAZON-02)
1	8.39.36.141 8.39.36.141	26667 (RUBICONPR...) (RUBICONPROJECT)
3 4	37.252.172.249 37.252.172.249	29990 (ASN-APPNEX) (ASN-APPNEX)
1	52.29.0.64 52.29.0.64	16509 (AMAZON-02) (AMAZON-02)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
2	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
3	2600:9000:21f... 2600:9000:21f3:d600:f:4f64:8940:93a1	16509 (AMAZON-02) (AMAZON-02)
2 3	37.157.2.239 37.157.2.239	198622 (ADFORM) (ADFORM)
2	89.187.169.47 89.187.169.47	60068 (CDN77 ^_^) (CDN77 ^_^)
6	62.149.0.72 62.149.0.72	15497 (COLOCALL ...) (COLOCALL Internet Data Center ColoCALL)
2 2	185.184.8.65 185.184.8.65	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
1 4	5.178.65.245 5.178.65.245	50673 (SERVERIUS-AS) (SERVERIUS-AS)
2	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
5 5	3.90.91.223 3.90.91.223	14618 (AMAZON-AES) (AMAZON-AES)
2 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
4 5	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
6 8	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
1 13	18.196.233.14 18.196.233.14	16509 (AMAZON-02) (AMAZON-02)
1 4	188.132.147.236 188.132.147.236	42910 (PREMIERDC...) (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH)
1 2	66.155.71.150 66.155.71.150	13768 (COGECO-PEER1) (COGECO-PEER1)
3	5.178.65.253 5.178.65.253	50673 (SERVERIUS-AS) (SERVERIUS-AS)
1	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
3 6	3.228.116.73 3.228.116.73	14618 (AMAZON-AES) (AMAZON-AES)
1 3	168.119.149.178 168.119.149.178	24940 (HETZNER-AS) (HETZNER-AS)
1 3	23.37.42.132 23.37.42.132	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:812::2006	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	13.225.83.200 13.225.83.200	16509 (AMAZON-02) (AMAZON-02)
1	51.75.86.98 51.75.86.98	16276 (OVH) (OVH)
16	2606:4700:10:... 2606:4700:10::6816:1957	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	62.209.227.211 62.209.227.211	13036 (TMOBILE-) (TMOBILE-)
3 4	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
1 2	37.157.4.24 37.157.4.24	198622 (ADFORM) (ADFORM)
1	2a04:4e42:600... 2a04:4e42:600::300	54113 (FASTLY) (FASTLY)
1	2607:ae80:2::48 2607:ae80:2::48	26558 (FREEWHEEL) (FREEWHEEL)
3 3	52.17.105.123 52.17.105.123	16509 (AMAZON-02) (AMAZON-02)
2 2	18.198.69.109 18.198.69.109	16509 (AMAZON-02) (AMAZON-02)
1 1	151.1.205.165 151.1.205.165	3242 (ASN-ITNET) (ASN-ITNET)
2 2	35.201.81.244 35.201.81.244	15169 (GOOGLE) (GOOGLE)
2 6	34.249.68.36 34.249.68.36	16509 (AMAZON-02) (AMAZON-02)
1 1	212.82.100.182 212.82.100.182	34010 (YAHOO-IRD) (YAHOO-IRD)
1 1	18.135.35.213 18.135.35.213	16509 (AMAZON-02) (AMAZON-02)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
2	54.77.177.229 54.77.177.229	16509 (AMAZON-02) (AMAZON-02)
3 3	151.101.194.49 151.101.194.49	54113 (FASTLY) (FASTLY)
1 1	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS)
1	54.217.170.69 54.217.170.69	16509 (AMAZON-02) (AMAZON-02)
1 1	52.204.3.213 52.204.3.213	14618 (AMAZON-AES) (AMAZON-AES)
1 2	54.239.37.23 54.239.37.23	16509 (AMAZON-02) (AMAZON-02)
1 1	52.214.105.43 52.214.105.43	16509 (AMAZON-02) (AMAZON-02)
1	13.225.80.14 13.225.80.14	16509 (AMAZON-02) (AMAZON-02)
1	51.158.29.12 51.158.29.12	12876 (Online SAS) (Online SAS)
1 1	182.161.74.16 182.161.74.16	55569 (CRITEO-AS...) (CRITEO-AS-AP Criteo APAC)
1 1	178.250.2.151 178.250.2.151	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	8.39.36.142 8.39.36.142	26667 (RUBICONPR...) (RUBICONPROJECT)
1 3	3.122.214.165 3.122.214.165	16509 (AMAZON-02) (AMAZON-02)
2 2	88.212.252.22 88.212.252.22	7979 (SERVERS-COM) (SERVERS-COM)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	185.29.134.244 185.29.134.244	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 1	37.252.173.214 37.252.173.214	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	72.251.244.141 72.251.244.141	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
264	73

47 18.158.98.109 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

win.gg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.193.52 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-52.fra2.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 185.229.227.132 (Amsterdam, Netherlands) 1 redirects

ASN41436 (CLOUDWEBMANAGE-EU, US)

live.primis.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:4800:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21f3:9800:1d:c575:fcc0:21 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

d33whie8snbuur.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.248.44.18 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-44-18.eu-west-1.compute.amazonaws.com

web-chat-plugin.picogp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:a1d1 (United States)

ASN13335 (CLOUDFLARENET, US)

g.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:20eb:3c00:12:b1b7:8800:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn-images.win.gg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:c800:d:3df0:6d00:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.winners.bet	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.35.50.171 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-35-50-171.us-west-2.compute.amazonaws.com

cdn.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3031::6815:496e (United States)

ASN13335 (CLOUDFLARENET, US)

gvl.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:21f3:6800:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a07:180:27b:71f4:967e:7b66:dbda:fbaf (Belize)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

cdn.gin.bet	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.224.198.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-4.fra2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 2 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0c:5c81:5139::2 (London, United Kingdom)

ASN55081 (24SHELLS, US)

s.console.adtarget.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 194.146.38.187 (Amsterdam, Netherlands)

ASN41436 (CLOUDWEBMANAGE-EU, US)

video.primis.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.123.179.172 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-179-172.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.88.75.187 (Gunzenhausen, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.187.75.88.23.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.234.21 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.245.213 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.80.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-95.fra2.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.39.36.141 (Los Angeles, United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.252.172.249 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.29.0.64 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-0-64.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.78 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:21f3:d600:f:4f64:8940:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.adscale.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.157.2.239 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 89.187.169.47 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-89-187-169-47.cdn77.com

cdn.admatic.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 62.149.0.72 (Ukraine)

ASN15497 (COLOCALL Internet Data Center ColoCALL, UA)
PTR: 0-72.cc86365-03-tmp.cc.colocall.com

sync.console.adtarget.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.65 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 5.178.65.245 (Woerden, Netherlands) 1 redirects

ASN50673 (SERVERIUS-AS, NL)
PTR: ads.us.e-planning.net

ads.us.e-planning.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u-ams02.e-planning.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.90.91.223 (Ashburn, United States) 5 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-90-91-223.compute-1.amazonaws.com

cs.choozle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.33.220.150 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.186.162 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 18.196.233.14 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com

ih.adscale.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 188.132.147.236 (Turkey) 1 redirects

ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR)
PTR: static-236-147-132-188.sadecehosting.net

ads3.admatic.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads4.admatic.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.155.71.150 (Portsmouth, United Kingdom) 1 redirects

ASN13768 (COGECO-PEER1, CA)

pixel.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 5.178.65.253 (Woerden, Netherlands)

ASN50673 (SERVERIUS-AS, NL)
PTR: i.e-planning.net

s.e-planning.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.228.116.73 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-228-116-73.compute-1.amazonaws.com

a.audrte.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 168.119.149.178 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.178.149.119.168.clients.your-server.de

sync.richaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.37.42.132 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.83.200 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-83-200.fra2.r.cloudfront.net

d1eoo1tco6rr5e.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.75.86.98 (France)

ASN16276 (OVH, FR)
PTR: ip98.ip-51-75-86.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2606:4700:10::6816:1957 (United States)

ASN13335 (CLOUDFLARENET, US)

spl.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mwzeom.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.209.227.211 (Prague, Czech Republic) 1 redirects

ASN13036 (TMOBILE-, CZ)
PTR: bbnautid2.ibillboard.com

bbnaut.ibillboard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.227.248.159 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.4.24 (Denmark) 1 redirects

ASN198622 (ADFORM, DK)

dmp.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::300 (United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:ae80:2::48 (United States)

ASN26558 (FREEWHEEL, US)

dmp.v.fwmrm.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.17.105.123 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-105-123.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.198.69.109 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-69-109.eu-central-1.compute.amazonaws.com

loadeu.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.1.205.165 (Milan, Italy) 1 redirects

ASN3242 (ASN-ITNET, IT)

bn01.er.bemail.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.81.244 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 244.81.201.35.bc.googleusercontent.com

idsync.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.249.68.36 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-68-36.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.182 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)
PTR: spcms.pbp.vip.ir2.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.135.35.213 (London, United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-135-35-213.eu-west-2.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.77.177.229 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-177-229.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.194.49 (United States) 3 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.233.201 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.217.170.69 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-217-170-69.eu-west-1.compute.amazonaws.com

engine.widespace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.204.3.213 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-3-213.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.239.37.23 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.214.105.43 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-105-43.eu-west-1.compute.amazonaws.com

obgpm76tt0a0sgozk8l.redinuid.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.80.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-14.fra2.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.158.29.12 (Paris, France)

ASN12876 (Online SAS, FR)
PTR: 51-158-29-12.rev.poneytelecom.eu

js.cookieless-data.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.161.74.16 (Singapore) 1 redirects

ASN55569 (CRITEO-AS-AP Criteo APAC, JP)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.151 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

widget.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.39.36.142 (United States)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.122.214.165 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-214-165.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.252.22 (Russian Federation) 2 redirects

ASN7979 (SERVERS-COM, US)

ads.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel-eu.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.29.134.244 (United Kingdom) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.173.214 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 865.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

adscale-emea.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.251.244.141 (Amsterdam, Netherlands) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)
PTR: tracking-failover-02.ams2.m6r.eu

tracking.m6r.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	win.gg 1 redirects win.gg — Cisco Umbrella Rank: 357480 cdn-images.win.gg — Cisco Umbrella Rank: 562413	2 MB
32	primis.tech 1 redirects live.primis.tech — Cisco Umbrella Rank: 2780 video.primis.tech — Cisco Umbrella Rank: 6043	3 MB
22	youtube.com www.youtube.com — Cisco Umbrella Rank: 91 img.youtube.com — Cisco Umbrella Rank: 3206	733 KB
16	zeotap.com spl.zeotap.com — Cisco Umbrella Rank: 1092 mwzeom.zeotap.com — Cisco Umbrella Rank: 1443	5 KB
16	adscale.de 1 redirects js.adscale.de — Cisco Umbrella Rank: 6665 ih.adscale.de — Cisco Umbrella Rank: 3223	17 KB
10	doubleclick.net 6 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 78 cm.g.doubleclick.net — Cisco Umbrella Rank: 169	1 KB
10	gin.bet cdn.gin.bet	398 KB
8	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 4931 buttons-config.sharethis.com — Cisco Umbrella Rank: 5856 platform-cdn.sharethis.com — Cisco Umbrella Rank: 11703 l.sharethis.com — Cisco Umbrella Rank: 4359	47 KB
7	crwdcntrl.net 2 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 538 tags.crwdcntrl.net — Cisco Umbrella Rank: 1395 sync.crwdcntrl.net — Cisco Umbrella Rank: 641	15 KB
7	e-planning.net 1 redirects ads.us.e-planning.net — Cisco Umbrella Rank: 3005 u-ams02.e-planning.net — Cisco Umbrella Rank: 47537 s.e-planning.net — Cisco Umbrella Rank: 4980	17 KB
7	adtarget.com.tr s.console.adtarget.com.tr — Cisco Umbrella Rank: 5490 sync.console.adtarget.com.tr — Cisco Umbrella Rank: 5916	3 KB
7	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 446 hbopenbid.pubmatic.com — Cisco Umbrella Rank: 448 image6.pubmatic.com — Cisco Umbrella Rank: 531	22 KB
7	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 258 fonts.googleapis.com — Cisco Umbrella Rank: 37 imasdk.googleapis.com — Cisco Umbrella Rank: 427	352 KB
6	audrte.com 3 redirects a.audrte.com — Cisco Umbrella Rank: 2824	5 KB
6	admatic.com.tr 1 redirects cdn.admatic.com.tr — Cisco Umbrella Rank: 8494 ads3.admatic.com.tr — Cisco Umbrella Rank: 9220 ads4.admatic.com.tr — Cisco Umbrella Rank: 17094	22 KB
6	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 270 secure-assets.rubiconproject.com — Cisco Umbrella Rank: 906 eus.rubiconproject.com — Cisco Umbrella Rank: 503 token.rubiconproject.com — Cisco Umbrella Rank: 583 pixel-eu.rubiconproject.com — Cisco Umbrella Rank: 2071	11 KB
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33	54 KB
5	adsrvr.org 4 redirects match.adsrvr.org — Cisco Umbrella Rank: 295 insight.adsrvr.org — Cisco Umbrella Rank: 602	2 KB
5	choozle.com 5 redirects cs.choozle.com — Cisco Umbrella Rank: 7012	3 KB
5	adform.net 3 redirects cm.adform.net — Cisco Umbrella Rank: 1465 dmp.adform.net — Cisco Umbrella Rank: 1949 track.adform.net — Cisco Umbrella Rank: 3624	2 KB
5	adnxs.com 4 redirects secure.adnxs.com — Cisco Umbrella Rank: 351 ib.adnxs.com — Cisco Umbrella Rank: 210 adscale-emea.adnxs.com — Cisco Umbrella Rank: 15529	4 KB
4	tapad.com 3 redirects pixel.tapad.com — Cisco Umbrella Rank: 369	2 KB
4	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 254	2 KB
4	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 272 aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1384	41 KB
4	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2314	11 KB
3	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 769	2 KB
3	mathtag.com 3 redirects pixel.mathtag.com — Cisco Umbrella Rank: 1039 sync.mathtag.com — Cisco Umbrella Rank: 372	2 KB
3	everesttech.net 3 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 491	977 B
3	krxd.net 1 redirects beacon.krxd.net — Cisco Umbrella Rank: 356 usermatch.krxd.net — Cisco Umbrella Rank: 896	940 B
3	demdex.net 3 redirects dpm.demdex.net — Cisco Umbrella Rank: 184	3 KB
3	richaudience.com 1 redirects sync.richaudience.com — Cisco Umbrella Rank: 1830	742 B
3	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 279	1 KB
3	gstatic.com fonts.gstatic.com	47 KB
3	casalemedia.com 3 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 456 ssum.casalemedia.com — Cisco Umbrella Rank: 1052	3 KB
3	ezodn.com g.ezodn.com — Cisco Umbrella Rank: 55060 gvl.ezodn.com — Cisco Umbrella Rank: 80445	174 KB
3	cloudfront.net 2 redirects d33whie8snbuur.cloudfront.net d1eoo1tco6rr5e.cloudfront.net	1 KB
2	m6r.eu 2 redirects tracking.m6r.eu — Cisco Umbrella Rank: 10644	1 KB
2	betweendigital.com 2 redirects ads.betweendigital.com — Cisco Umbrella Rank: 1471	1 KB
2	criteo.com 2 redirects dis.criteo.com — Cisco Umbrella Rank: 574 widget.eu.criteo.com — Cisco Umbrella Rank: 24020	1 KB
2	weborama.fr 2 redirects idsync.frontend.weborama.fr — Cisco Umbrella Rank: 25120	672 B
2	exelator.com 2 redirects loadeu.exelator.com — Cisco Umbrella Rank: 7330	2 KB
2	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 94	13 KB
2	sitescout.com 1 redirects pixel.sitescout.com — Cisco Umbrella Rank: 2742 pixel-sync.sitescout.com — Cisco Umbrella Rank: 547	479 B
2	bluekai.com 2 redirects tags.bluekai.com — Cisco Umbrella Rank: 402	1 KB
2	creativecdn.com 2 redirects creativecdn.com — Cisco Umbrella Rank: 666	721 B
2	google.it www.google.it — Cisco Umbrella Rank: 18370	608 B
2	google.com analytics.google.com — Cisco Umbrella Rank: 971 www.google.com — Cisco Umbrella Rank: 8	842 B
2	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 355	966 B
2	openx.net u.openx.net — Cisco Umbrella Rank: 639 rtb.openx.net — Cisco Umbrella Rank: 1154	656 B
2	spotxchange.com 2 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 418	1 KB
2	picogp.com web-chat-plugin.picogp.com	5 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	109 KB
1	cookieless-data.com js.cookieless-data.com — Cisco Umbrella Rank: 4716	535 B
1	imrworldwide.com 1 redirects obgpm76tt0a0sgozk8l.redinuid.imrworldwide.com — Cisco Umbrella Rank: 33853	214 B
1	widespace.com engine.widespace.com — Cisco Umbrella Rank: 52913	76 B
1	mookie1.com odr.mookie1.com — Cisco Umbrella Rank: 739	324 B
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 371	381 B
1	yahoo.com 1 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 775	893 B
1	bemail.it 1 redirects bn01.er.bemail.it — Cisco Umbrella Rank: 119601	659 B
1	fwmrm.net dmp.v.fwmrm.net — Cisco Umbrella Rank: 8893	361 B
1	taboola.com trc.taboola.com — Cisco Umbrella Rank: 523	163 B
1	ibillboard.com 1 redirects bbnaut.ibillboard.com — Cisco Umbrella Rank: 16655	550 B
1	onetag-sys.com onetag-sys.com — Cisco Umbrella Rank: 888	814 B
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 245	17 KB
1	intentiq.com sync.intentiq.com — Cisco Umbrella Rank: 1199
1	loopme.me 1 redirects csync.loopme.me — Cisco Umbrella Rank: 877	243 B
1	oribi.io cdn.oribi.io — Cisco Umbrella Rank: 15673	139 B
1	winners.bet cdn.winners.bet	930 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 398	23 KB
0	ib-ibi.com Failed global.ib-ibi.com Failed
264	70

	Domain	Requested by
47	win.gg	1 redirects win.gg ajax.googleapis.com
20	img.youtube.com	win.gg
19	live.primis.tech	1 redirects win.gg live.primis.tech
13	mwzeom.zeotap.com	ads.us.e-planning.net
13	ih.adscale.de	1 redirects js.adscale.de ih.adscale.de
13	video.primis.tech	live.primis.tech win.gg
10	cdn.gin.bet	win.gg
8	cm.g.doubleclick.net	6 redirects spl.zeotap.com bcp.crwdcntrl.net
8	cdn-images.win.gg	win.gg
6	a.audrte.com	3 redirects ads.us.e-planning.net a.audrte.com s.console.adtarget.com.tr
6	sync.console.adtarget.com.tr	s.console.adtarget.com.tr js.adscale.de ads.us.e-planning.net
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
5	cs.choozle.com	5 redirects
5	platform-cdn.sharethis.com	win.gg
4	pixel.tapad.com	3 redirects ads.us.e-planning.net
4	x.bidswitch.net	3 redirects win.gg
4	ads.pubmatic.com	live.primis.tech s.console.adtarget.com.tr ads.us.e-planning.net
4	fonts.googleapis.com	win.gg live.primis.tech d33whie8snbuur.cloudfront.net
4	nexus.ensighten.com	www.googletagmanager.com nexus.ensighten.com
3	sync.crwdcntrl.net	bcp.crwdcntrl.net
3	ps.eyeota.net	1 redirects s.console.adtarget.com.tr
3	sync-tm.everesttech.net	3 redirects
3	bcp.crwdcntrl.net	2 redirects tags.crwdcntrl.net
3	dpm.demdex.net	3 redirects
3	spl.zeotap.com	ads.us.e-planning.net spl.zeotap.com
3	sync.richaudience.com	1 redirects ads.us.e-planning.net spl.zeotap.com
3	s.e-planning.net	ads.us.e-planning.net
3	ads3.admatic.com.tr	cdn.admatic.com.tr s.console.adtarget.com.tr
3	idsync.rlcdn.com	2 redirects win.gg
3	match.adsrvr.org	3 redirects
3	js.adscale.de	s.console.adtarget.com.tr js.adscale.de ih.adscale.de
3	fonts.gstatic.com	fonts.googleapis.com
2	tracking.m6r.eu	2 redirects
2	sync.mathtag.com	2 redirects
2	ads.betweendigital.com	2 redirects
2	track.adform.net	2 redirects
2	aax-eu.amazon-adsystem.com	1 redirects ads.us.e-planning.net
2	beacon.krxd.net	spl.zeotap.com ads.us.e-planning.net
2	idsync.frontend.weborama.fr	2 redirects
2	loadeu.exelator.com	2 redirects
2	dmp.adform.net	1 redirects spl.zeotap.com
2	insight.adsrvr.org	1 redirects d1eoo1tco6rr5e.cloudfront.net
2	pagead2.googlesyndication.com	srcdoc imasdk.googleapis.com
2	eus.rubiconproject.com	ads.us.e-planning.net eus.rubiconproject.com
2	ib.adnxs.com	1 redirects spl.zeotap.com
2	u-ams02.e-planning.net	ads.us.e-planning.net
2	tags.bluekai.com	2 redirects
2	imasdk.googleapis.com	live.primis.tech imasdk.googleapis.com
2	ads.us.e-planning.net	1 redirects s.console.adtarget.com.tr
2	creativecdn.com	2 redirects
2	cdn.admatic.com.tr	s.console.adtarget.com.tr cdn.admatic.com.tr
2	www.google.it	win.gg
2	image6.pubmatic.com	ads.pubmatic.com spl.zeotap.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	secure.adnxs.com	2 redirects
2	eb2.3lift.com	2 redirects
2	ssum-sec.casalemedia.com	2 redirects
2	sync.search.spotxchange.com	2 redirects
2	c.amazon-adsystem.com	live.primis.tech c.amazon-adsystem.com
2	gvl.ezodn.com	g.ezodn.com
2	web-chat-plugin.picogp.com	win.gg
2	d33whie8snbuur.cloudfront.net	2 redirects
2	www.googletagmanager.com	win.gg www.googletagmanager.com
2	www.youtube.com	win.gg www.youtube.com
1	pixel-sync.sitescout.com	bcp.crwdcntrl.net
1	adscale-emea.adnxs.com	1 redirects
1	pixel-eu.rubiconproject.com	s.console.adtarget.com.tr
1	ads4.admatic.com.tr	1 redirects
1	token.rubiconproject.com	ads.us.e-planning.net
1	widget.eu.criteo.com	1 redirects
1	dis.criteo.com	1 redirects
1	js.cookieless-data.com	s.e-planning.net
1	tags.crwdcntrl.net	s.e-planning.net
1	ssum.casalemedia.com	1 redirects
1	obgpm76tt0a0sgozk8l.redinuid.imrworldwide.com	1 redirects
1	usermatch.krxd.net	1 redirects
1	engine.widespace.com	spl.zeotap.com
1	pixel.mathtag.com	1 redirects
1	odr.mookie1.com	spl.zeotap.com
1	aa.agkn.com	1 redirects
1	cms.analytics.yahoo.com	1 redirects
1	bn01.er.bemail.it	1 redirects
1	dmp.v.fwmrm.net	spl.zeotap.com
1	trc.taboola.com	spl.zeotap.com
1	bbnaut.ibillboard.com	1 redirects
1	onetag-sys.com	ads.us.e-planning.net
1	d1eoo1tco6rr5e.cloudfront.net	nexus.ensighten.com
1	s0.2mdn.net	imasdk.googleapis.com
1	secure-assets.rubiconproject.com	1 redirects
1	rtb.openx.net	ads.us.e-planning.net
1	pixel.sitescout.com	1 redirects
1	www.google.com	win.gg
1	cm.adform.net	s.console.adtarget.com.tr
1	analytics.google.com	www.googletagmanager.com
1	hbopenbid.pubmatic.com	live.primis.tech
1	l.sharethis.com	platform-api.sharethis.com
1	pixel.rubiconproject.com	win.gg
1	sync.intentiq.com	win.gg
1	csync.loopme.me	1 redirects
1	s.console.adtarget.com.tr	live.primis.tech
1	u.openx.net	live.primis.tech
1	cdn.oribi.io	win.gg
1	cdn.winners.bet	win.gg
1	g.ezodn.com	win.gg
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	cdn.jsdelivr.net	win.gg
1	ajax.googleapis.com	win.gg
1	platform-api.sharethis.com	win.gg
0	global.ib-ibi.com Failed	bcp.crwdcntrl.net
264	109

This site contains links to these domains. Also see Links.

Domain
mercurybest.com
twitter.com
winners.net
winners.bet
youtube.com
www.instagram.com
www.facebook.com

Subject Issuer	Validity	Valid
win.gg R3	`2021-12-16` - `2022-03-16`	3 months	crt.sh
sharethis.com Amazon	`2021-07-19` - `2022-08-17`	a year	crt.sh
primis.tech Go Daddy Secure Certificate Authority - G2	`2021-10-29` - `2022-06-18`	8 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.winners.bet Amazon	`2021-07-23` - `2022-08-21`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-14` - `2022-10-12`	a year	crt.sh
*.oribi.io Amazon	`2021-08-29` - `2022-09-27`	a year	crt.sh
cdn.gin.bet Cloudflare Inc ECC CA-3	`2021-09-15` - `2022-09-14`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
s.console.adtarget.com.tr ZeroSSL ECC Domain Secure Site CA	`2021-11-29` - `2022-02-27`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google.it GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.adscale.de Amazon	`2021-08-08` - `2022-09-06`	a year	crt.sh
*.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-05-28` - `2022-06-15`	a year	crt.sh
cdn.admatic.com.tr R3	`2022-01-06` - `2022-04-06`	3 months	crt.sh
sync.console.adtarget.com.tr R3	`2021-11-28` - `2022-02-26`	3 months	crt.sh
ads.us.e-planning.net R3	`2021-12-17` - `2022-03-17`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
ads4.admatic.com.tr R3	`2022-01-04` - `2022-04-04`	3 months	crt.sh
*.e-planning.net R3	`2021-12-30` - `2022-03-30`	3 months	crt.sh
*.audrte.com Amazon	`2021-01-26` - `2022-02-24`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
onetag-sys.com R3	`2021-11-02` - `2022-01-31`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-28` - `2022-12-29`	a year	crt.sh
*.v.fwmrm.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-29` - `2022-12-30`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh
*.richaudience.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-03-17` - `2022-03-16`	a year	crt.sh
widespace.com R3	`2021-11-01` - `2022-01-30`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2021-04-29` - `2022-05-31`	a year	crt.sh
js.cookieless-data.com R3	`2021-12-08` - `2022-03-08`	3 months	crt.sh
*.sitescout.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2021-12-15` - `2023-01-15`	a year	crt.sh

This page contains 26 frames:

Primary Page: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Frame ID: 33E4325A68197BDAA0A1D1148A50FAE8
Requests: 140 HTTP requests in this frame

Frame: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Frame ID: 19037AE3255CE2C836370BE44F364930
Requests: 21 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto&display=swap
Frame ID: 8DEFF3C18A38660E87B2393C110D2573
Requests: 7 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Frame ID: 72AE9256A13B231E3A41470D437998B8
Requests: 2 HTTP requests in this frame

Frame: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=94&advUuid=60f72c06-71d5-11ec-807c-18b2794d0506
Frame ID: D2EAF95963D7511193ED48451C8285AA
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D98%26advUuid%3D
Frame ID: 503B39DD3850B80583C699AB8E2AD7CD
Requests: 1 HTTP requests in this frame

Frame: https://s.console.adtarget.com.tr/sync.html?aid=556966
Frame ID: FA22A3E3B5C112B36BB496990AC51C26
Requests: 2 HTTP requests in this frame

Frame: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Frame ID: 10968103EE45FC5F48F335CFF55AA17F
Requests: 5 HTTP requests in this frame

Frame: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Frame ID: EE3187CE0D2A0C13BB3A971501774EEE
Requests: 1 HTTP requests in this frame

Frame: https://cdn.admatic.com.tr/user
Frame ID: BE0B47AB6A11855AC5B2EFAB16E438FF
Requests: 6 HTTP requests in this frame

Frame: https://sync.console.adtarget.com.tr/csync?t=a&ep=502624&extuid=${USER_ID}
Frame ID: 3A553341C1DCD48423ABB202038F91D8
Requests: 1 HTTP requests in this frame

Frame: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=XO4ac5hsBnamB2x1KaAv&pi=admatic&tc=1
Frame ID: B350DBAA7DF87E9E55FCA0378FA54B90
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Frame ID: DF750ACBEC5E27D3D1F5C158FDD61FF1
Requests: 13 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D
Frame ID: 1B001216B2F3E1C968734D4609D798F9
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
Frame ID: 7FBB744D515EBCCEC5D929C0D77BE48A
Requests: 4 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D8e205aefdc17fe5e%26uid%3D
Frame ID: 117EB8BFBCCAB833392DF046C733F739
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.494.0_en.html
Frame ID: 34591700762C7ED2B1F133BFD5BF2B12
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 9E12938E6C6A5306509D68C613E98768
Requests: 1 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/2tetedh/g27akpq/iframe
Frame ID: D0B2F2D2220FB6E2BD851065051C7191
Requests: 2 HTTP requests in this frame

Frame: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Frame ID: A7E73861D6E44EF7951C43AC4ED3D1E3
Requests: 11 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Frame ID: 382451231B143823BBBDBAB1F2E9C0EA
Requests: 1 HTTP requests in this frame

Frame: https://spl.zeotap.com/cmp?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&cmp=0
Frame ID: 4F3897274A18FC0554FBD8B96600C1DE
Requests: 29 HTTP requests in this frame

Frame: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Frame ID: 7CCBC25C2A6809890C485D0CBC19ED07
Requests: 2 HTTP requests in this frame

Frame: https://sync.console.adtarget.com.tr/csync?t=a&ep=307442&extuid=AJzm8orJKJ6cyz8t
Frame ID: F91B8D30A92BE7D695E8D0BCB0457FFE
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156595&gdpr=1&gdpr_consent=
Frame ID: 2D65D355B226BF3F3E7864FCDE93BC0C
Requests: 1 HTTP requests in this frame

Frame: https://bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/rt=ifr
Frame ID: F2E3D6F799B1FC700C9C6B3C4480CBC4
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Has Corpse Husband ever shown his face? We investigate - WIN.gg

Page URL History Show full URLs

https://win.gg/news/7999/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate HTTP 301
https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Oribi (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.oribi\.io

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

264
Requests

83 %
HTTPS

28 %
IPv6

70
Domains

109
Subdomains

73
IPs

15
Countries

7034 kB
Transfer

11256 kB
Size

88
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-direct&deeplink=/en/esports/

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:fc257edd-8ba3-4ec1-add1-0bc17b7c32c3
Title: Dota 2 - DPC CN 2021/22 Tour 1: Division I

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:3a26322b-c673-4917-b78c-3dc2c437fa6d
Title: Dota 2 - DPC CN 2021/22 Tour 1: Division I. Duel of Players. The Kills

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:23b0f46d-da2e-4699-b8f0-f45cc1f4a3ba
Title: Dota 2 - DPC CN 2021/22 Tour 1: Division I. Duel of Players. The Kills

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:a9ffe704-7865-4ead-b639-2a8713b09910
Title: Dota 2 - QH Sports Dota Series 3

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:6cfa0651-ce74-4ddb-8a5d-7274c92ac39a
Title: Dota 2 - DPC SEA 2021/22 Tour 1: Division II

Search URL Search Domain Scan URL

URL: https://twitter.com/Corpse_Husband/status/1205235849438171136?ref_src=twsrc%5Etfw
Title: December 12, 2019

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:ec94dc48-2197-4630-9922-f3f92c1b416e
Title: LoL - LCK Challenger 2022 Spring Fredit BRION Challengers LIVE jQuery(function($) { $(window).load(function() { const formatDate = function(date) { if (!date) { return; } let localDate = new Date(date); function addHoursToDate(date, hours) { return new Date(new Date(date) .setHours( date.getHours() + hours)); } const offset = localDate .getTimezoneOffset() / 60; if (offset < 0) { localDate = addHoursToDate( localDate, (offset * Math.sign( offset))); } else if (offset > 0) { localDate = addHoursToDate( localDate, ( offset * -1)) } else { localDate = addHoursToDate( localDate, offset); } const options = { hour: '2-digit', minute: '2-digit', month: 'short', day: 'numeric' }; const localDay = localDate .toLocaleDateString(undefined, options); const stringArr = localDay.split( ','); const elmnt = window.document .getElementById( '5:ec94dc48-2197-4630-9922-f3f92c1b416e' ); elmnt.innerHTML = `${stringArr[0]} ${stringArr[1]}` } const d = ' 2022-01-10 08:00:00' formatDate(d); }); }); Winner Nongshim RedForce Challengers 2.25 VS 1.60

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:31ee49ff-3a65-48e1-b598-cd59f93ae169
Title: LoL - LPL 2022 Spring Oh My God LIVE jQuery(function($) { $(window).load(function() { const formatDate = function(date) { if (!date) { return; } let localDate = new Date(date); function addHoursToDate(date, hours) { return new Date(new Date(date) .setHours( date.getHours() + hours)); } const offset = localDate .getTimezoneOffset() / 60; if (offset < 0) { localDate = addHoursToDate( localDate, (offset * Math.sign( offset))); } else if (offset > 0) { localDate = addHoursToDate( localDate, ( offset * -1)) } else { localDate = addHoursToDate( localDate, offset); } const options = { hour: '2-digit', minute: '2-digit', month: 'short', day: 'numeric' }; const localDay = localDate .toLocaleDateString(undefined, options); const stringArr = localDay.split( ','); const elmnt = window.document .getElementById( '5:31ee49ff-3a65-48e1-b598-cd59f93ae169' ); elmnt.innerHTML = `${stringArr[0]} ${stringArr[1]}` } const d = ' 2022-01-10 09:00:00' formatDate(d); }); }); Winner ThunderTalk Gaming 1.28 VS 3.52

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:b3bb8325-97e2-47aa-ab1e-2de7e8347e40
Title: LoL - LCK Challenger 2022 Spring T1 Challengers LIVE jQuery(function($) { $(window).load(function() { const formatDate = function(date) { if (!date) { return; } let localDate = new Date(date); function addHoursToDate(date, hours) { return new Date(new Date(date) .setHours( date.getHours() + hours)); } const offset = localDate .getTimezoneOffset() / 60; if (offset < 0) { localDate = addHoursToDate( localDate, (offset * Math.sign( offset))); } else if (offset > 0) { localDate = addHoursToDate( localDate, ( offset * -1)) } else { localDate = addHoursToDate( localDate, offset); } const options = { hour: '2-digit', minute: '2-digit', month: 'short', day: 'numeric' }; const localDay = localDate .toLocaleDateString(undefined, options); const stringArr = localDay.split( ','); const elmnt = window.document .getElementById( '5:b3bb8325-97e2-47aa-ab1e-2de7e8347e40' ); elmnt.innerHTML = `${stringArr[0]} ${stringArr[1]}` } const d = ' 2022-01-10 09:00:00' formatDate(d); }); }); Winner Liiv SANDBOX Challengers 1.64 VS 2.17

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:fcaeba2c-3604-4cbf-8437-879c9c6e625d
Title: LoL - LCK Challenger 2022 Spring KT Rolster Challengers LIVE jQuery(function($) { $(window).load(function() { const formatDate = function(date) { if (!date) { return; } let localDate = new Date(date); function addHoursToDate(date, hours) { return new Date(new Date(date) .setHours( date.getHours() + hours)); } const offset = localDate .getTimezoneOffset() / 60; if (offset < 0) { localDate = addHoursToDate( localDate, (offset * Math.sign( offset))); } else if (offset > 0) { localDate = addHoursToDate( localDate, ( offset * -1)) } else { localDate = addHoursToDate( localDate, offset); } const options = { hour: '2-digit', minute: '2-digit', month: 'short', day: 'numeric' }; const localDay = localDate .toLocaleDateString(undefined, options); const stringArr = localDay.split( ','); const elmnt = window.document .getElementById( '5:fcaeba2c-3604-4cbf-8437-879c9c6e625d' ); elmnt.innerHTML = `${stringArr[0]} ${stringArr[1]}` } const d = ' 2022-01-10 10:00:00' formatDate(d); }); }); Winner Gen.G Challengers 1.79 VS 1.96

Search URL Search Domain Scan URL

URL: https://mercurybest.com/gg/gb/?lp=00&param=win_ww-sb-odds&deeplink=/en/esports/match/5:2c37b244-d6d8-4a8a-8910-235dc6790449
Title: LoL - LPL 2022 Spring Royal Never Give Up LIVE jQuery(function($) { $(window).load(function() { const formatDate = function(date) { if (!date) { return; } let localDate = new Date(date); function addHoursToDate(date, hours) { return new Date(new Date(date) .setHours( date.getHours() + hours)); } const offset = localDate .getTimezoneOffset() / 60; if (offset < 0) { localDate = addHoursToDate( localDate, (offset * Math.sign( offset))); } else if (offset > 0) { localDate = addHoursToDate( localDate, ( offset * -1)) } else { localDate = addHoursToDate( localDate, offset); } const options = { hour: '2-digit', minute: '2-digit', month: 'short', day: 'numeric' }; const localDay = localDate .toLocaleDateString(undefined, options); const stringArr = localDay.split( ','); const elmnt = window.document .getElementById( '5:2c37b244-d6d8-4a8a-8910-235dc6790449' ); elmnt.innerHTML = `${stringArr[0]} ${stringArr[1]}` } const d = ' 2022-01-10 11:00:00' formatDate(d); }); }); Winner FunPlus Phoenix 1.65 VS 2.18

Search URL Search Domain Scan URL

URL: https://winners.net/

Search URL Search Domain Scan URL

URL: https://winners.bet/

Search URL Search Domain Scan URL

URL: http://youtube.com/c/wingg

Search URL Search Domain Scan URL

URL: https://www.instagram.com/officialwingg/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/officialWINgg/

Search URL Search Domain Scan URL

URL: https://twitter.com/officialWINgg

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://win.gg/news/7999/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate HTTP 301
https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

https://d33whie8snbuur.cloudfront.net/popupPlugin.min.js HTTP 301
https://web-chat-plugin.picogp.com/popupPlugin.min.js

Request Chain 116

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID&__user_check__=1&sync_id=60f72c5c-71d5-11ec-807c-18b2794d0506 HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=94&advUuid=60f72c06-71d5-11ec-807c-18b2794d0506

Request Chain 130

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D HTTP 307
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=93&advUuid=fb8fbb44-1793-40cc-bffb-e814dd17acd0

Request Chain 131

https://ssum-sec.casalemedia.com/usermatchredir?s=192962&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D99%26advUuid%3D HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D99%26advUuid%3D&s=192962&C=1 HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=99&advUuid=YdvCtaXa6ysJGwbjj1inVwAAByIAAAIB

Request Chain 132

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26mi%3D10%26dpi%3D259151345%26pcid%3D%24UID%26advId%3D121%26advUuid%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=1&cmp_cs=&us_privacy=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26mi%3D10%26dpi%3D259151345%26pcid%3D%24UID%26advId%3D121%26advUuid%3D%24UID HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&pixel=https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=259151345&pcid=17410188347599961048&advId=121&advUuid=17410188347599961048 HTTP 301
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20

Request Chain 134

https://secure.adnxs.com/getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D105%26advUuid%3D%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Flive.primis.tech%252Flive%252FliveCS.php%253Fsource%253Dexternal%2526csuuid%253D61dbc2b46b775%2526pixel%253D%2526advId%253D105%2526advUuid%253D%2524UID HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=105&advUuid=7764980466689436379

Request Chain 139

https://d33whie8snbuur.cloudfront.net/popupPlugin.min.css HTTP 301
https://web-chat-plugin.picogp.com/popupPlugin.min.css

Request Chain 161

https://creativecdn.com/cm-notify?pi=admatic HTTP 302
https://creativecdn.com/cm-notify?pi=admatic&tc=1 HTTP 302
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=XO4ac5hsBnamB2x1KaAv&pi=admatic&tc=1

Request Chain 162

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID HTTP 302
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

Request Chain 166

https://cs.choozle.com/dp/chz/24899?d=win.gg&cb=1467014941 HTTP 302
https://cs.choozle.com/sync HTTP 302
https://cs.choozle.com/sync?v=true&cid=bc7464c1-08cd-4dc3-99f7-9986072b031e HTTP 302
https://tags.bluekai.com/site/48443?id=bc7464c1-08cd-4dc3-99f7-9986072b031e&limit=1&redir=https%3A%2F%2Fcs.choozle.com%2Fsync%3Fpid%3D%24_BK_UUID%26dpsync%3Dbk%26cid%3Dbc7464c1-08cd-4dc3-99f7-9986072b031e HTTP 302
https://cs.choozle.com/sync?pid=$_BK_UUID&dpsync=bk&cid=bc7464c1-08cd-4dc3-99f7-9986072b031e HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_puid=bc7464c1-08cd-4dc3-99f7-9986072b031e&ttd_pid=gdmv7qs&ttd_tpi=1 HTTP 302
https://cs.choozle.com/sync?pid=2351059f-09cc-4d11-a82c-70bde096ba49&dpsync=ttd&cid=bc7464c1-08cd-4dc3-99f7-9986072b031e HTTP 302
https://idsync.rlcdn.com/459489.gif?partner_uid=bc7464c1-08cd-4dc3-99f7-9986072b031e HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=COGFHBIwCiwIARCp7AEaJGJjNzQ2NGMxLTA4Y2QtNGRjMy05OWY3LTk5ODYwNzJiMDMxZRAAGg0ItoXvjgYSBQjoBxAAQgBKAA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm=&google_tc= HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEH3NOoSj1Pt1Y9aj2El-wKI&google_cver=1

Request Chain 170

https://ih.adscale.de/uu?cbfn=receive&t=1641792181 HTTP 302
https://ih.adscale.de/uu?cbfn=receive&t=1641792181&nut&uu=b1d7933e98dd4ef98586e051b891600d

Request Chain 172

https://pixel.sitescout.com/dmp/pixelSync?network=EPLANNING&rurl=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D%7BUSER_ID%7D%26dc%3D0abbcb4eba840e59%26fi%3D8e205aefdc17fe5e HTTP 302
https://u-ams02.e-planning.net/um?uid=no-consent&dc=0abbcb4eba840e59&fi=8e205aefdc17fe5e

Request Chain 177

https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=25BiP9IMgN&r=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D[PDID]%26dc%3Dfabfd6762b833237%26fi%3D8e205aefdc17fe5e HTTP 302
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F

Request Chain 178

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3D8e205aefdc17fe5e%26uid%3D%24UID HTTP 302
https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=8e205aefdc17fe5e&uid=7764980466689436379

Request Chain 179

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=12186&endpoint=eu HTTP 301
https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu

Request Chain 188

https://insight.adsrvr.org/tags/2tetedh/g27akpq/iframe HTTP 303
https://d1eoo1tco6rr5e.cloudfront.net/2tetedh/g27akpq/iframe

Request Chain 197

https://bbnaut.ibillboard.com/match/AdScale?partneruid=b1d7933e98dd4ef98586e051b891600d&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg%3Ftpid%3D101%26tpuid%3DIBB_USER_ID&gdpr=0 HTTP 302
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=101&tpuid=BBID-01-03165061816685748-16495416

Request Chain 202

https://pixel.tapad.com/idsync/ex/push?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://pixel.tapad.com/idsync/ex/push/check?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=ada82a20-5acb-4151-824f-24c65ea74790&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 204

https://match.adsrvr.org/track/cmf/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=2351059f-09cc-4d11-a82c-70bde096ba49&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 208

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=d16ec5e9-ebae-402e-4312-5e26fde56cae&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=199624&dpuuid=d16ec5e9-ebae-402e-4312-5e26fde56cae&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=78044285237347154821385584713144225103&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 209

https://loadeu.exelator.com/load/?p=709&g=008&j=0&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://loadeu.exelator.com/load/?p=709&g=008&j=0&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&xl8blockcheck=1 HTTP 302
https://mwzeom.zeotap.com/mw?cid=72f76f09f3b5b44d43db9b7e57cbc327&zpartnerid=7&zdid=1361&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&w_k=&user_zi=&gdpr=&gdpr_consent=&optin=&uc=&z_p=&zem1=&zem2=&zem3=&zem4=&zem5=&zem6=&zph1=&zph2=&zph3=&zph4=&zph5=&zph6=&z_e_sha2_l=&z_e_sha2_u=&z_p_sha2_w=&z_p_sha2_wo=&email_hash=&zcluid=

Request Chain 210

https://bn01.er.bemail.it/zeotap.php?_bid=d16ec5e9-ebae-402e-4312-5e26fde56cae&_from=Zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=BE1-2022011006-60112-0.194072001641792172-960b583235d7f6d8ace35147aa7b9a7f&zdid=533&env=mWeb

Request Chain 211

https://pixel.tapad.com/idsync/ex/receive?partner_id=2885&partner_device_id=d16ec5e9-ebae-402e-4312-5e26fde56cae HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=d16ec5e9-ebae-402e-4312-5e26fde56cae

Request Chain 212

https://idsync.frontend.weborama.fr/ids?key=zeotap&value=d16ec5e9-ebae-402e-4312-5e26fde56cae&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://idsync.frontend.weborama.fr/ids?key=zeotap&value=d16ec5e9-ebae-402e-4312-5e26fde56cae&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361&bounce=1&random=4177194455 HTTP 302
https://mwzeom.zeotap.com/mw?webouuid=xhZmuFJqH2pkXTcFFY0qJu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 213

https://bcp.crwdcntrl.net/map/c=13620/tp=ZEOT/tpid=d16ec5e9-ebae-402e-4312-5e26fde56cae?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=13620/tp=ZEOT/tpid=d16ec5e9-ebae-402e-4312-5e26fde56cae?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://mwzeom.zeotap.com/mw?pid=24c634d4f9eb9f38cb25da32b48fe571&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 214

https://cms.analytics.yahoo.com/cms?partner_id=ZTAP HTTP 302
https://mwzeom.zeotap.com/mw?cid=y-mgeb6vBE2oqq0dNw1pVmlev1Vt3bS1yoXQ--~A&zpartnerid=570&env=mWeb

Request Chain 215

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=ITA&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=ITA&zdid=1361&cid=%2BNYx%2F0Q5zD6ficY64NvmAPD%2BCp3yIbxc%2BS41iYitP1U%3D

Request Chain 219

https://sync-tm.everesttech.net/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361&_test=YdvCtQAEeLBx3gAm HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=YdvCtQAEeLBx3gAm&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&_test=YdvCtQAEeLBx3gAm

Request Chain 220

https://pixel.mathtag.com/sync/img?mt_exid=10092&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%5BMM_UUID%5D%26env%3DmWeb%26zpartnerid%3D979%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=59aa61db-c2b5-4b00-abd1-63acfd497820&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 222

https://usermatch.krxd.net/um/v2?partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 223

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&dcc=t

Request Chain 224

https://tags.bluekai.com/site/87734?id=d16ec5e9-ebae-402e-4312-5e26fde56cae&gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1202%26env%3DmWeb%26cid%3D%24_BK_UUID%26BK_SWAP_DEST%3D87734&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=1202&env=mWeb&cid=$_BK_UUID&BK_SWAP_DEST=87734

Request Chain 225

https://obgpm76tt0a0sgozk8l.redinuid.imrworldwide.com/zeo?url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1395%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Request Chain 228

https://ssum.casalemedia.com/usermatchredir?s=183592&cb=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D63%26tpuid%3D__UID__&uid=da8cb481013ccbd68dcc6815bc904aabc5d2295baffc8351af9b8723b06638df&tpid=63&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YdvCtaXa6ysJGwbjj1inVwAA%261826

Request Chain 235

https://track.adform.net/serving/cookie/match/?party=9&uid=3071e27845d08a4e5e5c6785476472def62edc3b9bcd183f48f19419d6f92383&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg&gdpr=0 HTTP 302
https://track.adform.net/serving/cookie/match/?CC=1&party=9&uid=3071e27845d08a4e5e5c6785476472def62edc3b9bcd183f48f19419d6f92383&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=42&gdpr=0&tpuid=7049873714552798363

Request Chain 237

https://dis.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%40%40&uid=bc715229f48d8785f79b30766aa83af2db2f6c6b9eebf733e7b663eb3d3a0140&tpid=40&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg&gdpr=0 HTTP 302
https://widget.eu.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%40%40&uid=bc715229f48d8785f79b30766aa83af2db2f6c6b9eebf733e7b663eb3d3a0140&tpid=40&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=20836669-f583-457c-be50-0c79df1a53f7&gdpr=0

Request Chain 241

https://dmp.adform.net/serving/cookie/match/?party=1003&gdpr=0&gdpr_consent= HTTP 302
https://a.audrte.com/a?adform_uid=7049873714552798363 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent=&google_gid=CAESEGuyQ6MA4236CSPYC_bVpvg&google_cver=1 HTTP 302
https://ps.eyeota.net/match?bid=kh51m51&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=

Request Chain 242

https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm=&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=&google_gid=CAESEGuyQ6MA4236CSPYC_bVpvg&google_cver=1 HTTP 302
https://a.audrte.com/p

Request Chain 243

https://ps.eyeota.net/pixel?pid=kh51m51&t=ajs&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent= HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=kh51m51&t=ajs&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=

Request Chain 244

https://x.bidswitch.net/sync?ssp=admatic HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=admatic HTTP 302
https://ads.betweendigital.com/match?bidder_id=43092&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dadmatic%26expires%3D30%26user_group%3D%24%7BUSER_GROUP%7D HTTP 302
https://ads.betweendigital.com/match?bidder_id=43092&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dadmatic%26expires%3D30%26user_group%3D%24%7BUSER_GROUP%7D&crf=1 HTTP 302
https://x.bidswitch.net/sync?dsp_id=429&user_id=9a1ef089-68c8-510a-a29a-d009c34112bf&ssp=admatic&expires=30&user_group=1 HTTP 302
https://ads4.admatic.com.tr/showad/px/ums/sync/bsw?bsw_uuid=5c25e14b-061a-4e20-9ea1-2f4a2758e2b6&dsp_uuid=&dsp_id= HTTP 302
https://ads3.admatic.com.tr/user?bsw_uuid=5c25e14b-061a-4e20-9ea1-2f4a2758e2b6&dsp_uuid=&dsp_id=

Request Chain 247

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D39%26tpuid%3D%5BMM_UUID%5D&uid=c754aee7295d6eec54c35002602e614222b5e4e2ae2aa0afb7710746429dc622&tpid=39&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=59aa61db-c2b5-4b00-abd1-63acfd497820&gdpr=0&gdpr_consent=

Request Chain 248

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&uid=45d57485ab1bb7771b369a951544591df00b2d501b7b3abc2439b9b9487cc91c&tpid=38&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg&gdpr=0 HTTP 302
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?uid=45d57485ab1bb7771b369a951544591df00b2d501b7b3abc2439b9b9487cc91c&tpid=38&gdpr=0&tpuid=CAESEMLrAcGFEcd7WkXZWD6SJa8&google_cver=1

Request Chain 249

https://adscale-emea.adnxs.com/getuid?https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg%3Ftpid%3D75%26tpuid%3D%24UID&gdpr=0 HTTP 302
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=75&tpuid=7764980466689436379&gdpr=0

Request Chain 250

https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=ab7cc45d6e217efe8beba602076e242d8c19ebc71a557557b0cdbe89e831e8ff&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fjs&gdpr=0 HTTP 302
https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=ab7cc45d6e217efe8beba602076e242d8c19ebc71a557557b0cdbe89e831e8ff&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fjs&gdpr=0&checkcookies=true HTTP 302
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/js?tpid=48&tpuid=ab851939966e9c83dd9aded20890c2f0

Request Chain 255

https://dpm.demdex.net/ibs:dpid=121998&dpuuid=24c634d4f9eb9f38cb25da32b48fe571&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUID%7D HTTP 302
https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=78044285237347154821385584713144225103

Request Chain 256

https://sync-tm.everesttech.net/upi/pid/bsTd8NdE?redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1811%2Ftp%3DTBMG%2Ftpid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YdvCtQAEeLBx3gAm

Request Chain 258

https://sync.mathtag.com/sync/img?sync=auto&mt_exid=10040&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D4735%26tp%3DMDMA%26tpid%3D%5BMM_UUID%5D HTTP 302
https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=59aa61db-c2b5-4b00-abd1-63acfd497820

264 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Redirect Chain

https://win.gg/news/7999/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate
https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

460 KB
65 KB

103ms
103ms

Document
text/html

18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ddb5452a183196c93e848f0017abef2a1184277fe8a61b87bcf1369d4a10e753

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9

Response headers

age: 15
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 10 Jan 2022 05:23:00 GMT
display: pub_site_sol
expires: Sun, 09 Jan 2022 05:23:00 GMT
link: <https://win.gg/wp-json/>; rel="https://api.w.org/", <https://win.gg/wp-json/wp/v2/news/10337>; rel="alternate"; type="application/json", <https://win.gg/?p=10337>; rel=shortlink
pagespeed: off
response: 200
server: nginx
strict-transport-security: max-age=300
traceparent: 00-876cbe8826b64720ae976b2cc7be9026-07b36666a19f1cda-00
vary: Accept-Encoding Accept-Encoding,User-Agent
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, MISS
x-cache-hits: 1, 0
x-cloud-trace-context: 876cbe8826b64720ae976b2cc7be9026/554899770080959706;o=0
x-ezoic-cdn: Hit ds;mm;6ad8b3114e326fd0cc2833493230fc7e;2-255604-102;eec6ab43-29f8-42b1-401a-2b9fc6f06f12
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-origin-cache-control: public, max-age=600
x-pantheon-styx-hostname: styx-fe3fe4-d-79b8dbf6c8-s2m6p
x-served-by: cache-ams21075-AMS, cache-hhn4065-HHN
x-sol: pub_site
x-styx-req-id: ef3b6325-71d2-11ec-abef-2268baa4cde5
x-timer: S1641791146.053652,VS0,VE10

Redirect headers

age: 0
cache-control: public, max-age=1800
content-type: text/html; charset=UTF-8
date: Mon, 10 Jan 2022 05:23:00 GMT
display: staticcontent_sol
location: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
pagespeed: off
response: 301
server: nginx
strict-transport-security: max-age=300
traceparent: 00-7b74c0e5fafa482aa44fef026365a08f-8a6e1361caadfa57-00
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-cloud-trace-context: 7b74c0e5fafa482aa44fef026365a08f/9974931535405382231;o=0
x-ezoic-cdn: Hit ds;mm;18b1b6eb525378bd574c10810be13c7a;2-255604-102;b0be5841-e5ef-4e06-405d-e34717d9991c
x-middleton-display: staticcontent_sol
x-middleton-response: 301
x-origin-cache-control: no-cache, must-revalidate, max-age=0
x-pantheon-styx-hostname: styx-fe3fe4-d-79b8dbf6c8-s2m6p
x-redirect-by: WordPress
x-served-by: cache-ams12734-AMS, cache-fra19143-FRA
x-sol: pub_site
x-styx-req-id: f7f56adc-71d2-11ec-abef-2268baa4cde5
x-timer: S1641791146.869532,VS0,VE124
content-length: 0

GET
H2 200 index.css
win.gg/wp-content/themes/win/css/ 167 KB
23 KB 51ms
50ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/css/index.css?v=1.5.9

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

0f0ed4587f01973cf025b4bfc4dfdbb1dbabf8d4c0d3a01e67f65ef9c887970f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61cfad33-29d64-gzip"
x-sol: orig
age: 731437
x-ezoic-cdn: Hit ds;mm;051fb6117f6a0b847ed0ff8c33d8ca9e;2-255604-102;a0f43cc3-e42e-422d-5afb-1adefaad4ca7
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
x-served-by: cache-ams21034-AMS, cache-hhn4043-HHN
response: 200
last-modified: Sat, 01 Jan 2022 01:24:03 GMT
server: nginx
x-timer: S1641790783.083484,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 1d25776b-6b2b-11ec-acdb-663326ca7806
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 custom-styles.css
win.gg/wp-content/themes/win/css/ 2 KB
1 KB 39ms
38ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/css/custom-styles.css?v=1.1.1

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

81a319202c5a41a82b4a1e0172a87b35172b463467c66ba5feda41ec36ce2cc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61af950b-8bd-gzip"
x-sol: orig
age: 2788513
x-ezoic-cdn: Hit ds;mm;8361ae898528dceb63e038a4fc26ac6f;2-255604-102;57fb68f0-239d-4cc4-6189-c408b3bd8d40
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 2
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 683
x-served-by: cache-ams12735-AMS, cache-hhn4083-HHN
response: 200
last-modified: Tue, 07 Dec 2021 17:08:27 GMT
server: nginx
x-timer: S1641791146.232358,VS0,VE0
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74b1aaf5-5876-11ec-a10a-2e5155d624aa
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 banger.js Show response
win.gg/porpoiseant/ 53 KB
12 KB 33ms
31ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://win.gg/porpoiseant/banger.js?cb=195-0&bv=94&v=57&PageSpeed=off
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 04f6dd8dfbc09c92d792a22327a61239ce45948be46f4fc3f9d9c881aef2495b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 style.min.css
win.gg/wp-includes/css/dist/block-library/ 79 KB
10 KB 50ms
49ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61cfad33-13abe-gzip"
x-sol: orig
age: 731459
x-ezoic-cdn: Hit ds;mm;7a24adc887cf2bd44b73a823c49faf60;2-255604-102;92b17369-a489-45e1-51e8-f9f144be3bd0
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
x-served-by: cache-ams12779-AMS, cache-hhn4080-HHN
response: 200
last-modified: Sat, 01 Jan 2022 01:24:03 GMT
server: nginx
x-timer: S1641790805.202349,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 1d256551-6b2b-11ec-a10a-2e5155d624aa
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 blocks.style.build.css
win.gg/wp-content/plugins/embedpress/Gutenberg/dist/ 2 KB
781 B 33ms
32ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/embedpress/Gutenberg/dist/blocks.style.build.css?ver=1641675182

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e0c0c0b607dcddedcb101ac6487d7b5c321a984e25d19bbd24337e7a9b1d6c22

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61d8ac19-614-gzip"
x-sol: orig
age: 115581
x-ezoic-cdn: Hit ds;mm;058a59d16e70d8233332a00cba72881d;2-255604-102;2ac6a059-fb7c-434d-5342-1e72b9689f87
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 413
x-served-by: cache-ams12772-AMS, cache-hhn4046-HHN
response: 200
last-modified: Fri, 07 Jan 2022 21:09:45 GMT
server: nginx
traceparent: 00-e0c587df36c148609af4b996a9e4bdbc-59127d4ed3419ebb-00
x-timer: S1641790783.086503,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
x-cloud-trace-context: e0c587df36c148609af4b996a9e4bdbc/6418330196461592251;o=0
cache-control: public, max-age=1800
x-styx-req-id: 03eb3c34-70c5-11ec-ac1a-a2108af4b226
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-ccc8c45c8-hgz2w

GET
H2 200 dashicons.min.css
win.gg/wp-includes/css/ 58 KB
35 KB 51ms
50ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-includes/css/dashicons.min.css?ver=5.8.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61cfdab0-e688-gzip"
x-sol: orig
age: 641616
x-ezoic-cdn: Hit ds;mm;6b9595f95157eaab447126199ea57abe;2-255604-102;8093ba77-3b24-4ffb-7ec4-ac8253d00550
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
x-served-by: cache-ams21025-AMS, cache-hhn4023-HHN
response: 200
last-modified: Sat, 01 Jan 2022 04:38:08 GMT
server: nginx
x-timer: S1641791313.220552,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 7ad4c57e-6bfd-11ec-acdb-663326ca7806
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 rounded-thumbs.min.css
win.gg/wp-content/plugins/contextual-related-posts/css/ 1 KB
582 B 38ms
36ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/contextual-related-posts/css/rounded-thumbs.min.css?ver=1.0.1

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

0ca7188912ef3473bb7943356daf3909fb28acf076110495dd4eff399334fe70

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b122b0-4a9-gzip"
x-sol: orig
age: 2788816
x-ezoic-cdn: Hit ds;mm;d998c94939bb5942280b9358bc81d234;2-255604-102;a92b09fa-bcbe-4f1e-6702-ec0dcdc75f86
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 339
x-served-by: cache-ams12725-AMS, cache-hhn4049-HHN
response: 200
last-modified: Wed, 08 Dec 2021 21:25:04 GMT
server: nginx
x-timer: S1641791449.116498,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74b0f65e-5876-11ec-a10a-2e5155d624aa
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 embedpress.css
win.gg/wp-content/plugins/embedpress/assets/css/ 9 KB
2 KB 64ms
63ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/embedpress/assets/css/embedpress.css?ver=5.8.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

7940523b8dc250d607eb1c29860132762f634859ba03b88605b2e0a6591b34c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61c9a5d9-2397-gzip"
x-sol: orig
age: 1169857
x-ezoic-cdn: Hit ds;mm;fcb46c2729bf4dc218b0d2c034d1f5fe;2-255604-102;32f09a17-ae40-4e7a-5f5b-94294940035d
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 1986
x-served-by: cache-ams21081-AMS, cache-fra19174-FRA
response: 200
last-modified: Mon, 27 Dec 2021 11:39:05 GMT
server: nginx
x-timer: S1641790960.863618,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: c038409d-672e-11ec-b4f5-f6ae90fba23b
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-xsk8h

GET
H2 200 mu-style.css
win.gg/wp-content/plugins/sharethis-share-buttons/css/ 26 B
296 B 39ms
36ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/sharethis-share-buttons/css/mu-style.css?ver=5.8.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

f85e538e44687fc0feaa2f66a67831ec9f9b03446f115dec74b996da4a0a4a52

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b05a3c-1a-gzip"
x-sol: orig
age: 2788150
x-ezoic-cdn: Hit ds;mm;4961f7b5e85fc35c7aaa6ab6d605d287;2-255604-102;f5e91d14-e75c-4d06-4667-440a114ce1ca
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 30
x-served-by: cache-ams12768-AMS, cache-hhn4039-HHN
response: 200
last-modified: Wed, 08 Dec 2021 07:09:48 GMT
server: nginx
x-timer: S1641790783.085922,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74b1c4ae-5876-11ec-acdb-663326ca7806
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 win-gg-public.css
win.gg/wp-content/plugins/win-gg/public/css/ 98 B
401 B 75ms
73ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/win-gg/public/css/win-gg-public.css?ver=1.0.0

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61cc4fb3-62-gzip"
x-sol: orig
age: 980590
x-ezoic-cdn: Hit ds;mm;4ad16b3ce1ec8cca0416aaf40d44a1e4;2-255604-102;0de9b6ab-4d81-45c3-71de-251e2c4a762f
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 80
x-served-by: cache-ams12725-AMS, cache-hhn4069-HHN
response: 200
last-modified: Wed, 29 Dec 2021 12:08:19 GMT
server: nginx
x-timer: S1641791612.224140,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: f09f58c2-68e8-11ec-a10a-2e5155d624aa
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 style.css
win.gg/wp-content/themes/win/ 6 KB
2 KB 39ms
36ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/style.css?ver=1.0.0

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e81bc94621340a647972fd5fee0085a1ef67788c2fc010cd15e13f5920711d27

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61d164a9-16c8-gzip"
x-sol: orig
age: 633021
x-ezoic-cdn: Hit ds;mm;4aeda9832e2fea3b6684865acbd5e8e6;2-255604-102;dd019131-e5c4-48f5-65df-48a855e1b201
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol, orig_site_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 1584
x-served-by: cache-ams12736-AMS, cache-hhn4023-HHN
response: 200
last-modified: Sun, 02 Jan 2022 08:39:05 GMT
server: nginx
x-timer: S1641791313.220869,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 7d7e5573-6c11-11ec-bd88-9677aa3197bc
display: staticcontent_sol, orig_site_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-nwv88

GET
H2 200 pdfobject.min.js Show response
win.gg/wp-content/plugins/embedpress/assets/js/ 13 KB
4 KB 74ms
72ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/embedpress/assets/js/pdfobject.min.js?ver=3.2.1

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c1a86d7c11a5c83b82c7e6f814aff6286a9fe3483b8e0e2c16089370bad4676d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61af950b-34d3-gzip"
age: 2788327
x-ezoic-cdn: Hit ds;mm;df872bece1306577295992dda13f1b20;2-255604-102;4b43bba2-dc4c-4a63-76ab-ba7599a0e8d1
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 4088
x-served-by: cache-ams12771-AMS, cache-hhn4029-HHN
response: 200
last-modified: Tue, 07 Dec 2021 17:08:27 GMT
server: nginx
x-timer: S1641790960.869572,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74c7de59-5876-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 jquery.min.js Show response
win.gg/wp-includes/js/jquery/ 87 KB
30 KB 67ms
65ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61d3386e-15db1-gzip"
age: 433743
x-ezoic-cdn: Hit ds;mm;50d057da7aaf7d91656d68a151a7cca7;2-255604-102;b0b85b03-dec7-4f34-5529-9e5bc79dcaae
x-cache: MISS, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 0, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
x-served-by: cache-ams21059-AMS, cache-hhn4053-HHN
response: 200
last-modified: Mon, 03 Jan 2022 17:54:54 GMT
server: nginx
x-timer: S1641791524.607527,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: f60ba3eb-6de1-11ec-a997-eef33d940ff2
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-8lwkb

GET
H2 200 jquery-migrate.min.js Show response
win.gg/wp-includes/js/jquery/ 11 KB
4 KB 65ms
63ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b80dec-2bd8-gzip"
age: 2233165
x-ezoic-cdn: Hit ds;mm;7a11791901b6cd3c8ae1579f76ed157e;2-255604-102;d828c868-7ecc-4e04-6039-d5c7da233a30
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 3998
x-served-by: cache-ams21031-AMS, cache-fra19146-FRA
response: 200
last-modified: Tue, 14 Dec 2021 03:22:20 GMT
server: nginx
x-timer: S1641791524.660760,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 5b12a751-5d84-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 184 KB
41 KB 98ms
29ms Script
text/javascript 13.224.193.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.52 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-52.fra2.r.cloudfront.net

Software

Resource Hash

444ee2a405e57ede9ef10e17bb58c0351c39e9d21203f242b55a77fd07d30784

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:21:03 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 118
etag: W/"2df1b-sQ5Sn/JpfKxrQLYebTQ3d0yXV0s"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront)
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-amz-cf-pop: FRA2-C1
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: uw6w6uezug8F5WImCu9oWkjtGS7rYukoy1qc7j2U1l9hnE8KAwsapQ==

GET
H2 200 win-gg-public.js Show response
win.gg/wp-content/plugins/win-gg/public/js/ 838 B
695 B 72ms
71ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/win-gg/public/js/win-gg-public.js?ver=1.0.0

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61af2b4a-346-gzip"
age: 2788522
x-ezoic-cdn: Hit ds;mm;d1166ae83f155bbc2c21f0e958fbcb01;2-255604-102;58bdbd0d-6394-4073-4e62-35d225630dde
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 412
x-served-by: cache-ams21068-AMS, cache-hhn4022-HHN
response: 200
last-modified: Tue, 07 Dec 2021 09:37:14 GMT
server: nginx
x-timer: S1641791155.687585,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74cb4006-5876-11ec-b4f5-f6ae90fba23b
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-xsk8h

GET
H2 200 gtm4wp-youtube.js Show response
win.gg/wp-content/plugins/duracelltomi-google-tag-manager/js/ 7 KB
2 KB 65ms
64ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-youtube.js?ver=1.13.1

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

a83bf33080e6fd7aa375b48f11f4ac7b1a186d94a36af178e417cc00d6e09a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b21857-1c80-gzip"
age: 2641001
x-ezoic-cdn: Hit ds;mm;eb6bfb4df1d0db5e874c628b191330b1;2-255604-102;7f3be8a5-ae8c-41f9-72d9-08fb8326634c
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 6
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 1281
x-served-by: cache-ams12721-AMS, cache-hhn4077-HHN
response: 200
last-modified: Thu, 09 Dec 2021 14:53:11 GMT
server: nginx
x-timer: S1641791496.532503,VS0,VE0
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: b958815d-59ce-11ec-a10a-2e5155d624aa
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 analytics-talk-content-tracking.js Show response
win.gg/wp-content/plugins/duracelltomi-google-tag-manager/js/ 4 KB
1 KB 62ms
61ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/duracelltomi-google-tag-manager/js/analytics-talk-content-tracking.js?ver=1.13.1

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c983bccbfa3aeec262e4469747aaf9d860d93fedcf3ba263c84bd7ef21430234

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61ce7069-f16-gzip"
age: 742044
x-ezoic-cdn: Hit ds;mm;b98db409ddaa9dc76b68a7d82cbfcba8;2-255604-102;323691c2-68a1-4c8a-69d9-632dd9613c6d
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 1132
x-served-by: cache-ams21020-AMS, cache-hhn4022-HHN
response: 200
last-modified: Fri, 31 Dec 2021 02:52:25 GMT
server: nginx
x-timer: S1641791313.241432,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: a6cd841e-6b13-11ec-b4f5-f6ae90fba23b
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-xsk8h

GET
H2 200 wpp.min.js Show response
win.gg/wp-content/plugins/wordpress-popular-posts/assets/js/ 3 KB
1 KB 65ms
64ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.4.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ace4208545fb0ff5ea87fbe1470d3bf0af8e73d7d52fea869966c4b9d8c78a60

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b05a3c-bc3-gzip"
age: 2788433
x-ezoic-cdn: Hit ds;mm;549c00d922e8d6404fa2101e17aba8d1;2-255604-102;814016e0-a951-4d16-50a8-ddc42ee79030
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 1215
x-served-by: cache-ams12749-AMS, cache-hhn4047-HHN
response: 200
last-modified: Wed, 08 Dec 2021 07:09:48 GMT
server: nginx
x-timer: S1641791066.268054,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74c7fa3c-5876-11ec-a10a-2e5155d624aa
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 myloadmore.js Show response
win.gg/wp-content/themes/win/js/ 1 KB
776 B 48ms
47ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/js/myloadmore.js?ver=5.8.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c555bc295bb01f8cf5343bf7e338efa35182951447d9362a01ab618b31935ed4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b122b1-490-gzip"
age: 2789190
x-ezoic-cdn: Hit ds;mm;619273c511b78d219b271df8b8004e8f;2-255604-102;cea30e5f-fa18-4806-4728-68c0d3b29cc4
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 2, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 506
x-served-by: cache-ams21060-AMS, cache-hhn4051-HHN
response: 200
last-modified: Wed, 08 Dec 2021 21:25:05 GMT
server: nginx
x-timer: S1641791823.495376,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74c6f30a-5876-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 consentsettings.js Show response
win.gg/detroitchicago/ 1 KB
670 B 46ms
46ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://win.gg/detroitchicago/consentsettings.js?cb=2
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 383472db86bc19b822592340828e1a9d680ece8e6a5114eb4744351081fdea3c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
last-modified: Sun, 09 Jan 2022 09:11:18 GMT
server: nginx
etag: "5be-5d5229a585113;5c701b9c2cf40-gzip"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex
content-length: 525

GET
H2 200 liveView.php Show response
live.primis.tech/live/ 44 KB
12 KB 162ms
73ms Script
text/javascript 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d75fca707c4d336cac423247eb710c856d30ecd8b46ceb3e28dc35218381c38

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 89ms
26ms Script
text/javascript 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 20:11:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 378679
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Jan 2023 20:11:41 GMT

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/js/ 77 KB
23 KB 69ms
23ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/js/bootstrap.bundle.min.js

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://win.gg/
Origin: https://win.gg
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6597368
x-jsd-version: 5.0.1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19121-FRA, cache-mxp6979-MXP
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1339c-XbTEDbxr09liPumKIGHdJliFzy4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6cb37886dc933758-MXP

GET
H2 200 custom.js Show response
win.gg/wp-content/themes/win/js/ 2 KB
992 B 59ms
58ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/js/custom.js?ver=1

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cea9c3393f4b0a57475e38dbbff527aca7a3aa2d107b4b4742b937c2507e2063

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b02194-762-gzip"
age: 2789219
x-ezoic-cdn: Hit ds;mm;ca5a6afa4bd45676d088dc73fae68cc5;2-255604-102;c33a651c-ecd9-40a2-5f01-d7f03ab28894
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 707
x-served-by: cache-ams12781-AMS, cache-hhn4023-HHN
response: 200
last-modified: Wed, 08 Dec 2021 03:08:04 GMT
server: nginx
x-timer: S1641791852.498088,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74c8ac1f-5876-11ec-acdb-663326ca7806
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 app.js Show response
win.gg/wp-content/themes/win/js/ 2 KB
698 B 42ms
42ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/js/app.js?ver=1.0.4

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

935b2f1cdbf1af0439e86ecbd0ca09a2b3a91807ae651cf3f840f9237a45a667

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61af2b4a-718-gzip"
age: 2788892
x-ezoic-cdn: Hit ds;mm;bb0c8de94a1d9c208ce349ffedb8e213;2-255604-102;f9957c72-31cc-49cf-48b8-d9fc0713de05
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 411
x-served-by: cache-ams12751-AMS, cache-hhn4023-HHN
response: 200
last-modified: Tue, 07 Dec 2021 09:37:14 GMT
server: nginx
x-timer: S1641791525.860442,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74cb76b5-5876-11ec-acdb-663326ca7806
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 front.js Show response
win.gg/wp-content/plugins/embedpress/assets/js/ 2 KB
1 KB 57ms
57ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/plugins/embedpress/assets/js/front.js?ver=3.2.1

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

f62e11b110b6233da7f94fc6715e2d026d3dd3cc22fa394623ba16c9316fa8f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b21857-7bb-gzip"
age: 2640182
x-ezoic-cdn: Hit ds;mm;023c17ecc3422746f41ee0482784c7f2;2-255604-102;ab7c491a-c6dc-43f5-6fe4-37b2ff052e02
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 743
x-served-by: cache-ams12773-AMS, cache-hhn4049-HHN
response: 200
last-modified: Thu, 09 Dec 2021 14:53:11 GMT
server: nginx
x-timer: S1641790658.026639,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: adfc64fb-59ce-11ec-acdb-663326ca7806
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 navigation.js Show response
win.gg/wp-content/themes/win/js/ 3 KB
1 KB 67ms
67ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/js/navigation.js?ver=1.0.0

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

60e1017c6585464aa240b13f4074ab5ea100dcbdb72615124ff575bcc891a542

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61cb5a07-ba0-gzip"
age: 983544
x-ezoic-cdn: Hit ds;mm;cca13f525d9d477139ac577db149a09b;2-255604-102;8cd0835b-5565-463e-7de7-72470a5d9be6
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 933
x-served-by: cache-ams12734-AMS, cache-fra19177-FRA
response: 200
last-modified: Tue, 28 Dec 2021 18:40:07 GMT
server: nginx
x-timer: S1641791510.178718,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: d32ce9d3-68e1-11ec-a10a-2e5155d624aa
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 wp-embed.min.js Show response
win.gg/wp-includes/js/ 1 KB
905 B 58ms
57ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-includes/js/wp-embed.min.js?ver=5.8.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b3037b-592-gzip"
age: 2641305
x-ezoic-cdn: Hit ds;mm;00b60669f210d9d823f24b919fe23992;2-255604-102;3203abe4-093f-450f-48c4-d602cc9c0c5b
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 663
x-served-by: cache-ams21039-AMS, cache-hhn4069-HHN
response: 200
last-modified: Fri, 10 Dec 2021 07:36:27 GMT
server: nginx
x-timer: S1641791792.168651,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: b499448b-59ce-11ec-acdb-663326ca7806
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 ezcl.webp Show response
win.gg/utilcave_com/inc/ 1 KB
1 KB 34ms
32ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://win.gg/utilcave_com/inc/ezcl.webp?cb=4
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
x-sol: middleton
server: nginx
display: staticcontent_sol
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: max-age=86400
content-length: 605

GET
H2 200 wp-emoji-release.min.js Show response
win.gg/wp-includes/js/ 18 KB
5 KB 46ms
44ms Script
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61c0a0ae-4705-gzip"
age: 1776316
x-ezoic-cdn: Hit ds;mm;5365159454efb806c6d8bf4a4a129ab0;2-255604-102;365df495-fd15-4d9c-6362-2d34d5201e37
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
x-served-by: cache-ams12758-AMS, cache-fra19170-FRA
response: 200
last-modified: Mon, 20 Dec 2021 15:26:38 GMT
server: nginx
x-timer: S1641790529.787977,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: b98c58aa-61a9-11ec-bd88-9677aa3197bc
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-nwv88

GET
H2 200 60fa285f7c9b910013246b5d.js Show response
buttons-config.sharethis.com/js/ 1 KB
980 B 211ms
134ms Script
text/javascript 2600:9000:20eb:4800:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/60fa285f7c9b910013246b5d.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:4800:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1f5b6267968f60e8c5f023222caa8cfdd05574076c8ea3740894ef93fd4b8ba3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
etag: W/"b5b12554debecb814fc68e90517a2655"
last-modified: Mon, 11 Oct 2021 23:54:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/javascript
via: 1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control: public, max-age=60
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: WRn9xvJ2IxOIGLqc-bwNEnHR-nl8gWN0IHBYx6aCQKGsMUCJcCHf_A==

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
1 KB 102ms
42ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: win.gg
URL: https://win.gg/wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-youtube.js?ver=1.13.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2807db05f536fe45b16757ee0be3052e74fc954f23604d07c53889796adbbdab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=it for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="ATmXEA_aXV-idIZ-e5x1JSbJUg8hfAx2dSl3lQ"
expires: Mon, 10 Jan 2022 05:23:00 GMT

POST
H2 201 popular-posts Show response
win.gg/wp-json/wordpress-popular-posts/v1/ 55 B
781 B 180ms
180ms XHR
application/json 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-json/wordpress-popular-posts/v1/popular-posts

Requested by

Host: win.gg
URL: https://win.gg/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

1c5a0bc40bdeae5ff4d37d6995badbe167f35c1c260ca7af436e9baf37bb756f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
X-Requested-With: XMLHttpRequest
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

content-encoding: br
x-sol: pub_site
age: 0
x-pantheon-styx-hostname: styx-fe3fe4-c-ccc8c45c8-wkq9c
x-middleton-display: staticcontent_sol
strict-transport-security: max-age=300
x-served-by: cache-ams12738-AMS, cache-hhn4026-HHN
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
x-timer: S1641792180.396749,VS0,VE142
x-origin-cache-control: public, max-age=600
vary: Accept-Encoding, Origin,Accept-Encoding
access-control-allow-methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
content-type: application/json; charset=UTF-8
x-styx-req-id: 6095b123-71d5-11ec-bb6c-123717a32574
x-cloud-trace-context: 4c5fa34fed734de89e9c692a22b76479/10394290028633698539;o=0
cache-control: public, max-age=600
x-robots-tag: noindex
x-wp-nonce: 3afda80b03
x-cache-hits: 0, 0
date: Mon, 10 Jan 2022 05:23:00 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
access-control-allow-origin: https://win.gg
x-ezoic-cdn: Miss
x-cache: MISS, MISS
x-middleton-response: 201
content-length: 52
link: <https://win.gg/wp-json/>; rel="https://api.w.org/"
response: 201
server: nginx
traceparent: 00-4c5fa34fed734de89e9c692a22b76479-903fefb5b118b0eb-00
allow: GET, POST
access-control-allow-credentials: true
display: staticcontent_sol
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 136 KB
49 KB 99ms
38ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-598L2T6

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

67e07c07b9c0bef6d5881a58726edd701b442051638036348010fc7eefa0fecb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49421
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 10 Jan 2022 05:23:00 GMT

GET
H2 200 cmbv2.js Show response
win.gg/detroitchicago/ 41 KB
11 KB 36ms
35ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://win.gg/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y0b-5y0d-14y13-3y17-4y21-3&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x21&abt=PositionCalculator
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e1aeb63073df59e31194af5ba527e14162ecdd9617688b62294514dfbab3a8a5

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public, max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 1903 5 KB
2 KB 44ms
44ms Script
text/javascript 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: ea9cd43e87c14c06dafc0c2973b231d77b663805a04a63fc53ed1f0c9c9852e8

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H2

200

popupPlugin.min.js Show response
web-chat-plugin.picogp.com/
Redirect Chain

https://d33whie8snbuur.cloudfront.net/popupPlugin.min.js
https://web-chat-plugin.picogp.com/popupPlugin.min.js

11 KB
3 KB

181ms
50ms

Script
application/javascript

3.248.44.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web-chat-plugin.picogp.com/popupPlugin.min.js
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Server: 3.248.44.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-44-18.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: f484bd75176df807d80a01c229254644b01f2bba4599d788909331bd01367c3f

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 07:20:07 GMT
server: Apache
etag: "2c29-5d33e407e37c0-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 3270

Redirect headers

date: Sun, 09 Jan 2022 13:58:25 GMT
via: 1.1 c7015d60d4f8f2170aaaa75e69e40618.cloudfront.net (CloudFront)
server: awselb/2.0
age: 55475
x-cache: Hit from cloudfront
content-type: text/html
location: https://web-chat-plugin.picogp.com:443/popupPlugin.min.js
x-amz-cf-pop: FRA2-C2
content-length: 134
x-amz-cf-id: q010TG6W0YUaDqONnD_veZwJ11zeOklqIo7K1s3Cs5hebOCmXtxITA==

GET
H2 200 cmp.js Show response
g.ezodn.com/cmp/v2/ 518 KB
129 KB 80ms
34ms Script
application/javascript 2606:4700:3036::ac43:a1d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezodn.com/cmp/v2/cmp.js?v=49
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:a1d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16910f012ec529e4bef4051c3f178f72302c5ef55973277ba7aa36b5d19b91e2

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 04 Jan 2022 06:12:09 GMT
server: cloudflare
age: 452459
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hnwxQ6yTY%2BIi8gllXtrtW1lvk%2FaCsX5RjWdW2r5GfdoyEb%2B4Y9KzG06ohmASYUeAzwM52ecvl59ADUMLSVnOcYVd2Ukt2e8V%2FLl%2B4OOdmqtF4QcUnz4ZCPVJAnhPjwywtpTHL9jqdKsQDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cb378880c1483ae-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 nmash.js Show response
win.gg/porpoiseant/ 24 KB
6 KB 30ms
30ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://win.gg/porpoiseant/nmash.js?v=1
Requested by: Host: win.gg
URL: https://win.gg/porpoiseant/banger.js?cb=195-0&bv=94&v=57&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ffb648200f12e9e83c7a7d94892271c74f23b39d6f77b9df5e21c96166a41ecb

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
last-modified: Mon, 10 Jan 2022 05:05:29 GMT
server: nginx
etag: "6003-5d533490e8050;5c701b9c2cf40-gzip"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex

GET
H2 200 imp.gif Show response
win.gg/detroitchicago/ 43 B
159 B 30ms
29ms XHR
image/gif 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://win.gg/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A1%2C%22ad_count_adjustment%22%3A0%2C%22ad_lazyload_version%22%3A2%2C%22ad_load_version%22%3A1%2C%22ad_location_ids%22%3A%22%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A0%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A3%2C%22city%22%3A%22Milan%22%2C%22country%22%3A%22IT%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A0%2C%22domain_id%22%3A255604%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A2%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A1%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A0%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%22%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%2241b77813-eed7-49c7-46ad-2b9bf44f5bda%22%2C%22position_selection_id%22%3A42%2C%22postal_code%22%3A%2220153%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A384900%2C%22response_time_orig%22%3A7%2C%22serverid%22%3A%223.70.167.72%3A24090%22%2C%22state%22%3A%22MI%22%2C%22sub_page_ad_positions%22%3A%22%22%2C%22t_epoch%22%3A1641792180%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A795%2C%22worst_bad_word_level%22%3A1%7D
Requested by: Host: win.gg
URL: https://win.gg/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y0b-5y0d-14y13-3y17-4y21-3&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x21&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 47
expires: Sun, 09 Jan 2022 05:23:10 GMT

GET
H2 200 cmbdv2.js Show response
win.gg/detroitchicago/ 43 KB
10 KB 35ms
34ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://win.gg/detroitchicago/cmbdv2.js?gcb=195-0&cb=03-5y0c-5y18-4&cmbcb=20&sj=x03x0cx18&abt=PositionCalculator
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dc5aa15131e94ff270921a1009fa0f60527b7ddcc534287c3adada0f37fdc20c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public, max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 logo--dark.png
win.gg/wp-content/themes/win/assets/ 13 KB
11 KB 55ms
50ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/logo--dark.png

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ebab19f74d95b1c10457dbf025009438a9479c198c5e96a829c64f4b4298cf46

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: "61b2fcd6-3435-gzip"
age: 2641521
x-ezoic-cdn: Hit ds;mm;83d6e92484cb3e75716d513d7359b9a8;2-255604-102;80d4105d-4457-4c22-5284-7205f495258f
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
x-served-by: cache-ams12724-AMS, cache-fra19141-FRA
response: 200
last-modified: Fri, 10 Dec 2021 07:08:06 GMT
server: nginx
x-timer: S1641792016.479508,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/png
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: b9d375f0-59ce-11ec-b4f5-f6ae90fba23b
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-xsk8h

GET
H2 200 sun--dark.png
win.gg/wp-content/themes/win/assets/ 1 KB
1 KB 37ms
31ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/sun--dark.png

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

875ca1fe8a85b43fefb0206533f96bd56905305e6e0291c0b5284daf07b0c9e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: "61cb5a07-490-gzip"
age: 983646
x-ezoic-cdn: Hit ds;mm;d8e71934369849cda63ffbee45913a44;2-255604-102;ca2cf7dc-e3d2-40e8-4c1b-c361cdc52f59
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
content-length: 1172
x-served-by: cache-ams21052-AMS, cache-fra19126-FRA
response: 200
last-modified: Tue, 28 Dec 2021 18:40:07 GMT
server: nginx
x-timer: S1641791613.910777,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/png
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: d3553c68-68e1-11ec-b4f5-f6ae90fba23b
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-xsk8h

GET
H2 200 search--dark.svg
win.gg/wp-content/themes/win/assets/ 608 B
600 B 55ms
48ms Image
image/svg+xml 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/search--dark.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

62c6ababbe88d3d4496203cd685f2b900a0cb382b8e24704ad25e84b8ed80833

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b122b1-260-gzip"
age: 2789375
x-ezoic-cdn: Hit ds;mm;ccf92ad84bedceade2dc9e9a6c739300;2-255604-102;bbfa280e-4a68-4e71-58dc-f3405b97efd6
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 339
x-served-by: cache-ams12743-AMS, cache-hhn4026-HHN
access-control-allow-origin: *
response: 200
last-modified: Wed, 08 Dec 2021 21:25:05 GMT
server: nginx
x-timer: S1641792009.609099,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 74b35548-5876-11ec-b4f5-f6ae90fba23b
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-xsk8h

GET
H2 200 has-corpse-husband-ever-shown-his-face-question-mark-we-investigate.jpg
cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/ 77 KB
77 KB 536ms
447ms Image
image/webp 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate.jpg
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b6c2c004674f17d54d9905790df57a805fbff7ac2f3022b5d1474213b2a8fa2d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Fri, 27 Aug 2021 21:07:03 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "111c85e58415ce5fa04ea1368ad5aaa5"
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31557600
x-cache: Miss from cloudfront
content-length: 78660
x-amz-cf-id: kWkSa9Zn969uT7R5TDflzqgbjhJ2MxNmLCClYcRqYS3ETC9lsJAuvg==

GET
H2 200 here-are-all-pokemon-games-in-order-of-their-release.jpg
cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/ 258 KB
259 KB 487ms
398ms Image
image/webp 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/here-are-all-pokemon-games-in-order-of-their-release.jpg
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 081f383dd6dba858ee81e6b297eabf5ab04b9fc263517439dfa323e0c3d3c06d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Fri, 27 Aug 2021 20:24:44 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "82739464afb14b8de1caf9c268c700ee"
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31557600
x-cache: RefreshHit from cloudfront
content-length: 264218
x-amz-cf-id: YXGpDRUe83crlLNI-gEnhpQI-Bf2YZ08n5rkXbYnLn8D8kzLY6v5PQ==

GET
H2 200 arcana-lore.png
cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/11/ 233 KB
234 KB 508ms
419ms Image
image/webp 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/11/arcana-lore.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 69ed3547491fe22ca5be1ae732ad69f25d6dc1cc445ade7fbb10d16f22479247

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Sat, 04 Dec 2021 14:34:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "811c68607ec040ef57f53445efad7b1a"
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31557600
x-cache: RefreshHit from cloudfront
content-length: 238532
x-amz-cf-id: 014Dn_lSIYD15lksdBto1ai4cM5D2j0UKNlKzvzuyiXSYtTF6kPRaA==

GET
H2 200 thorin-and-montecristo-on-the-future-of-flashpoint-cloud9-fpx-more.jpg
cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/ 121 KB
121 KB 308ms
219ms Image
image/webp 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/thorin-and-montecristo-on-the-future-of-flashpoint-cloud9-fpx-more.jpg
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e9a8ad26258ebc90b218b72c9edbbbe314945cd3dacb600a6c677f298387106c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Fri, 27 Aug 2021 19:51:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "b27fb2c6a0cb5c55236f8299942c1415"
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31557600
x-cache: RefreshHit from cloudfront
content-length: 123836
x-amz-cf-id: wn64Bo2NMSVwOppQqksHgofvMXyQeAKOQdOIj9xcPwUC30A0ma-lRw==

GET
H2 200 breaking-down-the-international-2019s-field-of-teams.jpg
cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/ 132 KB
132 KB 437ms
349ms Image
image/webp 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/breaking-down-the-international-2019s-field-of-teams.jpg
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ee78b017c2b924ed15db50df9950897fece0939aeefca3e841eb0d27abead1a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Fri, 27 Aug 2021 21:04:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "365f469462ef855c1a2d4f2d4b82a744"
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31557600
x-cache: RefreshHit from cloudfront
content-length: 134782
x-amz-cf-id: J80qRm7iLP6Moy9IshyyBbkaQNM8fDZnp-HjsAjwmEHE8UDj8ATZVQ==

GET
H2 200 the-numbers-say-these-are-the-top-10-teams-in-csgo.jpg
cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/ 197 KB
198 KB 454ms
366ms Image
image/webp 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/the-numbers-say-these-are-the-top-10-teams-in-csgo.jpg
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d2d2c02162792065c0c23e4077f5c184408874b6d17646d65b48df45bb443a24

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Fri, 27 Aug 2021 20:06:09 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "0776cfca4da9a489031e37c5c27394fc"
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31557600
x-cache: RefreshHit from cloudfront
content-length: 202132
x-amz-cf-id: Ffrmq2XYs7Zs9fauK7z6o3qSd7YSu1a_LgeTQq6gM_OE66R4SrSx8Q==

GET
H2 200 the-rise-fall-and-potential-rise-again-of-unicorns-of-love.jpg
cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/ 304 KB
304 KB 428ms
425ms Image
image/webp 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/resize/w/1000/format/webp/type/progressive/fit/cover/path/wp/uploads/2021/08/the-rise-fall-and-potential-rise-again-of-unicorns-of-love.jpg
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0db6aceba6a39f92ad81c2d309444894c1f1be29a8f5f2390e29b5f809854df2

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Fri, 27 Aug 2021 20:08:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "a141c110f7901e2bece264e482ef165a"
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31557600
x-cache: RefreshHit from cloudfront
content-length: 310862
x-amz-cf-id: oDPFpEzKnSNiYGNMyvbPd6-7OLC0qmm3VTLtEDGPDnhfRL2YL3Z6Uw==

GET
H2 200 0.jpg
img.youtube.com/vi/IJLflOxnkB8/ 34 KB
34 KB 47ms
32ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/IJLflOxnkB8/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8bdde6f133628c4a48055ed25929a14aa77e1c00ea8a6fa3150746bd61cd4817

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:19:09 GMT
x-content-type-options: nosniff
age: 231
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34613
x-xss-protection: 0
server: sffe
etag: "1641667024"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=300
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 05:24:09 GMT

GET
H2 200 0.jpg
img.youtube.com/vi/0LVzne35csU/ 33 KB
34 KB 35ms
35ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/0LVzne35csU/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42488c78648e3488f2cba57c217dd9bbb6219046f50fbc65b3c946aa6b7a8ed7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:21:42 GMT
x-content-type-options: nosniff
age: 78
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34300
x-xss-protection: 0
server: sffe
etag: "1641650284"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=300
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 05:26:42 GMT

GET
H2 200 0.jpg
img.youtube.com/vi/mdU7_vt1UYA/ 38 KB
38 KB 44ms
43ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/mdU7_vt1UYA/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

218a4b9d771f0fb60868fe38d391e1847e69ed4883236a6a10549bb00ddfab92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:21:42 GMT
x-content-type-options: nosniff
age: 78
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39284
x-xss-protection: 0
server: sffe
etag: "1641544250"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=300
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 05:26:42 GMT

GET
H2 200 0.jpg
img.youtube.com/vi/ptZJSq_BKUs/ 32 KB
32 KB 55ms
54ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/ptZJSq_BKUs/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da6bba72d171362ca0b743ad4980b57a161c885989ed0e6006a3af1941bd13e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:38:27 GMT
x-content-type-options: nosniff
age: 2673
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32588
x-xss-protection: 0
server: sffe
etag: "1641407900"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:38:27 GMT

GET
H2 200 0.jpg
img.youtube.com/vi/-1rZswrJv0M/ 46 KB
46 KB 62ms
62ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/-1rZswrJv0M/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed750e681f09555fcd3f87382fede5226d3fd6ce4c9b63e8c57dadc5c5092553

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:04:38 GMT
x-content-type-options: nosniff
age: 4702
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46922
x-xss-protection: 0
server: sffe
etag: "1641475785"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:04:38 GMT

GET
H2 200 0.jpg
img.youtube.com/vi/X73pw9DTtHA/ 39 KB
40 KB 64ms
63ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/X73pw9DTtHA/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12dc3fbcf201e281b2edc90e10e2cef5afa7bbf21a1886284a1f447705f9260b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:29:52 GMT
x-content-type-options: nosniff
age: 3188
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40426
x-xss-protection: 0
server: sffe
etag: "1641389665"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:29:52 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/UCloH1M5Awc/ 30 KB
30 KB 76ms
75ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/UCloH1M5Awc/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d5a784db790b0b9b94d6ad523b23ab5834c5844bbc01e6d01021f3fe01e3b46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:11:50 GMT
x-content-type-options: nosniff
age: 670
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30635
x-xss-protection: 0
server: sffe
etag: "1641305179"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 07:11:50 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/reR9rMGepTw/ 33 KB
33 KB 78ms
77ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/reR9rMGepTw/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5ae734732c18d60c5ed7f2ba8d8ef6f7bd5d97eb97c29306339dbadcfc60715

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 03:54:39 GMT
x-content-type-options: nosniff
age: 5301
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34218
x-xss-protection: 0
server: sffe
etag: "1641248231"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 05:54:39 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/aTFsUEh-txE/ 25 KB
25 KB 28ms
27ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/aTFsUEh-txE/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e27706b20996f8275f1bc1914ebb3f21d7b8c1f98a615cedee3bfd7d9f65eb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:04:48 GMT
x-content-type-options: nosniff
age: 1092
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25696
x-xss-protection: 0
server: sffe
etag: "1640976517"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 07:04:48 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/3KE48Ext_IE/ 36 KB
36 KB 69ms
67ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/3KE48Ext_IE/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e755339aa80a7257a32d804d35ff5bc5e535f3ef013ca7b547df6e2ff54cf7bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 03:24:16 GMT
x-content-type-options: nosniff
age: 7124
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36825
x-xss-protection: 0
server: sffe
etag: "1640768269"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 05:24:16 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/QVISCoKkZoM/ 31 KB
31 KB 49ms
48ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/QVISCoKkZoM/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7c62c6ff2a5810e6614352d1dae0a10fc98c1b3f97179fc768891083ab3d97a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:13:03 GMT
x-content-type-options: nosniff
age: 597
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32142
x-xss-protection: 0
server: sffe
etag: "1640681724"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 07:13:03 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/lkUaMfJXXak/ 35 KB
36 KB 40ms
39ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/lkUaMfJXXak/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b6e4ddbee5d65c3c125435d5c4f4648c281dc23a6e37d36b8206c93dfb21e5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:16:52 GMT
x-content-type-options: nosniff
age: 3968
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36328
x-xss-protection: 0
server: sffe
etag: "1640551630"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:16:52 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/1rTAfl2IkZE/ 30 KB
30 KB 58ms
57ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/1rTAfl2IkZE/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

727f45ae1692ce3a9cd8caa581e149bf6bfb1e05acd06b5457ddb839f49f12a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:45:16 GMT
x-content-type-options: nosniff
age: 2264
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30437
x-xss-protection: 0
server: sffe
etag: "1640591429"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:45:16 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/K6AdklyZpW4/ 45 KB
45 KB 105ms
104ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/K6AdklyZpW4/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73b579a32d3f69b2472cc1108ca5f67f7055f92676435cc8adcbfd17330a0642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:31:09 GMT
x-content-type-options: nosniff
age: 3111
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45785
x-xss-protection: 0
server: sffe
etag: "1640526129"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:31:09 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/YJnIvcuKyUY/ 27 KB
27 KB 100ms
99ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/YJnIvcuKyUY/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34ad89dba4e0292fba916dd3c8c4a79a779d047f22522dc6cca75207433ff478

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:54:47 GMT
x-content-type-options: nosniff
age: 1693
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27505
x-xss-protection: 0
server: sffe
etag: "1640506913"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:54:47 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/1xJDf1CGrVA/ 38 KB
38 KB 88ms
86ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/1xJDf1CGrVA/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eee27924bf4d911592556c15acb777978be0e32b7145a6bfa5f57a6b5cc68ed3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:39:03 GMT
x-content-type-options: nosniff
age: 2637
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39350
x-xss-protection: 0
server: sffe
etag: "1640309970"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:39:03 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/q4mlEPpnEDE/ 36 KB
36 KB 82ms
80ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/q4mlEPpnEDE/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21a46a76325b873e8e2695ca80ae1a330642b54fc95fc59faeef045c80b61373

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:38:28 GMT
x-content-type-options: nosniff
age: 2672
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37255
x-xss-protection: 0
server: sffe
etag: "1640365183"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 06:38:28 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/9VV2IOfXEI0/ 30 KB
30 KB 96ms
94ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/9VV2IOfXEI0/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8fec1c32636d1846a124214e650c4e9c7f608b3fd4e3200f11d83b3c26d2917e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 03:47:55 GMT
x-content-type-options: nosniff
age: 5705
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30850
x-xss-protection: 0
server: sffe
etag: "1640162482"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 05:47:55 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/Lz-go3pBmtY/ 33 KB
33 KB 83ms
81ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/Lz-go3pBmtY/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

594ddac798983598f532ff9185733bf20004d353fe92460ca4e7fbba064f83bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 03:33:55 GMT
x-content-type-options: nosniff
age: 6545
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33354
x-xss-protection: 0
server: sffe
etag: "1640101897"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 05:33:55 GMT

GET
H3 200 0.jpg
img.youtube.com/vi/Fp33iscXzR0/ 29 KB
29 KB 104ms
102ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/Fp33iscXzR0/0.jpg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fdc657af14908b8096c3da226e147e7f249e6f0aa09a5c20415ce9f08bfca47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:13:03 GMT
x-content-type-options: nosniff
age: 597
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29897
x-xss-protection: 0
server: sffe
etag: "1640075044"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 10 Jan 2022 07:13:03 GMT

GET
H2 200 wingg.svg
cdn.winners.bet/bet/static/images/icons/ 1 KB
930 B 143ms
26ms Image
image/svg+xml 2600:9000:21f3:c800:d:3df0:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.winners.bet/bet/static/images/icons/wingg.svg
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:c800:d:3df0:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a460867641adc96414fe08a934ba16de4bc98e1cb940417b810205d2ce9650fa

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 07:39:12 GMT
content-encoding: gzip
last-modified: Fri, 23 Jul 2021 20:32:07 GMT
server: AmazonS3
age: 79795
etag: W/"aca2b7e288891d28e17d9ec9d5b60237-1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 d6b9c7bad28b271f1e800a50d49ab8a4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: W_DUDjSdqyfegVIeeaSEy_Ppjx6KgaR_p9hS33WygrwJmROVEboTAA==

GET
H2 200 winnersNet--dark.webp
win.gg/wp-content/themes/win/assets/ 6 KB
6 KB 58ms
57ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/winnersNet--dark.webp

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

d905e1e08cc9a120a8630d1aeb347f7ba8d412361e251a07ea5f000c832c7412

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: "61d3386e-1796-gzip"
age: 439510
x-ezoic-cdn: Hit ds;mm;70b3a8ce77ecf36fc2a3fbc44d1b9498;2-255604-102;b9748f05-1357-45a1-5cb5-25fbcc495e62
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
x-served-by: cache-ams12742-AMS, cache-hhn4043-HHN
response: 200
last-modified: Mon, 03 Jan 2022 17:54:54 GMT
server: nginx
x-timer: S1641791105.522574,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/webp
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 8f0525a1-6dd3-11ec-b296-3e307427f9f8
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-2t84k

GET
H2 200 winnersBet--dark.png
win.gg/wp-content/themes/win/assets/ 6 KB
6 KB 35ms
34ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/winnersBet--dark.png

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

4f2f14c39c4b652a6bfed55bf65c3434d2d1707996601db9b2c5f43df38ff0e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: "61b122b1-185b-gzip"
age: 2788994
x-ezoic-cdn: Hit ds;mm;7dc23127694e354a7f907a2ab29dca18;2-255604-102;edf22a20-9972-4647-6386-7f2142c68a8f
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
x-served-by: cache-ams21033-AMS, cache-hhn4076-HHN
response: 200
last-modified: Wed, 08 Dec 2021 21:25:05 GMT
server: nginx
x-timer: S1641791627.113246,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/png
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 74c7b76a-5876-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 youtube--dark.svg
win.gg/wp-content/themes/win/assets/ 735 B
624 B 48ms
47ms Image
image/svg+xml 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/youtube--dark.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c14eec7dcf14eb8e6a55a51fa0673d2dec616c080a74a890ba1583b1687f76fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b02194-2df-gzip"
age: 2788526
x-ezoic-cdn: Hit ds;mm;1e9f768eafee6d9b19bedea71ab5746a;2-255604-102;f21d3c24-ebe2-447f-532d-60a99020e665
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 381
x-served-by: cache-ams21080-AMS, cache-hhn4080-HHN
access-control-allow-origin: *
response: 200
last-modified: Wed, 08 Dec 2021 03:08:04 GMT
server: nginx
x-timer: S1641791158.424168,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 74c7debc-5876-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 instagram.svg
win.gg/wp-content/themes/win/assets/ 1 KB
908 B 44ms
43ms Image
image/svg+xml 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/instagram.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

49aa9dd43371f1114267ce1402683c40bed1a0beba352d71930127d67176719f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61af950b-4a7-gzip"
age: 2788994
x-ezoic-cdn: Hit ds;mm;e6d4ad6fdaa4b87c474a267d60a55a12;2-255604-102;96387d5a-a6b3-4efa-7218-cf6135fd6bbb
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 545
x-served-by: cache-ams12720-AMS, cache-hhn4022-HHN
access-control-allow-origin: *
response: 200
last-modified: Tue, 07 Dec 2021 17:08:27 GMT
server: nginx
x-timer: S1641791627.105351,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 74c92e5f-5876-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 facebook.svg
win.gg/wp-content/themes/win/assets/ 443 B
562 B 49ms
48ms Image
image/svg+xml 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/facebook.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

a8dee0d8bf99402d55632730a805dbc567a95770c511ff997ee8a0a51ae4ef66

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b02194-1bb-gzip"
age: 2788249
x-ezoic-cdn: Hit ds;mm;a259a81535047443d93dd365a8258676;2-255604-102;870d74c0-e62c-4316-575a-2c33f349d3d7
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 277
x-served-by: cache-ams21063-AMS, cache-hhn4067-HHN
access-control-allow-origin: *
response: 200
last-modified: Wed, 08 Dec 2021 03:08:04 GMT
server: nginx
x-timer: S1641790882.011070,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 9c5bec9b-5875-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 twitter.svg
win.gg/wp-content/themes/win/assets/ 1 KB
867 B 34ms
33ms Image
image/svg+xml 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/twitter.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

1ff7f291ef8bacab4d9ba865601974aac21d4c86395f33c732779210267ab993

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b05a3d-420-gzip"
age: 2788994
x-ezoic-cdn: Hit ds;mm;d0406819423080f132b6f5b85c5170f1;2-255604-102;54e6fe0d-bf0b-4451-615a-a0bca8640837
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 558
x-served-by: cache-ams12761-AMS, cache-hhn4057-HHN
access-control-allow-origin: *
response: 200
last-modified: Wed, 08 Dec 2021 07:09:49 GMT
server: nginx
x-timer: S1641791627.107847,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 74c855e4-5876-11ec-a10a-2e5155d624aa
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-mfwzd

GET
H2 200 rss.svg
win.gg/wp-content/themes/win/assets/ 900 B
698 B 47ms
47ms Image
image/svg+xml 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://win.gg/wp-content/themes/win/assets/rss.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

4b6c0e30bb4b961addd346acade8505a2dfcb63e5f857f1306cc4fc9026b0f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61b122b1-384-gzip"
age: 2788249
x-ezoic-cdn: Hit ds;mm;5bd1f20399ab1f93309e59b80b343e70;2-255604-102;5878fb26-e60b-4515-4af1-5985aa3a82e5
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 477
x-served-by: cache-ams12757-AMS, cache-hhn4042-HHN
access-control-allow-origin: *
response: 200
last-modified: Wed, 08 Dec 2021 21:25:05 GMT
server: nginx
x-timer: S1641790882.011462,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-styx-req-id: 74c810df-5876-11ec-ad17-423dc069c077
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-6bd4c9db-ktlfl

GET
H2 200 admin-ajax.php Show response
win.gg/wp-admin/ 24 B
500 B 179ms
179ms XHR
text/html 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-admin/admin-ajax.php?action=ai_ajax&ip-data=ip-address-country-city&ai_check=235478f52b&ver=1641792180496-74091

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

692671669fec1b7626e449845f6a856661a36fff78f4a111db24c30bb8b2367c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
X-Requested-With: XMLHttpRequest
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 0
expires: Wed, 11 Jan 1984 05:00:00 GMT
x-ezoic-cdn: Bypass
x-cache: MISS, MISS
x-middleton-display: staticcontent_sol
x-cache-hits: 0, 0
x-middleton-response: 200
content-length: 28
x-served-by: cache-ams12749-AMS, cache-fra19147-FRA
referrer-policy: strict-origin-when-cross-origin
pagespeed: off
response: 200
server: nginx
traceparent: 00-52edee3b471140548e849191a00b89b5-60fc559afe36c14a-00
x-timer: S1641792181.535104,VS0,VE126
x-frame-options: SAMEORIGIN
x-origin-cache-control: no-cache, must-revalidate, max-age=0
vary: Accept-Encoding, Accept-Encoding,Cookie,Origin
strict-transport-security: max-age=300
content-type: text/html; charset=UTF-8
via: 1.1 varnish, 1.1 varnish
x-cloud-trace-context: 52edee3b471140548e849191a00b89b5/6988554845950493002;o=0
cache-control: no-cache, must-revalidate, max-age=0
x-robots-tag: noindex
x-styx-req-id: 60aacf82-71d5-11ec-bf1c-1ec8beb49917
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-d-79b8dbf6c8-bbj9t

GET
H2 200 iab_consent_sdk.v1.0.js Show response
live.primis.tech/content/ClientDetections/ Frame 1903 19 KB
6 KB 39ms
39ms Script
application/javascript 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:22:59 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 15:01:36 GMT
server: nginx
etag: W/"5e441350-4be0"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 10 Jan 2023 05:22:59 GMT

GET
H2 200 DetectGDPR2.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame 1903 9 KB
3 KB 40ms
39ms Script
application/javascript 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR2.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 154212eb976f7df7c79f5844fcb356740bcb6c51edacb2e8515108e2d7effa67

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:22:59 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
etag: W/"6024fccc-228f"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 10 Jan 2023 05:22:59 GMT

GET
H2 200 DetectGDPR.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame 1903 8 KB
3 KB 40ms
39ms Script
application/javascript 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 5bb08412d18881e3fc69fdb44226bfc6f66a77d45dfff3f10b98a100c09bc970

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
etag: W/"6024fccc-1ef8"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 10 Jan 2023 05:23:00 GMT

GET
H2 200 hls.0.12.4_2.min.js Show response
live.primis.tech/content/video/hls/ Frame 1903 256 KB
86 KB 43ms
42ms Script
application/javascript 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:22:59 GMT
content-encoding: gzip
last-modified: Thu, 13 Aug 2020 08:36:05 GMT
server: nginx
etag: W/"5f34fb75-3ff27"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 10 Jan 2023 05:22:59 GMT

GET
H2 200 prebidVid.5.18.0_6.min.js Show response
live.primis.tech/content/prebid/ Frame 1903 482 KB
175 KB 114ms
113ms Script
application/javascript 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_6.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 6a6c28a2bae4339f212ecd19e178a40e02a8f5cc7e40203633d6981353a0c6af

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
last-modified: Mon, 22 Nov 2021 12:28:42 GMT
server: nginx
etag: W/"619b8cfa-7892b"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 10 Jan 2023 05:23:00 GMT

GET
H2 200 liveVideo.php Show response
live.primis.tech/live/ Frame 1903 612 KB
171 KB 152ms
151ms Script
text/html 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=104669&vp_content=plembed2011ghzmiptq&cbuster=1641792180&pubUrlAuto=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: c143e8e7006ab800c1913682296f942b0515cdf15277247d1e0e4bc5d38fb02b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
server: nginx
content-type: text/html; charset=UTF-8

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/edff9f99/www-widgetapi.vflset/ 149 KB
49 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/edff9f99/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a30efe5482066576af9976d7b0716c88d2ccd05e54bfb481bd8485427945dbd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 09 Jan 2022 23:01:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22897
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49417
x-xss-protection: 0
last-modified: Wed, 05 Jan 2022 01:18:03 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 09 Jan 2023 23:01:23 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 93ms
25ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-598L2T6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 6486
date: Mon, 10 Jan 2022 03:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 10 Jan 2022 05:34:54 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 162 KB
60 KB 79ms
41ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-916JLHZYLF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-598L2T6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3a291e7b6d5384914c0d162cc11a76b274550e0afb8ee2f3c7770c4eff6e8d4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61490
x-xss-protection: 0
expires: Mon, 10 Jan 2022 05:23:00 GMT

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/15154/ 28 KB
9 KB 113ms
48ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/15154/Bootstrap.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-598L2T6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2fb07bc2036b6b6338b8632cdb49566bb1a3fdaa471b628345de4459692362c8

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 19:30:44 GMT
server: nginx
etag: W/"61390f64-7013"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300

GET
H2 200 oribi.js Show response
cdn.oribi.io/Xy0xODg1MDA0Nzk1/ 3 B
139 B 579ms
192ms Script
application/javascript 52.35.50.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.oribi.io/Xy0xODg1MDA0Nzk1/oribi.js
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.35.50.171 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-35-50-171.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
cache-control: public, max-age=60
content-length: 3
x-application-context: application
content-type: application/javascript;charset=UTF-8

GET
H2 200 GVL Show response
gvl.ezodn.com/gvlcache/ 300 KB
40 KB 81ms
35ms XHR
application/json 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gvl.ezodn.com/gvlcache/GVL?gvlSpecificationVersion=2&language=en&vb=123&cmpv=55
Requested by: Host: g.ezodn.com
URL: https://g.ezodn.com/cmp/v2/cmp.js?v=49
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f24ca47fbbc6a0e0ad55bde1a42b19fed1fdd63fa90396876f83ad6400c02769

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
gvlcache-hit: true
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A%2Bnm9%2FXFrY%2Fw0PInsiTYOyo1rp1UtE23ubDwu%2FZwoKLEzlPpiGH%2BF%2B3N908h8B79YrXK3PYIvEYqBBekJpXoxh8e%2Fz2BUfD0awllrrTd%2Bc7IDQWoXN1K74DboXvKNk3pP5d7yd0Ffgxf22Z1"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=604800, public
cf-ray: 6cb37888fdf4375d-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 twitter.svg
platform-cdn.sharethis.com/img/ 731 B
1 KB 88ms
25ms Image
image/svg+xml 2600:9000:21f3:6800:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/twitter.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:6800:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sun, 09 Jan 2022 11:02:46 GMT
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 66014
etag: "0af2fb38987598376c99e21af17ade45"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 731
x-amz-cf-id: BAppwcxssMKoZZ-mQG2XqX3h34kcjmOJOPxggXfB5mcouCf7HmuFyA==

GET
H2 200 facebook.svg
platform-cdn.sharethis.com/img/ 301 B
725 B 89ms
25ms Image
image/svg+xml 2600:9000:21f3:6800:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/facebook.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:6800:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Thu, 06 Jan 2022 06:44:51 GMT
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 340690
etag: "c6e9be45643e197ce1db1d7e24a99adc"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 301
x-amz-cf-id: B3SC_tpvIacqCf1zqImYzgdZ7FHm8j6bh0iHyeqg_Q273MVEFZQZXQ==

GET
H2 200 messenger.svg
platform-cdn.sharethis.com/img/ 372 B
797 B 89ms
25ms Image
image/svg+xml 2600:9000:21f3:6800:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/messenger.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:6800:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2986551fd9e82929eabb8cba7c44f74a28d8496c744893432f067b320dff55da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 24 Dec 2021 04:22:09 GMT
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 1472452
etag: "a5aa43fa302867d3e888ac2f69b7b288"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 372
x-amz-cf-id: tXJ3fR7V1qrhaJkrAl8LMgaByjyBoJ5hImzVjBiRlGZGDaPz1AXLUg==

GET
H2 200 reddit.svg
platform-cdn.sharethis.com/img/ 910 B
1 KB 88ms
24ms Image
image/svg+xml 2600:9000:21f3:6800:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/reddit.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:6800:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 05 Jan 2022 10:33:29 GMT
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 413372
etag: "78d796ca648d8a5e665b48ed0217c56a"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 910
x-amz-cf-id: ZmUZlz-IcgavesXv0RYYuFZuIZwRnETd3OATbR68WaZMKhSGxsJVnw==

GET
H2 200 email.svg
platform-cdn.sharethis.com/img/ 343 B
766 B 25ms
24ms Image
image/svg+xml 2600:9000:21f3:6800:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/email.svg

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:6800:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 24 Dec 2021 03:27:44 GMT
via: 1.1 83caebe1f817a31bd75ba17dff7ae1a6.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 1475717
etag: "5977437466e857c7ddcadda6f6d88c2a"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 343
x-amz-cf-id: Akt9cF3wbdgvok5GK2vQPc5qR9iXrXLAuR6F5pmM9RiNe1t4Tx71tA==

GET
H2 200 app.js Show response
win.gg/wp-content/themes/win/js/ 2 KB
855 B 50ms
50ms XHR
application/x-javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-content/themes/win/js/app.js?ver=1.0.4

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

935b2f1cdbf1af0439e86ecbd0ca09a2b3a91807ae651cf3f840f9237a45a667

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
X-Requested-With: XMLHttpRequest
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
etag: W/"61af2b4a-718-gzip"
age: 2788892
x-ezoic-cdn: Hit ds;mm;bb0c8de94a1d9c208ce349ffedb8e213;2-255604-102;f9957c72-31cc-49cf-48b8-d9fc0713de05
x-cache: HIT, HIT
x-middleton-display: staticcontent_sol
x-cache-hits: 1, 1
x-middleton-response: 200
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
content-length: 411
x-served-by: cache-ams12751-AMS, cache-hhn4023-HHN
response: 200
last-modified: Tue, 07 Dec 2021 09:37:14 GMT
server: nginx
x-timer: S1641791525.860442,VS0,VE1
x-origin-cache-control: max-age=31622400
strict-transport-security: max-age=300
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=1800
x-styx-req-id: 74cb76b5-5876-11ec-acdb-663326ca7806
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-856fdc5bb6-jqgc9

GET
H2 200 light.png
cdn-images.win.gg/wp/uploads/2021/10/ 6 KB
6 KB 389ms
387ms Image
image/png 2600:9000:20eb:3c00:12:b1b7:8800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn-images.win.gg/wp/uploads/2021/10/light.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3c00:12:b1b7:8800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7e0e2fbaa7a89c64df6b30953123d55b39e38cb0933d59425ecb11c9989d477b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
last-modified: Fri, 08 Oct 2021 15:56:11 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: "7d33bf45dbe240bfc75db6ba977aba38"
vary: Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
x-cache: RefreshHit from cloudfront
content-length: 5857
x-amz-cf-id: aYcz7lpHGrBLV0BnTXD11VcQURdK569IrFizWdFiNSBWpIrR-kaaHw==

GET
H2 200 t8791261b2cad4f0ca3969989462.png
cdn.gin.bet/team/ 59 KB
59 KB 96ms
40ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t8791261b2cad4f0ca3969989462.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4020165d6e09bd9d4ab3ff31d07ef236815d956940a6f795322492d0b247964

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Fri, 10 Dec 2021 03:34:44 GMT
server: cloudflare
age: 424760
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a99a63750-MXP

GET
H2 200 220[1]5ffff12929fe4858443687.png
cdn.gin.bet/team/ 20 KB
21 KB 95ms
40ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/220[1]5ffff12929fe4858443687.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e21e1613bbb5218070a9b6c89286497628e6ea512f2b2fa51c6167bb5a9964f6

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Thu, 14 Jan 2021 07:22:17 GMT
server: cloudflare
age: 424760
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a89913750-MXP

GET
H2 200 t8717611d285ea9321793323130.png
cdn.gin.bet/team/ 45 KB
45 KB 94ms
39ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t8717611d285ea9321793323130.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f37c6ad1aeafdbf2fda86036ff1993838830f469f53fd8fb639fd4487aea36d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Aug 2021 15:33:50 GMT
server: cloudflare
age: 598788
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a89933750-MXP

GET
H2 200 220[1]600cb700b1dac960251023.png
cdn.gin.bet/team/ 11 KB
11 KB 108ms
54ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/220[1]600cb700b1dac960251023.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6e55d55d4c55cf139fe10a393a5b9bcfb12fcaece73db7d7f2ab35e4747b8ed

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Sat, 23 Jan 2021 23:53:36 GMT
server: cloudflare
age: 598788
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a99a73750-MXP

GET
H2 200 t73639611d27c46b94d986787885.png
cdn.gin.bet/team/ 7 KB
7 KB 70ms
40ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t73639611d27c46b94d986787885.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99804220c3204691bd91fa39497f38f3235177d52723188cf3ac53026e0b0f6a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Aug 2021 15:31:16 GMT
server: cloudflare
age: 424760
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a89923750-MXP

GET
H2 200 t61813611d27374033a283586869.png
cdn.gin.bet/team/ 141 KB
141 KB 66ms
40ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t61813611d27374033a283586869.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 379b0677d7ebdd694a38680fa6aa64844afac94967bb796fd695d4dcc2c3d5b4

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Aug 2021 15:28:55 GMT
server: cloudflare
age: 424760
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a898d3750-MXP

GET
H2 200 t62644611d2742efb93193376507.png
cdn.gin.bet/team/ 24 KB
24 KB 47ms
22ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t62644611d2742efb93193376507.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54f0bf848b3561d7e1127ee9c8bd47fe8643254597fab341c5379645a5d8ee56

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Aug 2021 15:29:06 GMT
server: cloudflare
age: 424760
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a89903750-MXP

GET
H2 200 t73637611d27c4495e0246338028.png
cdn.gin.bet/team/ 18 KB
18 KB 66ms
40ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t73637611d27c4495e0246338028.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0ce1c35a5960b75b9920bafcefc89fe548f105ec8c767f32d83afa64bda6433

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Aug 2021 15:31:16 GMT
server: cloudflare
age: 424760
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a898c3750-MXP

GET
H2 200 t8604611d285713760056152837.png
cdn.gin.bet/team/ 6 KB
6 KB 64ms
39ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t8604611d285713760056152837.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb35e960629d7b7f26da19f7fa0df3e2811ff9f5c43eb8ef71306e91cf2f3198

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Aug 2021 15:33:43 GMT
server: cloudflare
age: 140732
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a898f3750-MXP

GET
H2 200 t22832611d24f64f0b5485431002.png
cdn.gin.bet/team/ 66 KB
66 KB 49ms
23ms Image
image/png 2a07:180:27b:71f4:967e:7b66:dbda:fbaf
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.gin.bet/team/t22832611d24f64f0b5485431002.png
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a07:180:27b:71f4:967e:7b66:dbda:fbaf , Belize, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2a00fa9417eb51e747aeec31ebe648fd1f04d6937c19e793b0c9dfc8df1a00ef

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
cf-cache-status: HIT
last-modified: Wed, 18 Aug 2021 15:19:18 GMT
server: cloudflare
age: 140732
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31536000
cf-ray: 6cb3788a898b3750-MXP

GET
H3 200 GVL Show response
gvl.ezodn.com/gvlcache/ 31 KB
5 KB 53ms
33ms XHR
application/json 2606:4700:3031::6815:496e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gvl.ezodn.com/gvlcache/GVL?gvlSpecificationVersion=2&language=it&vb=123&cmpv=55
Requested by: Host: g.ezodn.com
URL: https://g.ezodn.com/cmp/v2/cmp.js?v=49
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:496e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ad7ae37966c904cd579e286580b0a26a235106dab97d9a24323cf6e99f2b3d0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
gvlcache-hit: true
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JVHL81fS%2Bndy1v%2BUs84qYB861ixWJyic86p74be8bYH96HiD1l7hXFvHGqrseJw7u4wtxoA0FwmezJgVw7w%2FtxuIUlAG9y2Oqgfh1irFh60ONEyyyFIZeLddxRBgee8R0DNP8p9IeoTw7b7S"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=604800, public
cf-ray: 6cb3788a59370f6a-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 primisslate.css
live.primis.tech/content/video/css/ 17 KB
5 KB 38ms
38ms Stylesheet
text/css 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/css/primisslate.css
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 10:07:25 GMT
server: nginx
etag: W/"5f3ba85d-45c8"
content-type: text/css

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 1903 134 KB
36 KB 120ms
31ms Script
application/javascript 13.224.198.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.198.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-198-4.fra2.r.cloudfront.net
Software: Server /
Resource Hash: de80309d98405d566c6fb1912811b24c8ad3a8380f6819d26a6c1eac5cd99185

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: KuXuY5mbG6yln5YsEdf9JaPJtFF6aIqm
content-encoding: gzip
etag: 1e39d25f07f5619925357b752ab10d04
age: 702
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 09CV6TYPJHPZTHWRYWBT
date: Mon, 10 Jan 2022 05:11:22 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 7a18a0a1d9929dae345690b88b08dd5e.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: sJxmkhvaKaFs-nkwrCh3IXkk5LwYyh1Y09UD_L1EkW0aYVDBkMc-Ow==

GET
H2 200 css
fonts.googleapis.com/ Frame 8DEF 2 KB
1 KB 99ms
37ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 04:10:07 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 10 Jan 2022 05:23:00 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Jan 2022 05:23:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
622 B 85ms
38ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 04:18:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 10 Jan 2022 05:23:00 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Jan 2022 05:23:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 72AE 14 KB
5 KB 87ms
25ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=29586
expires: Mon, 10 Jan 2022 13:36:06 GMT
date: Mon, 10 Jan 2022 05:23:00 GMT
vary: Accept-Encoding

GET
H2

200

liveCS.php Show response
live.primis.tech/live/ Frame D2EA
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=94&advUuid=60f72c06-71d5-11ec-807c-18b2794d0506

0
223 B

43ms
43ms

Document
text/html

185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=94&advUuid=60f72c06-71d5-11ec-807c-18b2794d0506
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/

Response headers

server: nginx
date: Mon, 10 Jan 2022 05:23:00 GMT
content-type: text/html; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

Server: nginx
Date: Mon, 10 Jan 2022 05:23:01 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=94&advUuid=60f72c06-71d5-11ec-807c-18b2794d0506
X-fe: 136
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 503B 43 B
305 B 86ms
34ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D98%26advUuid%3D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.0.0 /
Resource Hash: e963e7196beb9123059ec3534b042ebcd1ef0a470fa568bfbebfeab2f33c4fda

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.0.0
pragma: no-cache
p3p: CP="CUR ADM OUR NOR STA NID"
expires: Mon, 26 Jul 1997 05:00:00 GMT
date: Mon, 10 Jan 2022 05:23:00 GMT
content-type: text/html
content-length: 56
content-encoding: gzip
cache-control: private, max-age=0, no-cache
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame FA22 2 KB
1 KB 161ms
39ms Document
text/html 2a0c:5c81:5139::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5139::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 43b348d194f4e2c50da38d2a5e596635df86baee4de5839d73d19aa6285dbd4f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/

Response headers

Server: VertaMedia 1.0
Date: Mon, 10 Jan 2022 05:23:00 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 853
Access-Control-Allow-Origin: https://win.gg
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 1903 17 KB
4 KB 64ms
64ms XHR
application/json 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYlOTxjOSUlRaZcZGViXmVzNzFzMDAkYWFyMWIlNwQmNTIjNDUyMxZ2nWQ2MWQ5Ymp0YWM4MTE3MDp1OTY0NwMlLz1jNCZ2nWRsY29hqGVhqF9cZD0lMDMjMmI4JaZcZF9wo250ZW50X2Ryp2M9Q3JuraxeYXR0ZW50nW9hK3RiK2RyqGFcoCgcovgBozygYWjeQ3Jip3NcozpyM0EeTzV3K0uipzy6o25mJaZcZF9wo250ZW50X3RcqGkyPUNlYXc5K2F0qGVhqGyiovg0olgxZXRunWjenW4eQW5coWFfK0Nlo3NmnW5aJTNBK05yqlgIo3Jcrz9hplZ2nWRsY29hqGVhqF9xqXJuqGyiow05MSZxZWJ1Z0yhZz9loWF0nW9hPSZ4PTY0NCZ5PTM2MvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3nW4hZ2pyMxZhZXqmJTJGnGFmLWNipaBmZS1bqXNvYW5xLWV2ZXIgp2uiq24gnGymLWZuY2UgpXVyp3Rco24goWFlnl13ZS1coaZyp3RcZ2F0ZSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMlMxQmMDMkMxQmMTMjNUYmMDM3N0Q3QwpmMmEmNDM4MmAmOTMlMmEmNwqEN0I0MmMkMmYmNDqEN0I1MmY0MmI2Qmp1NEM2RDY0NxU3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmpmNTMjN0Q3QwU5MmQmMwM0N0Q3QwY2MmE3RDqCNEMmODM1MmUmNwqERxVGRSZcp0FjpD0jJzqyo0kuqGx9NDUhNDplMvZaZW9Mo25aPTxhMTxlMvZ1p2VlSXBBZGRlPTE5Mv4kNDUhMTI3LwIkNSZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGODxhMC40Mmt5LwplK1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkZGJwMzI0NzI3NmUzY2J1p3Rypw0kNwQkNmxlMTtjOTA4JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: b116448ba85d53cb08d3e189ff68c832bac0f0993b3635a3331a81e3fe00c71a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://win.gg
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 4268

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 1903 17 KB
4 KB 57ms
57ms XHR
application/json 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYlOTxjOSUlRaZcZGViXmVzNzFzMDAkYWFyMWIlNwQmNTIjNDUyMxZ2nWQ2MWQ5Ymp0YWM4MTE3MDp1OTY0NwMlLz1jNCZ2nWRsY29hqGVhqF9cZD0lMDMjMmI4JaZcZF9wo250ZW50X2Ryp2M9Q3JuraxeYXR0ZW50nW9hK3RiK2RyqGFcoCgcovgBozygYWjeQ3Jip3NcozpyM0EeTzV3K0uipzy6o25mJaZcZF9wo250ZW50X3RcqGkyPUNlYXc5K2F0qGVhqGyiovg0olgxZXRunWjenW4eQW5coWFfK0Nlo3NmnW5aJTNBK05yqlgIo3Jcrz9hplZ2nWRsY29hqGVhqF9xqXJuqGyiow05MSZxZWJ1Z0yhZz9loWF0nW9hPSZ4PTQjMCZ5PTIlNSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3nW4hZ2pyMxZhZXqmJTJGnGFmLWNipaBmZS1bqXNvYW5xLWV2ZXIgp2uiq24gnGymLWZuY2UgpXVyp3Rco24goWFlnl13ZS1coaZyp3RcZ2F0ZSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMlMxQmMDMkMxQmMTMjNUYmMDM3N0Q3QwpmMmEmNDM4MmAmOTMlMmEmNwqEN0I0MmMkMmYmNDqEN0I1MmY0MmI2Qmp1NEM2RDY0NxU3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmpmNTMjN0Q3QwU5MmQmMwM0N0Q3QwY2MmE3RDqCNEMmODM1MmUmNwqERxVGRSZcp0FjpD0jJzqyo0kuqGx9NDUhNDplMvZaZW9Mo25aPTxhMTxlMvZ1p2VlSXBBZGRlPTE5Mv4kNDUhMTI3LwIkNSZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGODxhMC40Mmt5LwplK1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkZGJwMzI0NzI3NmUzY2J1p3Rypw0kNwQkNmxlMTtjOTA5JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dd3655f66791af7f50203529ce85cec31d91f5ad264a2c8a0b96985705d291b

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://win.gg
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 4272

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 1903 9 KB
3 KB 61ms
61ms XHR
application/json 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYlOTxjOSUlRaZcZGViXmVzNzFzMDAkYWFyMWIlNwQmNTIjNDUyMxZ2nWQ2MWQ5Ymp0YWM4MTE3MDp1OTY0NwMlLz1jNCZ2nWRsY29hqGVhqF9cZD0lMDMjMmI4JaZcZF9wo250ZW50X2Ryp2M9Q3JuraxeYXR0ZW50nW9hK3RiK2RyqGFcoCgcovgBozygYWjeQ3Jip3NcozpyM0EeTzV3K0uipzy6o25mJaZcZF9wo250ZW50X3RcqGkyPUNlYXc5K2F0qGVhqGyiovg0olgxZXRunWjenW4eQW5coWFfK0Nlo3NmnW5aJTNBK05yqlgIo3Jcrz9hplZ2nWRsY29hqGVhqF9xqXJuqGyiow05MSZxZWJ1Z0yhZz9loWF0nW9hPSZ4PTY0NCZ5PTM2MvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3nW4hZ2pyMxZhZXqmJTJGnGFmLWNipaBmZS1bqXNvYW5xLWV2ZXIgp2uiq24gnGymLWZuY2UgpXVyp3Rco24goWFlnl13ZS1coaZyp3RcZ2F0ZSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMlMxQmMDMkMxQmMTMjNUYmMDM3N0Q3QwpmMmEmNDM4MmAmOTMlMmEmNwqEN0I0MmMkMmYmNDqEN0I1MmY0MmI2Qmp1NEM2RDY0NxU3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmpmNTMjN0Q3QwU5MmQmMwM0N0Q3QwY2MmE3RDqCNEMmODM1MmUmNwqERxVGRSZcp0FjpD0jJzqyo0kuqGx9NDUhNDplMvZaZW9Mo25aPTxhMTxlMvZ1p2VlSXBBZGRlPTE5Mv4kNDUhMTI3LwIkNSZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGODxhMC40Mmt5LwplK1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkZGJwMzI0NzI3NmUzY2J1p3Rypw0kNwQkNmxlMTtjOTElJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032322D30312D31305F30377D7B7331343830393231367D7B433136347D7B5364326C754C6D646E7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583735307D7B593432347D7B66317D7B4C383535367DFEFE&userIpAddr=192.145.127.215&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F89.0.4389.72+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=61dbc2b46b775&debugInfo=14809216_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=14809216&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed2011ghzmiptq&secondaryContent=&x=750&y=424&pubUrl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=110&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=45.4722&geoLong=9.1922&vpTemplate=8556&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=win.gg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e52a5dce5ec489b5677abb04ca8564754509a31ffd3054ee0db1b0aaa669e82c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:22:59 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://win.gg
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 3143

GET
H2 200 chunklist_480.m3u8 Show response
video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/ 641 B
1 KB 125ms
39ms XHR
application/vnd.apple.mpegurl 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/chunklist_480.m3u8
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 8286e6b6e23037720e66ef74cb3206c0e8f2781bfed730ad60f8fb8e42c67664

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 4612dc3b414cf2057f542e94733d59bc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
content-length: 641
last-modified: Sat, 08 Jan 2022 17:24:47 GMT
server: Tengine
etag: "57eb2c7134fa02a3237a57ce57506856"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: 62cTm4g_WpBk5Rym0vvPiNZniY6DDdqrMoiPzi50FvEWJ4xg5xL3TQ==
expires: Mon, 24 Jan 2022 05:23:01 GMT

GET
H2 200 vid61d9c74ac8117075964632_thumb.jpg
video.primis.tech/uploads/cn5/video/users/converted/29909/video_5f6af001aae1b264352045/ Frame 8DEF 4 KB
5 KB 117ms
43ms Image
image/jpeg 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn5/video/users/converted/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632_thumb.jpg?cbuster=1641733593
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: c8dbf0d976d58e9a85fe853a4331a4915f2983daccb394e2a7087de9ffe89097

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 84465451fc5898ca8155a82c8976074e.cloudfront.net (CloudFront)
last-modified: Sun, 09 Jan 2022 13:06:33 GMT
server: Tengine
x-amz-cf-pop: HAM50-C2
etag: "ab3513de6c11ebed96c342c1b0ccb99b"
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 24 Jan 2022 05:23:01 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 4305
x-amz-cf-id: awYql_w0oWd-fkgeolt3zIDwDPJA4xKyRr8mFblzZrFo-0SjHaGJmw==
x-proxy-cache: HIT

GET
H2 200 vid61daa5b759582192321358_thumb.jpg
video.primis.tech/uploads/cn6/video/users/converted/29909/video_5f6af001aae1b264352045/ Frame 8DEF 4 KB
5 KB 150ms
76ms Image
image/jpeg 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn6/video/users/converted/29909/video_5f6af001aae1b264352045/vid61daa5b759582192321358_thumb.jpg?cbuster=1641733591
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 81e5a285aa15116e4575e39d54cf93b2c305215d0d114b0e14a51e5e88d07248

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 24eb1500b3f80b309dcd7b8a50210a68.cloudfront.net (CloudFront)
last-modified: Sun, 09 Jan 2022 13:06:31 GMT
server: Tengine
x-amz-cf-pop: HAM50-C2
etag: "d05b5679a458a38d4fa2200a11afcfc6"
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 24 Jan 2022 05:23:01 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 4390
x-amz-cf-id: H1MsrVJH3-x6uE_Mbbf1onxhhoHsrwp4iWKRxADsbVg_fnYqAzFmCA==
x-proxy-cache: HIT

GET
H2 200 vid61d8915274097967903599_thumb.jpg
video.primis.tech/uploads/cn4/video/users/converted/29909/video_5f6af001aae1b264352045/ Frame 8DEF 6 KB
7 KB 150ms
77ms Image
image/jpeg 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn4/video/users/converted/29909/video_5f6af001aae1b264352045/vid61d8915274097967903599_thumb.jpg?cbuster=1641583818
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 9098059629f03cc62b01a2f95bdd705604dac8e6a93b6ed42d7d5c8b3fe26d45

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 2aad8fcd2689a21927951e9c238dbd00.cloudfront.net (CloudFront)
last-modified: Fri, 07 Jan 2022 19:30:18 GMT
server: Tengine
x-amz-cf-pop: HAM50-C2
etag: "95a6adf9b6a2ed1dd19baf9bca44b467"
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 24 Jan 2022 05:23:01 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 6608
x-amz-cf-id: WwMfjDbBOY138YxDYE8KWEVpsomA1q51s4y61dnKvtWc_Nio9e_q2w==
x-proxy-cache: HIT

GET
H2 200 vid61d81b0082daf738405150_thumb.jpg
video.primis.tech/uploads/cn4/video/users/converted/29909/video_5f6af001aae1b264352045/ Frame 8DEF 4 KB
4 KB 151ms
77ms Image
image/jpeg 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn4/video/users/converted/29909/video_5f6af001aae1b264352045/vid61d81b0082daf738405150_thumb.jpg?cbuster=1641553150
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 22f5922420e54dbd75b7170d72731d12642f10f004fd6035990e54372a7412b0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 c3e656776c8a9f0e1ea24405ab1dcc85.cloudfront.net (CloudFront)
last-modified: Fri, 07 Jan 2022 10:59:11 GMT
server: Tengine
x-amz-cf-pop: HAM50-C2
etag: "ce9846312b196222a35c3cd6175f4105"
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 24 Jan 2022 05:23:01 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 4108
x-amz-cf-id: r0cS3NCwAu1_sFOC3DTNPnZ_9XxftIeCDMSvYZqvXOfUKBqmlGpIqg==
x-proxy-cache: HIT

GET
H2 200 vid61d74be4dea37824759849_thumb.jpg
video.primis.tech/uploads/cn3/video/users/converted/29909/video_5f6af001aae1b264352045/ Frame 8DEF 6 KB
6 KB 103ms
45ms Image
image/jpeg 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn3/video/users/converted/29909/video_5f6af001aae1b264352045/vid61d74be4dea37824759849_thumb.jpg?cbuster=1641506617
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: c8607cd22af79cc6492bd2b0a6443679e907fe660ff470133aa61b649dfec11c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 3dca71b0fde541bcd2caf3756ffbc27a.cloudfront.net (CloudFront)
last-modified: Thu, 06 Jan 2022 22:03:38 GMT
server: Tengine
x-amz-cf-pop: VIE50-C1
etag: "0451b996dfaf44d6c2cd5e8279753f8a"
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 24 Jan 2022 05:23:01 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 5662
x-amz-cf-id: 8jWV7flyPDA5LLt1ppAgX8GsOVrPg-H5UweSl5UE5XgH15KfiRTQfg==
x-proxy-cache: HIT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 43ms
42ms Image
text/html 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTUjJaNypaZypyRcoWU9MTY0MTp5MwE4MCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA0NwY5JaN0YT0jJat9NmUjJax9NDI0JaZcZF9jYXNmRG9gYWyhPXqcov5aZlZmqWJJZD13nW4hZ2pzZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMlMxQmMDMkMxQmMTMjNUYmMDM3N0Q3QwpmMmEmNDM4MmAmOTMlMmEmNwqEN0I0MmMkMmYmNDqEN0I1MmY0MmI2Qmp1NEM2RDY0NxU3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmpmNTMjN0Q3QwU5MmQmMwM0N0Q3QwY2MmE3RDqCNEMmODM1MmUmNwqERxVGRSZxnWFcZD0zqXNypxyjQWRxpw0kOTIhMTQ1LwElNl4lMTUzqXNypyVBPU1irzyfoGEyMxY1LwAyMwAyMwuXnW5xo3qmJTIjTyQyMwAkMC4jJTNCJTIjV2yhNwQyM0IyMwB4NwQyMwxyMwBBpHBfZVqyYxgcqCUlRwUmNl4mNvUlMCUlOEgIVE1MJTJDJTIjoGyeZSUlMEqyY2giJTI5JTIjQ2ulo21yJTJGODxhMC40Mmt5LwplJTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02MWRvYmJvNDZvNmp1JzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2NDE3OTIkODA5MDMzqWyxPVNyn2yhZG9TUGkurWVlNwFxYzMlYwQ4MwMlMCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3nW4hZ2pyMxZhZXqmJTJGnGFmLWNipaBmZS1bqXNvYW5xLWV2ZXIgp2uiq24gnGymLWZuY2UgpXVyp3Rco24goWFlnl13ZS1coaZyp3RcZ2F0ZSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQ=
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:22:59 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 1903 43 B
220 B 167ms
26ms Image
image/gif 3.123.179.172
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=sekindo&gdpr=1&gdpr_consent=
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.179.172 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-179-172.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 1903
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=93&advUuid=fb8fbb44-1793-40cc-bffb-e814dd17acd0

0
223 B

42ms
42ms

Image
text/html

185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=93&advUuid=fb8fbb44-1793-40cc-bffb-e814dd17acd0
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=93&advUuid=fb8fbb44-1793-40cc-bffb-e814dd17acd0
date: Mon, 10 Jan 2022 05:23:01 GMT
server: _
content-length: 0

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 1903
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=192962&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D99%26advUuid%3D
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D99%26advUuid%3D&s=192962&C=1
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=99&advUuid=YdvCtaXa6ysJGwbjj1inVwAAByIAAAIB

0
223 B

50ms
50ms

Image
text/html

185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=99&advUuid=YdvCtaXa6ysJGwbjj1inVwAAByIAAAIB
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=99&advUuid=YdvCtaXa6ysJGwbjj1inVwAAByIAAAIB
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 334
Expires: Mon, 10 Jan 2022 05:23:01 GMT

GET
H2

403

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 1903
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D...
https://eb2.3lift.com/getuid?ld=1&gdpr=1&cmp_cs=&us_privacy=&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3Dhttps%3A%2F%2Fsync.intentiq.com%2Fprofiles_engine...
https://live.primis.tech/live/liveCS.php?source=external&pixel=https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=259151345&pcid=17410188347599961048&advId=121&advUuid=...
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20

0
0

121ms
36ms

Image
text/html

13.225.80.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Server: 13.225.80.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-80-95.fra2.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:00 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20
cache-control: no-store
content-type: text/html; charset=utf-8

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 1903 0
239 B 712ms
179ms Image
image/gif 8.39.36.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=primis
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 8.39.36.141 Los Angeles, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0963d041a95f271fbba7f411adc03573
Content-Type: image/gif

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 1903
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D105%26advUuid%3D%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Flive.primis.tech%252Flive%252FliveCS.php%253Fsource%253Dexternal%2526csuuid%253D61dbc2b46b775%2526pixel%253D%2526advId%253D105%2526ad...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=105&advUuid=7764980466689436379

0
223 B

41ms
41ms

Image
text/html

185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=105&advUuid=7764980466689436379
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:01 GMT
X-Proxy-Origin: 192.145.127.215; 192.145.127.215; 534.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: d5dbaa83-fb5f-4370-93fa-228723c045fa
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=61dbc2b46b775&pixel=&advId=105&advUuid=7764980466689436379
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 vid61d9c74ac8117075964632.jpg
video.primis.tech/uploads/cn5/video/users/converted/29909/video_5f6af001aae1b264352045/ 33 KB
33 KB 63ms
63ms Image
image/jpeg 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn5/video/users/converted/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.jpg?cbuster=1641733593
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 65a4abbc172abd62a87ad8a3aea5c219268f8694acb8d9f09e4f92bef29c7d1a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 372875ad1ec20daf24f3f29f14a73cd0.cloudfront.net (CloudFront)
last-modified: Sun, 09 Jan 2022 13:06:33 GMT
server: Tengine
x-amz-cf-pop: FRA60-P3
etag: "43f2526b5f6d1ced313bd2d731ae24f5"
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 24 Jan 2022 05:23:01 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 33509
x-amz-cf-id: H8pCpSdEoXWLM9-l9Mb8E630_YqbNlnB1KwipeVQckHG-UY6dQkfPg==
x-proxy-cache: HIT

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
393 B 135ms
28ms XHR
text/plain 52.29.0.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=win.gg&location=%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&product=unknown&url=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&source=sharethis.js&fcmp=false&fcmpv2=true&has_segmentio=false&title=Has%20Corpse%20Husband%20ever%20shown%20his%20face%3F%20We%20investigate%20-%20WIN.gg&cms=unknown&publisher=60fa285f7c9b910013246b5d&sop=true&version=st_sop.js&lang=en&description=Corpse%20Husband%20is%20a%20mystery.%20-%20April%2029%2C%202021%20-%20WIN.gg

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.29.0.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-0-64.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin: https://win.gg
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Connection: keep-alive
Access-Control-Allow-Headers: *

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 69ms
32ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1702464393&t=pageview&_s=1&dl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&ul=en-us&de=UTF-8&dt=Has%20Corpse%20Husband%20ever%20shown%20his%20face%3F%20We%20investigate%20-%20WIN.gg&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEADQAAAAC~&jid=1870187994&gjid=854874226&cid=1252858921.1641792181&tid=UA-125662552-1&_gid=1797592701.1641792181&_r=1&gtm=2wg150598L2T6&cg1=&cg2=article&cd1=article&cd2=&cd9=Olivia%20Richman&cd11=10337&cd12=&z=226736794

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://win.gg/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://win.gg
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 87 KB
34 KB 68ms
35ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-T8SWN4K&t=gtm5&cid=1252858921.1641792181

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

71d88cd9f1c9bf1860410dc1d8fa02567af98c1190964b57e87512cfa92d0665

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35102
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 10 Jan 2022 05:23:01 GMT

GET
H2

200

popupPlugin.min.css
web-chat-plugin.picogp.com/
Redirect Chain

https://d33whie8snbuur.cloudfront.net/popupPlugin.min.css
https://web-chat-plugin.picogp.com/popupPlugin.min.css

5 KB
1 KB

50ms
50ms

Stylesheet
text/css

3.248.44.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web-chat-plugin.picogp.com/popupPlugin.min.css
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Server: 3.248.44.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-44-18.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 2d12697710766f7c49fc2aab197871003ce3012d026bd109827226ff2252e134

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 07:20:07 GMT
server: Apache
etag: "142d-5d33e407e37c0-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1252

Redirect headers

date: Sun, 09 Jan 2022 15:13:54 GMT
via: 1.1 c7015d60d4f8f2170aaaa75e69e40618.cloudfront.net (CloudFront)
server: awselb/2.0
age: 50947
x-cache: Hit from cloudfront
content-type: text/html
location: https://web-chat-plugin.picogp.com:443/popupPlugin.min.css
x-amz-cf-pop: FRA2-C2
content-length: 134
x-amz-cf-id: Aa247f1W6nibfdwIy8JPywDhD1iRMxTDkxCwaerFWKthc9YHWtLlNw==

GET
H3 200 css
fonts.googleapis.com/ 2 KB
537 B 70ms
35ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto

Requested by

Host: d33whie8snbuur.cloudfront.net
URL: https://d33whie8snbuur.cloudfront.net/popupPlugin.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7888a75eac5f8b9dc4c448f10e8dc9030fcae612cb236f1a9e9700d56ae6ef34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 04:04:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 10 Jan 2022 05:23:01 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Jan 2022 05:23:01 GMT

GET
H3 200 icon
fonts.googleapis.com/ 569 B
366 B 69ms
34ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: d33whie8snbuur.cloudfront.net
URL: https://d33whie8snbuur.cloudfront.net/popupPlugin.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

58584f5006f30da3270d3408f6a382962ee7deb22b6c79920419228f2f836bb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 05:23:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 10 Jan 2022 05:23:01 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Jan 2022 05:23:01 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 1903 0
110 B 113ms
32ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_6.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://win.gg/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://win.gg
date: Mon, 10 Jan 2022 05:22:59 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 100ms
37ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://win.gg
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 Jan 2022 13:39:48 GMT
x-content-type-options: nosniff
age: 229393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 07 Jan 2023 13:39:48 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/15154/ 401 B
543 B 38ms
38ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/15154/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/15154/code/&publishedOn=Wed%20Sep%2008%2019:30:43%20GMT%202021&ClientID=923&PageID=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/15154/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 20894fd88f2bd535d34c76c268dd9f9ca8d9cb572574d3dd7ae9f03c5a16fa00

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
cache-control: no-cache, no-store
server: nginx
content-type: text/javascript
content-length: 401
expires: Mon, 10 Jan 2022 05:23:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 8DEF 15 KB
15 KB 123ms
75ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://win.gg
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 Jan 2022 13:39:48 GMT
x-content-type-options: nosniff
age: 229393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 07 Jan 2023 13:39:48 GMT

GET
H2 200 w_480_00000.ts Show response
video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/ 473 KB
474 KB 78ms
77ms XHR
video/mp2t 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/w_480_00000.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 30a284ff4a11c4dde6aa352e197242da0c01d581dfc8bfc469123b7393e6eef8

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 91f3147e9f66b9e5e2ff9fa00ee626c0.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
content-length: 484852
last-modified: Sat, 08 Jan 2022 17:24:47 GMT
server: Tengine
etag: "fe58b674b0c67d308d36b8be655dbdf8"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: P1-5HzCbqIvBgwOd1ZvafRUQK2F8qn4_3r2v_wai5X-Do5mkVGQEqQ==
expires: Mon, 24 Jan 2022 05:23:01 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
436 B 112ms
36ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-125662552-1&cid=1252858921.1641792181&jid=1870187994&gjid=854874226&_gid=1797592701.1641792181&_u=YEBAAEACQAAAAC~&z=91263666

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b4cd4f889e2c7dd71da12d2b0a29aa6346de2e5d8b3c882d7700d64c700f661d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://win.gg/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/plain
access-control-allow-origin: https://win.gg
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 52ms
43ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://win.gg
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 Jan 2022 13:39:48 GMT
x-content-type-options: nosniff
age: 229393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 07 Jan 2023 13:39:48 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 1903 6 KB
3 KB 85ms
32ms XHR
application/javascript 13.224.198.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.198.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-198-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: L2_MRp8KwiUR7xIWXZFooLHRBfnaqY96
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 10611
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 22 Dec 2021 01:41:37 GMT
server: AmazonS3
date: Mon, 10 Jan 2022 02:57:13 GMT
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 430fc75cac3bdd04869a39405c45fba2.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: RB702faJ7epC5qbVrhvRuh8Xm07zSQrtKQUu9C6GP5wF4TCaB_IU4Q==

GET
BLOB 200
OK 9f5e3333-1ee4-4e5f-94b5-d674646c6872
https://win.gg/ 65 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://win.gg/9f5e3333-1ee4-4e5f-94b5-d674646c6872
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af

Request headers

Accept-Language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 66258
Content-Type: text/javascript

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 72AE 0
42 B 123ms
40ms Script
text/plain 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=68023495&p=159196&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D61dbc2b46b775%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:22:59 GMT
content-length: 0

GET
H2 200 023efb217eee1cbb71f657f0ff77d993.js Show response
nexus.ensighten.com/choozle/15154/code/ 1 KB
869 B 26ms
26ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/15154/code/023efb217eee1cbb71f657f0ff77d993.js?conditionId0=4912064&conditionId1=4912065
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/15154/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 96ae6a03a75db67d90cdae793dabdb904860f79f05feeaea10a4e09428719763

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 19:14:38 GMT
server: nginx
etag: W/"61390b9e-5cc"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 7e3bcccbe9be6061a65a6eb142929580.js Show response
nexus.ensighten.com/choozle/15154/code/ 2 KB
558 B 26ms
26ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/15154/code/7e3bcccbe9be6061a65a6eb142929580.js?conditionId0=421905
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/15154/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 19:09:28 GMT
server: nginx
etag: W/"61390a68-746"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

POST
H2 204 collect
analytics.google.com/g/ 0
341 B 110ms
45ms Ping
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-916JLHZYLF&gtm=2oe150&_p=1702464393&sr=1600x1200&_gaz=1&ul=en-us&cid=1252858921.1641792181&_s=1&dl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&dt=Has%20Corpse%20Husband%20ever%20shown%20his%20face%3F%20We%20investigate%20-%20WIN.gg&sid=1641792181&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.game=&ep.author=Olivia%20Richman&ep.content_type=article&ep.tag=&epn.item_id=10337
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-916JLHZYLF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://win.gg/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://win.gg
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 62ms
37ms Ping
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-916JLHZYLF&cid=1252858921.1641792181&gtm=2oe150&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-916JLHZYLF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://win.gg/
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://win.gg
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.it/ads/ 42 B
501 B 102ms
38ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-916JLHZYLF&cid=1252858921.1641792181&gtm=2oe150&aip=1&z=47155538

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pbsync.html Show response
js.adscale.de/ Frame 1096 3 KB
2 KB 110ms
26ms Document
text/html 2600:9000:21f3:d600:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:d600:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ecde72bc5d9fd5bc5150218535ae8f75ad9161924b91e64b7995c495fc90c246

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

content-type: text/html
last-modified: Mon, 06 Dec 2021 15:37:56 GMT
x-amz-version-id: 6Aq591PsFKZg.nhWoLRNYsxuGl0lv087
server: AmazonS3
content-encoding: br
date: Mon, 10 Jan 2022 04:15:19 GMT
cache-control: max-age=7200
etag: W/"5550fca00caf055568d6ced373f2721f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: p6eJNcbeWieLxCeRVDgMfsxcoNekMCBSjAxd02MURNrcoXR0bK-IxQ==
age: 4062

GET
H2 200 cookie Show response
cm.adform.net/ Frame EE31 43 B
106 B 122ms
38ms Document
image/gif 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

server: nginx
date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: image/gif
content-length: 43

GET
H2 200 user Show response
cdn.admatic.com.tr/ Frame BE0B 251 B
658 B 97ms
28ms Document
text/html 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.admatic.com.tr/user
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: 62b58b017cf4d54dc404dbc48e49b0429cbbb46678a868a95bf17664cc6340fd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/html
vary: Accept-Encoding
server: BunnyCDN-DE1-756
cdn-pullzone: 266102
cdn-uid: bea626e5-d007-4073-8941-73ce8dd2f81c
cdn-requestcountrycode: IT
cache-control: public, max-age=3600
last-modified: Thu, 11 Feb 2021 13:30:42 GMT
cdn-storageserver: DE-51
cdn-fileserver: 141
cdn-proxyver: 1.02
cdn-requestpullsuccess: True
cdn-requestpullcode: 206
cdn-cachedat: 12/27/2021 07:28:04
cdn-edgestorageid: 756
cdn-status: 200
cdn-requestid: 581ce0fbe37554671dd4d272f7e021e1
cdn-cache: HIT
content-encoding: gzip

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame 3A55 0
397 B 712ms
268ms Document
text/plain 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=502624&extuid=${USER_ID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Mon, 10 Jan 2022 05:23:01 GMT
Content-Length: 0
Etag: 8293ecdf37d1a813

GET
H/1.1

200
OK

csync Show response
sync.console.adtarget.com.tr/ Frame B350
Redirect Chain

https://creativecdn.com/cm-notify?pi=admatic
https://creativecdn.com/cm-notify?pi=admatic&tc=1
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=XO4ac5hsBnamB2x1KaAv&pi=admatic&tc=1

0
407 B

564ms
269ms

Document
text/plain

62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=XO4ac5hsBnamB2x1KaAv&pi=admatic&tc=1
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Mon, 10 Jan 2022 05:23:01 GMT
Content-Length: 0
Etag: 8293ecdf37d1a813

Redirect headers

date: Mon, 10 Jan 2022 05:23:01 GMT Mon, 10 Jan 2022 05:23:01 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=XO4ac5hsBnamB2x1KaAv&pi=admatic&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H2

200

/ Show response
ads.us.e-planning.net/uspd/1/ Frame DF75
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

2 KB
1 KB

42ms
42ms

Document
text/html

5.178.65.245
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.245 Woerden, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 0ef12a7eee7a0a906d2cb5f3f67dfea464f0c4ee04aee516ecd30ca2af974a1d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

server: openresty
date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/html
cache-control: max-age=0, no-cache
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
expires: Mon, 10 Jan 2022 05:23:01 GMT
x-sid: AMS-601
content-encoding: gzip

Redirect headers

server: openresty
date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/html; charset=iso-8859-1
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
location: /uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
x-sid: AMS-601

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 1B00 14 KB
5 KB 39ms
39ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=29585
expires: Mon, 10 Jan 2022 13:36:06 GMT
date: Mon, 10 Jan 2022 05:23:01 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame FA22 43 B
331 B 592ms
47ms Image
image/gif 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?redir=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: VertaMedia 1.0
Etag: 8293ecdf37d1a813
Content-Length: 43
Content-Type: image/gif

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 1903 375 KB
124 KB 118ms
48ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d7fcc6fcc8f7cad5e4057c7add47caf4bf89bf5368158fe7a7285c0f63a1733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126524
x-xss-protection: 0
expires: Mon, 10 Jan 2022 05:23:01 GMT

GET
H2

200

362358.gif
idsync.rlcdn.com/
Redirect Chain

https://cs.choozle.com/dp/chz/24899?d=win.gg&cb=1467014941
https://cs.choozle.com/sync
https://cs.choozle.com/sync?v=true&cid=bc7464c1-08cd-4dc3-99f7-9986072b031e
https://tags.bluekai.com/site/48443?id=bc7464c1-08cd-4dc3-99f7-9986072b031e&limit=1&redir=https%3A%2F%2Fcs.choozle.com%2Fsync%3Fpid%3D%24_BK_UUID%26dpsync%3Dbk%26cid%3Dbc7464c1-08cd-4dc3-99f7-99860...
https://cs.choozle.com/sync?pid=$_BK_UUID&dpsync=bk&cid=bc7464c1-08cd-4dc3-99f7-9986072b031e
https://match.adsrvr.org/track/cmf/generic?ttd_puid=bc7464c1-08cd-4dc3-99f7-9986072b031e&ttd_pid=gdmv7qs&ttd_tpi=1
https://cs.choozle.com/sync?pid=2351059f-09cc-4d11-a82c-70bde096ba49&dpsync=ttd&cid=bc7464c1-08cd-4dc3-99f7-9986072b031e
https://idsync.rlcdn.com/459489.gif?partner_uid=bc7464c1-08cd-4dc3-99f7-9986072b031e
https://idsync.rlcdn.com/1000.gif?memo=COGFHBIwCiwIARCp7AEaJGJjNzQ2NGMxLTA4Y2QtNGRjMy05OWY3LTk5ODYwNzJiMDMxZRAAGg0ItoXvjgYSBQjoBxAAQgBKAA
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm=&google_tc=
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEH3NOoSj1Pt1Y9aj2El-wKI&google_cver=1

42 B
316 B

33ms
33ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEH3NOoSj1Pt1Y9aj2El-wKI&google_cver=1
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEH3NOoSj1Pt1Y9aj2El-wKI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 106ms
38ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-125662552-1&cid=1252858921.1641792181&jid=1870187994&_u=YEBAAEACQAAAAC~&z=219287925

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.it/ads/ 42 B
107 B 36ms
36ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-125662552-1&cid=1252858921.1641792181&jid=1870187994&_u=YEBAAEACQAAAAC~&z=219287925

Requested by

Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bundle.js Show response
cdn.admatic.com.tr/user/ Frame BE0B 54 KB
20 KB 32ms
32ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.admatic.com.tr/user/bundle.js
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: 8b5cbe512fbb056de7aa42963d3bac7e38adb05e32fbe6f502b4fad3cabf57fc

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://cdn.admatic.com.tr/user
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: br
cdn-edgestorageid: 756
cdn-fileserver: 141
cdn-storageserver: DE-199
cdn-cachedat: 12/27/2021 09:53:15
cdn-pullzone: 266102
server: BunnyCDN-DE1-756
last-modified: Fri, 12 Mar 2021 04:24:48 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
etag: W/"604aed10-d908"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
cdn-uid: bea626e5-d007-4073-8941-73ce8dd2f81c
cache-control: public, max-age=3600
cdn-requestid: aa843c87f300f0ec9d8d91c724c1e16f
cdn-requestcountrycode: IT
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2

200

uu Show response
ih.adscale.de/ Frame 1096
Redirect Chain

https://ih.adscale.de/uu?cbfn=receive&t=1641792181
https://ih.adscale.de/uu?cbfn=receive&t=1641792181&nut&uu=b1d7933e98dd4ef98586e051b891600d

44 B
214 B

26ms
26ms

Script
text/javascript

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/uu?cbfn=receive&t=1641792181&nut&uu=b1d7933e98dd4ef98586e051b891600d
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: cdba8159f5be3c833a4b69c53aa29e7e13e82282be59843a74193a8e4480f1b8

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-length: 44
content-type: text/javascript;charset=ISO-8859-1

Redirect headers

location: https://ih.adscale.de/uu?cbfn=receive&t=1641792181&nut&uu=b1d7933e98dd4ef98586e051b891600d
date: Mon, 10 Jan 2022 05:23:01 GMT
content-length: 0

GET
H2 200 user Show response
ads3.admatic.com.tr/ Frame BE0B 77 B
444 B 195ms
72ms XHR
application/json 188.132.147.236
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 188.132.147.236 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-236-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: cb1a7628ac13de4472c6cd0b85d874e288d8c19c401984078b09f5bbb14d8b2f

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: br
server: AdMatic
x-powered-by: AdMatic
vary: Origin,Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 81

GET
H2

200

um
u-ams02.e-planning.net/ Frame DF75
Redirect Chain

https://pixel.sitescout.com/dmp/pixelSync?network=EPLANNING&rurl=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D%7BUSER_ID%7D%26dc%3D0abbcb4eba840e59%26fi%3D8e205aefdc17fe5e
https://u-ams02.e-planning.net/um?uid=no-consent&dc=0abbcb4eba840e59&fi=8e205aefdc17fe5e

42 B
103 B

68ms
38ms

Image
image/gif

5.178.65.245
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams02.e-planning.net/um?uid=no-consent&dc=0abbcb4eba840e59&fi=8e205aefdc17fe5e
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 5.178.65.245 Woerden, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
server: openresty
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://u-ams02.e-planning.net/um?uid=no-consent&dc=0abbcb4eba840e59&fi=8e205aefdc17fe5e
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 dataxpand_28122020.js Show response
s.e-planning.net/esb/4/1/3fb8/8a4272ba9ae263fe/ Frame DF75 39 KB
14 KB 178ms
80ms Script
application/x-javascript 5.178.65.253
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/1/3fb8/8a4272ba9ae263fe/dataxpand_28122020.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.253 Woerden, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: i.e-planning.net
Software: openresty /
Resource Hash: 792e8d90eda8320b9bad0aa1aa9b98cb609ac3a72a642e6d370f40131c88ebe4

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
last-modified: Mon, 28 Dec 2020 16:45:03 GMT
server: openresty
etag: W/"5fea0b8f-9a72"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Sat, 09 Jan 2027 05:23:01 GMT

GET
H2 200 prebid
rtb.openx.net/sync/ Frame DF75 43 B
351 B 69ms
34ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeebd%26fi%3D8e205aefdc17fe5e%26uid%3D%24%7BUID%7D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ojprhil60p7lti65sqq846njk3csjj1t

GET
H/1.1 200 ptag Show response
a.audrte.com/ Frame DF75 5 KB
2 KB 462ms
114ms Script
text/plain 3.228.116.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptag?p=M1353665098
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.116.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-116-73.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 5f6712e48d170147488d16a249b7f40f1b480a017742ab14a4b526ef6c777efe

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-transform, public, max-age=3600
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1683

GET
H2 200 lotame.js Show response
s.e-planning.net/esb/4/1/3fb8/69b1486c74a3b7dc/ Frame DF75 266 B
415 B 178ms
81ms Script
application/x-javascript 5.178.65.253
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/1/3fb8/69b1486c74a3b7dc/lotame.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.253 Woerden, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: i.e-planning.net
Software: openresty /
Resource Hash: 76d1da9e9902ccf3d2983b706151d7c4f1a910c86b757fae4302ccf989c630a7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
last-modified: Thu, 19 Nov 2020 16:18:03 GMT
server: openresty
etag: W/"5fb69abb-10a"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Sat, 09 Jan 2027 05:23:01 GMT

GET
H2

200

/
sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/ Frame DF75
Redirect Chain

https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=25BiP9IMgN&r=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D[PDID]%26dc%3Dfabfd6762b833237%26fi%3D8e205aefdc17fe5e
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F

95 B
222 B

31ms
31ms

Image
image/png

168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

Redirect headers

location: https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
date: Mon, 10 Jan 2022 05:23:01 GMT
server: nginx/1.14.2
content-type: text/html; charset=UTF-8

GET
H2

200

um
u-ams02.e-planning.net/ Frame DF75
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3D8e205aefdc17fe5e%26uid%3D%24UID
https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=8e205aefdc17fe5e&uid=7764980466689436379

42 B
104 B

123ms
38ms

Image
image/gif

5.178.65.245
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=8e205aefdc17fe5e&uid=7764980466689436379
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 5.178.65.245 Woerden, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
server: openresty
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:01 GMT
X-Proxy-Origin: 192.145.127.215; 192.145.127.215; 534.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0ddc1ec4-3254-42b4-8c78-397680c75ffa
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=8e205aefdc17fe5e&uid=7764980466689436379
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 7FBB
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=12186&endpoint=eu
https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu

281 B
410 B

46ms
38ms

Document
text/html

23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

server: Apache/2.2.15 (CentOS)
last-modified: Tue, 14 Dec 2021 23:07:59 GMT
etag: "402b2-119-5d32342a551c0"
accept-ranges: bytes
content-encoding: gzip
content-length: 233
content-type: text/html; charset=UTF-8
date: Mon, 10 Jan 2022 05:23:01 GMT
vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
date: Mon, 10 Jan 2022 05:23:01 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 117E 14 KB
5 KB 28ms
27ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D8e205aefdc17fe5e%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=29585
expires: Mon, 10 Jan 2022 13:36:06 GMT
date: Mon, 10 Jan 2022 05:23:01 GMT
vary: Accept-Encoding

GET
H2 200 w_480_00001.ts Show response
video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/ 459 KB
460 KB 41ms
41ms XHR
video/mp2t 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/w_480_00001.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 4de6ac9a7dc216abb5853006199694ff55cc18bc124558eeaefda5db45ca22ca

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
content-length: 469624
last-modified: Sat, 08 Jan 2022 17:24:47 GMT
server: Tengine
etag: "ab97d65cc84ac2e77068b0045ee41433"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: K8xJX0Yel4L7TtO3ndNMLQabCqbmim1Hk43zC90YIrOWJV3O4RsL-g==
expires: Mon, 24 Jan 2022 05:23:01 GMT

GET
H2 200 userconnect.js Show response
js.adscale.de/ Frame 1096 14 KB
5 KB 27ms
25ms Script
application/javascript 2600:9000:21f3:d600:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/userconnect.js
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:d600:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58ed344732766704ee535508e3dcd8d4a8ec0c9c79d16adf02293adde110926c

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: .aJwg_KmjGd9NAOcsIdaU7E4wOJILkbc
content-encoding: br
last-modified: Mon, 06 Dec 2021 15:37:56 GMT
server: AmazonS3
age: 5630
etag: W/"98f37b242862929d9aef4bde91abc8ad"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Mon, 10 Jan 2022 03:49:12 GMT
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: aKwaAjsJ6kYotZnLshH251EDeH6jtzRe3RaG29dQqh5p6rHh47PoIw==

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame 1096 0
419 B 625ms
268ms Image
text/plain 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307565&extuid=b1d7933e98dd4ef98586e051b891600d
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: VertaMedia 1.0
Etag: 4f06352ba3aadf67
Content-Length: 0

GET
H3 200 bridge3.494.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 3459 598 KB
194 KB 78ms
44ms Document
text/html 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.494.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aa900c43537f2033211adb263b21e424397bc66aba2383df7ad62e7d4e9a075

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/

Response headers

cross-origin-resource-policy: cross-origin
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 198941
date: Sat, 08 Jan 2022 17:35:07 GMT
expires: Sun, 08 Jan 2023 17:35:07 GMT
last-modified: Tue, 04 Jan 2022 16:08:31 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 128874
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 1903 44 KB
17 KB 94ms
34ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 10 Jan 2022 05:23:01 GMT

GET
H2 200 userconnect Show response
ih.adscale.de/ Frame 1096 149 B
224 B 35ms
34ms Script
application/javascript 18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/userconnect?ssl=1&sid=0&cbfn=stroeerCoreConnect&ts=1641792181444&umd=false&gdpr=0&gdpr_version=2&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3516496d97f72bf509cf5d6902b5deebf53355ccb21127dc777d265cd96ca2d8

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-length: 149
content-type: application/javascript

GET
H2 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 9E12 37 KB
13 KB 108ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:00:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1364
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 10 Jan 2022 06:00:17 GMT

GET
H/1.1

200
OK

iframe Show response
d1eoo1tco6rr5e.cloudfront.net/2tetedh/g27akpq/ Frame D0B2
Redirect Chain

https://insight.adsrvr.org/tags/2tetedh/g27akpq/iframe
https://d1eoo1tco6rr5e.cloudfront.net/2tetedh/g27akpq/iframe

138 B
667 B

131ms
43ms

Document
text/html

13.225.83.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1eoo1tco6rr5e.cloudfront.net/2tetedh/g27akpq/iframe
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/15154/code/023efb217eee1cbb71f657f0ff77d993.js?conditionId0=4912064&conditionId1=4912065
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.83.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-83-200.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b98d73c9da43ab088e858bcfadfa96208819a10c743b730ccf229e427655cd82

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/

Response headers

Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Last-Modified: Fri, 01 Oct 2021 23:46:10 GMT
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Server: AmazonS3
Date: Mon, 10 Jan 2022 01:52:11 GMT
Cache-Control: max-age=86400
ETag: "8c0625cd3448e60af6c1f4784d6f3573"
X-Cache: Hit from cloudfront
Via: 1.1 882f747f39885162595630c95dd0012c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
X-Amz-Cf-Id: _7eLi2LyOQipRc75yeN0WnD2P5G1jCEJrcPZLol5OttkrIkjFEbBwg==
Age: 14351

Redirect headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/html; charset=UTF-8
content-length: 183
location: https://d1eoo1tco6rr5e.cloudfront.net/2tetedh/g27akpq/iframe
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET

GET
H2 200 w_480_00002.ts Show response
video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/ 451 KB
452 KB 47ms
47ms XHR
video/mp2t 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/w_480_00002.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 060d57b33079a59663a2f02c9b1872c583fac0829a1ef198b4fd9ea20c198d7a

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 fac12edd3ea2d7d16f6e74eebe042dcc.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
content-length: 461728
last-modified: Sat, 08 Jan 2022 17:24:47 GMT
server: Tengine
etag: "ba9c3f7803d8c4e19c1958f67f176b47"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: biNna0HGksdqV1eFe3MB1cY3HvbrcJTqqr3unl2vCIvqM6j9PtTbvQ==
expires: Mon, 24 Jan 2022 05:23:01 GMT

GET
H2 200 map Show response
ih.adscale.de/ Frame A7E7 3 KB
3 KB 38ms
37ms Document
text/html 18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 4525353b717ebb3afd8def25f8f371935171f1110238f89bcffb55a25c531dca

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://js.adscale.de/

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/html;charset=ISO-8859-1
content-length: 2604

GET
H2 200 new Show response
ads3.admatic.com.tr/user/ Frame BE0B 171 B
313 B 61ms
61ms XHR
application/json 188.132.147.236
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user/new
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 188.132.147.236 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-236-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: a74b0e131549f4568fc46a8c664b702aa127ccca487b6d678951418378802e27

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: br
etag: GQmoSxDjAT5noXsMafPHhjD5Fg3ogbc9O2TWtZftxDjQqWHXeuqwaAgbbN7fik19tmQu9IzpiIh3mLblB-9VQA
last-modified: Mon, 10 Jan 2022 06:23:01 GMT
server: AdMatic
x-powered-by: AdMatic
vary: Origin,Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 175

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 3824 2 KB
814 B 87ms
29ms Document
text/html 51.75.86.98
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5927d926323dc2c

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.75.86.98 , France, ASN16276 (OVH, FR),

Reverse DNS

ip98.ip-51-75-86.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2 200 / Show response
spl.zeotap.com/ Frame 4F38 7 KB
2 KB 87ms
40ms Document
text/html 2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80001a82cc9cf3004898d8522e34d91dbf25ecde2d0f8946abfb4876b0161316

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/html
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://ads.us.e-planning.net
vary: Origin
via: 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6cb3788edfd15a31-MXP
content-encoding: br

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 7FBB 32 KB
10 KB 38ms
38ms Script
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: cefe33c78eb7f63c40d3f5866e9d17d1308a04befd68069df84308b9b8e8f9d9

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
content-encoding: gzip
last-modified: Wed, 15 Dec 2021 23:04:08 GMT
server: Apache/2.2.15 (CentOS)
x-powered-by: PHP/5.3.3
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control: max-age=81164
content-type: text/html; charset=UTF-8
content-length: 9706
expires: Tue, 11 Jan 2022 03:55:45 GMT

GET
H2 200 match.js Show response
js.adscale.de/ Frame A7E7 4 KB
2 KB 25ms
25ms Script
application/javascript 2600:9000:21f3:d600:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/match.js
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:d600:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 91b4eb09154d5ebef46352e922194ec6dbb9547b63f9776ae10133fe1ca66879

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: fd5SxP75_inNwuwuiiECHv1D808VkMYU
content-encoding: br
last-modified: Mon, 06 Dec 2021 15:37:56 GMT
server: AmazonS3
age: 6786
etag: W/"b75124846aec28a28b7a3441813682d5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Mon, 10 Jan 2022 03:29:55 GMT
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: ULJRJqbMv3VkRLilcsgVke25i4l_zIe83S1tX5-4txd_jauDfVbgaA==

GET
H2 200 w_480_00003.ts Show response
video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/ 500 KB
501 KB 40ms
40ms XHR
video/mp2t 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/w_480_00003.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 077b5e235416d83b181de15985af232067d458cfce04c3f32013701676a79873

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 89f400f550feb1d74a18ecb2070103ac.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
content-length: 512300
last-modified: Sat, 08 Jan 2022 17:24:47 GMT
server: Tengine
etag: "b53ab91a09a532fe76a4bfc3e4abc1d8"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: OgjgjxElMIpDcK50MB_KuNJ1coUcGeCyc45mltGGqLWti3cSTFdjoQ==
expires: Mon, 24 Jan 2022 05:23:01 GMT

GET
H2

200

img
ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/ Frame A7E7
Redirect Chain

https://bbnaut.ibillboard.com/match/AdScale?partneruid=b1d7933e98dd4ef98586e051b891600d&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg%3Ftpid%...
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=101&tpuid=BBID-01-03165061816685748-16495416

49 B
465 B

28ms
28ms

Image
image/gif

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=101&tpuid=BBID-01-03165061816685748-16495416
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: nginx
Transfer-Encoding: chunked
p3p: CP="CUR ADM DEV OUR STP PRE DSP NOI COR NID"
Location: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=101&tpuid=BBID-01-03165061816685748-16495416
Cache-Control: private, max-age=3600
Access-Control-Allow-Credentials: true
Connection: close

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame BE0B 0
473 B 464ms
268ms Image
text/plain 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=314221&extuid=BWgd3RZ6H5hEP3YrHjYO2DEjhvtJYyT8JB23SF5MX7OSSM2zxuLOqw3KDXoKnB_rh9hENWGb_t473R4_jHUT5A
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: VertaMedia 1.0
Etag: c6de41986628bb02
Content-Length: 0

GET
H2 200 w_480_00004.ts Show response
video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/ 401 KB
402 KB 42ms
42ms XHR
video/mp2t 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/w_480_00004.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 21e9ee2e38830c38635c52f29c8e83ec4b9e584f973a6212548ec7b42f0e3eb6

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 63c9a084de27504ef34be3673921d01e.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
content-length: 410780
last-modified: Sat, 08 Jan 2022 17:24:47 GMT
server: Tengine
etag: "cd226e7c09a3a198e75566e345466c3e"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: Nf7CB3AuAovF6sq5qZ67J3VXJIUjZV7KpTVxqB3S2ONGSB-cS8u8UA==
expires: Mon, 24 Jan 2022 05:23:01 GMT

GET
H/1.1 400
Request failed due to privacy signals getuid
ib.adnxs.com/ Frame 4F38 0
0 25ms
25ms Image
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 4F38 170 B
502 B 121ms
41ms Image
image/png 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://pixel.tapad.com/idsync/ex/push?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26...
https://pixel.tapad.com/idsync/ex/push/check?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent...
https://mwzeom.zeotap.com/mw?cid=ada82a20-5acb-4151-824f-24c65ea74790&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84...

95 B
153 B

34ms
32ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=ada82a20-5acb-4151-824f-24c65ea74790&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37890594d5a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=ada82a20-5acb-4151-824f-24c65ea74790&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 403 /
dmp.adform.net/serving/cookie/match/ Frame 4F38 0
331 B 123ms
40ms Image
text/plain 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1105&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7...
https://match.adsrvr.org/track/cmb/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7...
https://mwzeom.zeotap.com/mw?cid=2351059f-09cc-4d11-a82c-70bde096ba49&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84...

95 B
153 B

35ms
35ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=2351059f-09cc-4d11-a82c-70bde096ba49&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37890796f5a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://mwzeom.zeotap.com/mw?cid=2351059f-09cc-4d11-a82c-70bde096ba49&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 481

GET
H2 200 cm
trc.taboola.com/sg/zeotap/1/ Frame 4F38 0
163 B 78ms
42ms Image
text/plain 2a04:4e42:600::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/zeotap/1/cm?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-vcl-time-ms: 27
date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 varnish
server: nginx
x-timer: S1641792182.730481,VS0,VE27
x-cache: MISS
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
x-served-by: cache-mxp6974-MXP

GET
H/1.1 200
OK u
dmp.v.fwmrm.net/ad/ Frame 4F38 0
361 B 553ms
117ms Image
text/html 2607:ae80:2::48
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.v.fwmrm.net/ad/u?mode=echo&cr=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1368%26env%3DmWeb%26cid%3D%23%7Buser.id%7D%26gdpr%3D%24%7BGDPR_ENFORCED%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2607:ae80:2::48 , United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:02 GMT
Cache-Control: no-store
Expires: 0
Content-Type: text/html
Content-Length: 0
P3P: policyref="https://www.freewheel.tv/w3c/p3p.xml",CP="ALL DSP COR NID"

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 4F38 0
163 B 40ms
38ms Image
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?gdpr=1&gdpr_consent=&rd=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1384%26env%3DmWeb%26cid%3D%23PM_USER_ID%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec5e9-ebae-402e-4312-5e26fde56cae%26reqId%3D7055cb8f-b086-4c84-528e-520d4cb60a2d%26zdid%3D1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=d16ec5e9-ebae-402e-4312-5e26fde56cae&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3D...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=199624&dpuuid=d16ec5e9-ebae-402e-4312-5e26fde56cae&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env...
https://mwzeom.zeotap.com/mw?cid=78044285237347154821385584713144225103&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-...

95 B
153 B

39ms
39ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=78044285237347154821385584713144225103&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb378914a595a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

DCS: dcs-prod-irl1-2-v026-0f18d6584.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: VwQyYjr/QkE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://mwzeom.zeotap.com/mw?cid=78044285237347154821385584713144225103&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://loadeu.exelator.com/load/?p=709&g=008&j=0&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
https://loadeu.exelator.com/load/?p=709&g=008&j=0&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&xl8b...
https://mwzeom.zeotap.com/mw?cid=72f76f09f3b5b44d43db9b7e57cbc327&zpartnerid=7&zdid=1361&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&w_k=&user_zi=&gdpr=&gdpr_consent=&optin=&uc=&z_p=&zem1=&zem2=&zem...

95 B
153 B

35ms
34ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=72f76f09f3b5b44d43db9b7e57cbc327&zpartnerid=7&zdid=1361&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&w_k=&user_zi=&gdpr=&gdpr_consent=&optin=&uc=&z_p=&zem1=&zem2=&zem3=&zem4=&zem5=&zem6=&zph1=&zph2=&zph3=&zph4=&zph5=&zph6=&z_e_sha2_l=&z_e_sha2_u=&z_p_sha2_w=&z_p_sha2_wo=&email_hash=&zcluid=
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37890897a5a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

date: Mon, 10 Jan 2022 05:23:01 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://mwzeom.zeotap.com/mw?cid=72f76f09f3b5b44d43db9b7e57cbc327&zpartnerid=7&zdid=1361&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&w_k=&user_zi=&gdpr=&gdpr_consent=&optin=&uc=&z_p=&zem1=&zem2=&zem3=&zem4=&zem5=&zem6=&zph1=&zph2=&zph3=&zph4=&zph5=&zph6=&z_e_sha2_l=&z_e_sha2_u=&z_p_sha2_w=&z_p_sha2_wo=&email_hash=&zcluid=
cache-control: no-cache
access-control-allow-credentials: true
content-type: image/gif
content-length: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://bn01.er.bemail.it/zeotap.php?_bid=d16ec5e9-ebae-402e-4312-5e26fde56cae&_from=Zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-...
https://mwzeom.zeotap.com/mw?cid=BE1-2022011006-60112-0.194072001641792172-960b583235d7f6d8ace35147aa7b9a7f&zdid=533&env=mWeb

95 B
164 B

42ms
34ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=BE1-2022011006-60112-0.194072001641792172-960b583235d7f6d8ace35147aa7b9a7f&zdid=533&env=mWeb
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37890392f5a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

Location: https://mwzeom.zeotap.com/mw?cid=BE1-2022011006-60112-0.194072001641792172-960b583235d7f6d8ace35147aa7b9a7f&zdid=533&env=mWeb
Date: Mon, 10 Jan 2022 05:22:52 GMT
Server: nginx/1.10.2
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Transfer-Encoding: chunked
Content-Type: text/html

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame 4F38
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2885&partner_device_id=d16ec5e9-ebae-402e-4312-5e26fde56cae
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=d16ec5e9-ebae-402e-4312-5e26fde56cae

95 B
424 B

33ms
33ms

Image
image/png

35.227.248.159
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=d16ec5e9-ebae-402e-4312-5e26fde56cae

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

Protocol

Server

35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

159.248.227.35.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
content-type: image/png
alt-svc: clear
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=d16ec5e9-ebae-402e-4312-5e26fde56cae
date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://idsync.frontend.weborama.fr/ids?key=zeotap&value=d16ec5e9-ebae-402e-4312-5e26fde56cae&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://idsync.frontend.weborama.fr/ids?key=zeotap&value=d16ec5e9-ebae-402e-4312-5e26fde56cae&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://mwzeom.zeotap.com/mw?webouuid=xhZmuFJqH2pkXTcFFY0qJu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c...

95 B
153 B

33ms
33ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?webouuid=xhZmuFJqH2pkXTcFFY0qJu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37890d9ec5a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
last-modified: Mon, 10 Jan 2022 05:23:01 GMT
server: nginx/1.12.0
location: https://mwzeom.zeotap.com/mw?webouuid=xhZmuFJqH2pkXTcFFY0qJu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://bcp.crwdcntrl.net/map/c=13620/tp=ZEOT/tpid=d16ec5e9-ebae-402e-4312-5e26fde56cae?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_con...
https://bcp.crwdcntrl.net/map/ct=y/c=13620/tp=ZEOT/tpid=d16ec5e9-ebae-402e-4312-5e26fde56cae?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdp...
https://mwzeom.zeotap.com/mw?pid=24c634d4f9eb9f38cb25da32b48fe571&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b0...

95 B
153 B

36ms
36ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?pid=24c634d4f9eb9f38cb25da32b48fe571&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37891daf45a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:02 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://mwzeom.zeotap.com/mw?pid=24c634d4f9eb9f38cb25da32b48fe571&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
cache-control: no-cache
x-server: 10.45.8.41
content-length: 0
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ZTAP
https://mwzeom.zeotap.com/mw?cid=y-mgeb6vBE2oqq0dNw1pVmlev1Vt3bS1yoXQ--~A&zpartnerid=570&env=mWeb

95 B
153 B

35ms
34ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=y-mgeb6vBE2oqq0dNw1pVmlev1Vt3bS1yoXQ--~A&zpartnerid=570&env=mWeb
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb378917a965a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

date: Mon, 10 Jan 2022 05:23:01 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: text/html;charset=utf-8
location: https://mwzeom.zeotap.com/mw?cid=y-mgeb6vBE2oqq0dNw1pVmlev1Vt3bS1yoXQ--~A&zpartnerid=570&env=mWeb
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
content-length: 0
x-content-type-options: nosniff

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=ITA&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zd...
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=ITA&zdid=1361&cid=%2BNYx%2F0Q5zD6ficY64NvmAPD%2BCp3yIbxc%2BS41iYitP1U%3D

95 B
153 B

37ms
37ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=ITA&zdid=1361&cid=%2BNYx%2F0Q5zD6ficY64NvmAPD%2BCp3yIbxc%2BS41iYitP1U%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb378913a465a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
server: AAWebServer
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=ITA&zdid=1361&cid=%2BNYx%2F0Q5zD6ficY64NvmAPD%2BCp3yIbxc%2BS41iYitP1U%3D
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2 200 v2
odr.mookie1.com/t/ Frame 4F38 43 B
324 B 71ms
34ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2?tagid=V2_746632&src.visitorId=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 4F38 0
338 B 150ms
49ms Image
text/plain 54.77.177.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=141838&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.177.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-177-229.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
cache-control: private, no-cache, no-store
x-request-time: D=57 t=1641792181
x-served-by: beacon-n015-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 /
sync.richaudience.com/1988B3F6BED450961C9D70DD91/ Frame 4F38 95 B
358 B 33ms
32ms Image
image/png 168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/1988B3F6BED450961C9D70DD91/?uuid=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_co...
https://sync-tm.everesttech.net/ct/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr...
https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=YdvCtQAEeLBx3gAm&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520...

95 B
153 B

34ms
34ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=YdvCtQAEeLBx3gAm&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&_test=YdvCtQAEeLBx3gAm
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37891daec5a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1641792182.033357,VS0,VE0
x-served-by: cache-mxp6932-MXP
x-cache: HIT
location: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=YdvCtQAEeLBx3gAm&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&_test=YdvCtQAEeLBx3gAm
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://pixel.mathtag.com/sync/img?mt_exid=10092&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%5BMM_UUID%5D%26env%3DmWeb%26zpartnerid%3D979%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_co...
https://mwzeom.zeotap.com/mw?cid=59aa61db-c2b5-4b00-abd1-63acfd497820&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8...

95 B
176 B

38ms
38ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=59aa61db-c2b5-4b00-abd1-63acfd497820&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb378916a865a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: MT3 4133 baa842e master cdg-pixel-x27 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://mwzeom.zeotap.com/mw?cid=59aa61db-c2b5-4b00-abd1-63acfd497820&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Mon, 10 Jan 2022 05:23:00 GMT

GET
H/1.1 204 v1
engine.widespace.com/map/ext/api/trackingcallback/ Frame 4F38 0
76 B 166ms
53ms Image
text/plain 54.217.170.69
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://engine.widespace.com/map/ext/api/trackingcallback/v1?accessToken=zeotap-user-sync&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.217.170.69 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-217-170-69.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
server: nginx/1.20.1

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 4F38
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb6...

0
336 B

49ms
49ms

Image
text/plain

54.77.177.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 54.77.177.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-177-229.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
cache-control: private, no-cache, no-store
x-request-time: D=32 t=1641792182
x-served-by: beacon-n010-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
date: Mon, 10 Jan 2022 05:23:02 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a012-ash-prod.krxd.net

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame 4F38
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-431...
https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-431...

43 B
645 B

54ms
54ms

Image
image/gif

54.239.37.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&dcc=t

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

Protocol

HTTP/1.1

Server

54.239.37.23 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:02 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: D37NG0XR5N40KKZRWW7T
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:02 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: GWJY2HGNY2VDSNHKRBT1
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=d16ec5e9-ebae-402e-4312-5e26fde56cae&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://tags.bluekai.com/site/87734?id=d16ec5e9-ebae-402e-4312-5e26fde56cae&gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1202%26env%3DmWeb%26cid%3D%24_BK_UUID%26BK...
https://mwzeom.zeotap.com/mw?zpartnerid=1202&env=mWeb&cid=$_BK_UUID&BK_SWAP_DEST=87734

95 B
153 B

34ms
34ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1202&env=mWeb&cid=$_BK_UUID&BK_SWAP_DEST=87734
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb37892dbd75a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

Location: https://mwzeom.zeotap.com/mw?zpartnerid=1202&env=mWeb&cid=$_BK_UUID&BK_SWAP_DEST=87734
Date: Mon, 10 Jan 2022 05:23:02 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: f05e
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 4F38
Redirect Chain

https://obgpm76tt0a0sgozk8l.redinuid.imrworldwide.com/zeo?url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1395%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Dd16ec...
https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361

95 B
153 B

34ms
34ms

Image
image/png

2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6cb378928b895a31-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
date: Mon, 10 Jan 2022 05:23:02 GMT
cross-origin-resource-policy: cross-origin
content-length: 0

GET
H2 200 cmp.min.js Show response
spl.zeotap.com/ Frame 4F38 557 B
496 B 37ms
36ms Script
text/plain 2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/cmp.min.js?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd1bafd614713b27b10beabcd61045fa8ca08fbb758ede7d75f23c4157ed0d8d

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 6cb3788f98895a31-MXP
date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 google
cf-cache-status: MISS
last-modified: Mon, 10 Jan 2022 05:23:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
content-encoding: br
access-control-allow-headers: *

GET
H2 200 w_480_00005.ts Show response
video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/ 463 KB
464 KB 39ms
39ms XHR
video/mp2t 194.146.38.187
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn5/video/users/hls/29909/video_5f6af001aae1b264352045/vid61d9c74ac8117075964632.mp4/w_480_00005.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.146.38.187 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: b8042c2b8e66e36c18c31fee0917c96723b3a0198fb981d41402dd996752f78f

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
via: 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
content-length: 474136
last-modified: Sat, 08 Jan 2022 17:24:47 GMT
server: Tengine
etag: "7afb5c99d16e856abb4a27b8c9d37ebe"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
x-proxy-cache: HIT
accept-ranges: bytes
x-amz-cf-id: kTaLUtqHnr4g0-vITHF_kzWDAXNaYndK6qXbpmEdSBIKcK_5MBeDpg==
expires: Mon, 24 Jan 2022 05:23:01 GMT

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame A7E7
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=183592&cb=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D63%26tpuid%3D__UID__&uid=da8cb481013ccbd68dcc6815b...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YdvCtaXa6ysJGwbjj1inVwAA%261826

49 B
556 B

34ms
34ms

Image
image/gif

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YdvCtaXa6ysJGwbjj1inVwAA%261826
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YdvCtaXa6ysJGwbjj1inVwAA%261826
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 310
Expires: Mon, 10 Jan 2022 05:23:01 GMT

GET
H2 204 cmp
spl.zeotap.com/ Frame 4F38 0
0 33ms
33ms Document
text/plain 2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/cmp?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361&cmp=0
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/cmp.min.js?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Response headers

date: Mon, 10 Jan 2022 05:23:01 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://spl.zeotap.com
vary: Origin
via: 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6cb3788fd8d65a31-MXP

GET
H2 200 /
insight.adsrvr.org/track/pxl/ Frame D0B2 70 B
260 B 51ms
51ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=2tetedh&ct=0:g27akpq&fmt=3
Requested by: Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/2tetedh/g27akpq/iframe
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://d1eoo1tco6rr5e.cloudfront.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 cc.js Show response
tags.crwdcntrl.net/c/15238/ Frame DF75 38 KB
11 KB 90ms
27ms Script
application/json 13.225.80.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/c/15238/cc.js?ns=_cc15238
Requested by: Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/1/3fb8/69b1486c74a3b7dc/lotame.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.80.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-80-14.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1844237c138bd410bc7fcfecd38156aa58aa2968d59889386b17de5c796e3c84

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 04:58:16 GMT
content-encoding: gzip
etag: W/"2b2f816f40499d384e118ce88a266e02"
last-modified: Thu, 02 Jul 2020 15:35:12 GMT
server: AmazonS3
age: 1489
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
via: 1.1 a10d58b5ce965502cc34c5b27682fe22.cloudfront.net (CloudFront)
cache-control: max-age: 86400
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: eKv8iPaRrsrb2hRKk_go6irwT5W_By-nF4LoIs90s23aMEY9700kGQ==

GET
H2 200 sirdata_03022021.html Show response
s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/ Frame 7CCB 636 B
577 B 37ms
34ms Document
text/html 5.178.65.253
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.253 Woerden, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: i.e-planning.net
Software: openresty /
Resource Hash: 14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

server: openresty
date: Mon, 10 Jan 2022 05:23:01 GMT
content-type: text/html
last-modified: Wed, 03 Feb 2021 21:18:20 GMT
etag: W/"601b131c-27c"
expires: Sat, 09 Jan 2027 05:23:01 GMT
cache-control: max-age=157680000
access-control-allow-origin: *
content-encoding: gzip

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame F91B 0
403 B 269ms
268ms Document
text/plain 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307442&extuid=AJzm8orJKJ6cyz8t
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

Server: VertaMedia 1.0
Date: Mon, 10 Jan 2022 05:23:01 GMT
Content-Length: 0
Etag: 8293ecdf37d1a813

GET
H/1.1 200
OK GS.d Show response
js.cookieless-data.com/ Frame 7CCB 0
535 B 117ms
36ms Script
text/plain 51.158.29.12
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://js.cookieless-data.com/GS.d?pa=24492&cmp=0&si=1&u=https%3A%2F%2Fs.e-planning.net%2Fesb%2F4%2F0%2F1992d%2Fbb6e7a161f794f56%2Fsirdata_03022021.html&r=https%3A%2F%2Fads.us.e-planning.net%2F&s=&rand=1641792181846

Requested by

Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.158.29.12 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

51-158-29-12.rev.poneytelecom.eu

Software

nginx/1.11.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains; preload
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://s.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:01 GMT
Server: nginx/1.11.3
Strict-Transport-Security: max-age=15724800; includeSubDomains; preload
P3p: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 0
X-Xss-Protection: 0
Expires: Tue, 01 Jan 2000 00:00:00 GMT

GET
H2

200

img
ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/ Frame A7E7
Redirect Chain

https://track.adform.net/serving/cookie/match/?party=9&uid=3071e27845d08a4e5e5c6785476472def62edc3b9bcd183f48f19419d6f92383&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac5...
https://track.adform.net/serving/cookie/match/?CC=1&party=9&uid=3071e27845d08a4e5e5c6785476472def62edc3b9bcd183f48f19419d6f92383&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a...
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=42&gdpr=0&tpuid=7049873714552798363

49 B
567 B

35ms
35ms

Image
image/gif

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=42&gdpr=0&tpuid=7049873714552798363
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:01 GMT
server: nginx
location: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=42&gdpr=0&tpuid=7049873714552798363
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 303 ads Show response
pagead2.googlesyndication.com/gampad/ Frame 3459 136 B
125 B 83ms
49ms XHR
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?iu=%2F21734706084%2C22144266561%2Fworldintersportsnetwork&description_url=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&env=vp&correlator=1564179580470126&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dunmvax&sdkv=h.3.494.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&gdpr=1&gdpr_consent=tcunavailable&addtl_consent=1~&sdki=44d&adk=131214266&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.494.0&sid=CA9B5903-72F5-4089-99A6-62F7EB6B53B5&nel=0&eid=44733246%2C44750604&url=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&dlt=1641792180413&idt=1273&dt=1641792181949&scor=858472028201421&ged=ve4_td2_tt0_pd2_la2000_er964.-2757.1117.-2457_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.494.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

106b39f48e91ecd4e58145357095e1014ceba98a7b71c81e2a9388a36be77732

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-creative-id: -2
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame A7E7
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%40%40&u...
https://widget.eu.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%4...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=20836669-f583-457c-be50-0c79df1a53f7&gdpr=0

49 B
590 B

27ms
27ms

Image
image/gif

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=20836669-f583-457c-be50-0c79df1a53f7&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:02 GMT
server: Kestrel
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=20836669-f583-457c-be50-0c79df1a53f7&gdpr=0
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2300857
content-length: 0
expires: Mon, 10 Jan 2022 00:00:00 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 7FBB 284 B
536 B 709ms
177ms Image
image/jpg 8.39.36.142
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 8.39.36.142 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 5e3ed5b16ff95387d0b9d1c5e78ff6a2
Content-Type: image/jpg

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2D65 14 KB
5 KB 26ms
25ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156595&gdpr=1&gdpr_consent=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_6.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=29584
expires: Mon, 10 Jan 2022 13:36:06 GMT
date: Mon, 10 Jan 2022 05:23:02 GMT
vary: Accept-Encoding

GET
H/1.1 200 ptrack Show response
a.audrte.com/ Frame DF75 368 B
880 B 138ms
138ms XHR
text/plain 3.228.116.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptrack?arlocation=192.145.127.215&p=M1353665098&artime=2022-01-10T05:23:02.296Z&arlocation=YWRzLnVzLmUtcGxhbm5pbmcubmV0L3VzcGQvMT9jdD0xJmR1PWh0dHBzJTNBJTJGJTJGc3luYy5jb25zb2xlLmFkdGFyZ2V0LmNvbS50ciUyRmNzeW5jJTNGdCUzRGElMjZlcCUzRDMwNzQ0MiUyNmV4dHVpZCUzRCUyNFVJRA==&gdpr=0&gdpr_consent=null&gdpr_version=1&arreferer=cy5jb25zb2xlLmFkdGFyZ2V0LmNvbS50ci8=
Requested by: Host: a.audrte.com
URL: https://a.audrte.com/ptag?p=M1353665098
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.116.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-116-73.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: da3380884cb6b16f6200ceb897762ab0b596fb4f9238a76a659a6d0feb67c6e2

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:02 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: https://ads.us.e-planning.net
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 263

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame DF75
Redirect Chain

https://dmp.adform.net/serving/cookie/match/?party=1003&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=7049873714552798363
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent=&google_gid=CAESEGuyQ6MA4236CSPYC_bVpvg&google_cver=1
https://ps.eyeota.net/match?bid=kh51m51&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=

70 B
440 B

32ms
32ms

Image
image/gif

3.122.214.165
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=kh51m51&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Server: 3.122.214.165 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-214-165.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:02 GMT
Content-Type: image/gif
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Date: Mon, 10 Jan 2022 05:23:02 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://ps.eyeota.net/match?bid=kh51m51&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

p
a.audrte.com/ Frame DF75
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm=&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=&google_tc=
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=&google_gid=CAESEGuyQ6MA4236CSPYC_bVpvg&google_cver=1
https://a.audrte.com/p

68 B
617 B

168ms
113ms

Image
image/png

3.228.116.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Server: 3.228.116.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-116-73.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:02 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Mon, 10 Jan 2022 05:23:02 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/ Frame DF75
Redirect Chain

https://ps.eyeota.net/pixel?pid=kh51m51&t=ajs&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=
https://ps.eyeota.net/pixel/bounce/?pid=kh51m51&t=ajs&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=

1 KB
1 KB

26ms
26ms

Image
application/javascript

3.122.214.165
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=kh51m51&t=ajs&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Server: 3.122.214.165 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-214-165.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 10 Jan 2022 05:23:02 GMT
Content-Type: application/javascript
Content-Length: 1218
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /pixel/bounce/?pid=kh51m51&t=ajs&uid=4862xcsOIDETfev15P602wVpA&gdpr=0&gdpr_consent=
Date: Mon, 10 Jan 2022 05:23:02 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2

200

user
ads3.admatic.com.tr/ Frame BE0B
Redirect Chain

https://x.bidswitch.net/sync?ssp=admatic
https://x.bidswitch.net/ul_cb/sync?ssp=admatic
https://ads.betweendigital.com/match?bidder_id=43092&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dadmatic%26expires%3D30%26user_group%3D%24%...
https://ads.betweendigital.com/match?bidder_id=43092&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Dadmatic%26expires%3D30%26user_group%3D%24%...
https://x.bidswitch.net/sync?dsp_id=429&user_id=9a1ef089-68c8-510a-a29a-d009c34112bf&ssp=admatic&expires=30&user_group=1
https://ads4.admatic.com.tr/showad/px/ums/sync/bsw?bsw_uuid=5c25e14b-061a-4e20-9ea1-2f4a2758e2b6&dsp_uuid=&dsp_id=
https://ads3.admatic.com.tr/user?bsw_uuid=5c25e14b-061a-4e20-9ea1-2f4a2758e2b6&dsp_uuid=&dsp_id=

35 B
82 B

58ms
58ms

Image
image/gif

188.132.147.236
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads3.admatic.com.tr/user?bsw_uuid=5c25e14b-061a-4e20-9ea1-2f4a2758e2b6&dsp_uuid=&dsp_id=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Server: 188.132.147.236 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-236-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:02 GMT
server: AdMatic
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
x-powered-by: AdMatic
content-type: image/gif
cache-control: no-cache
timing-allow-origin: *
content-length: 35

Redirect headers

timing-allow-origin: *
date: Mon, 10 Jan 2022 05:23:02 GMT
location: https://ads3.admatic.com.tr/user?bsw_uuid=5c25e14b-061a-4e20-9ea1-2f4a2758e2b6&dsp_uuid=&dsp_id=
x-powered-by: AdMatic
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html; charset=utf-8
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
content-length: 221

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 7FBB 0
239 B 111ms
26ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=12186
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Content-Type: image/gif

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 41ms
40ms Image
text/html 185.229.227.132
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTM2JaNypaZypyRcoWU9MTY0MTp5MwE4MCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA0NwY5JaN0YT0jJat9NmUjJax9NDI0JaZcZF9jYXNmRG9gYWyhPXqcov5aZlZmqWJJZD13nW4hZ2pzZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ1p2VlSXBBZGRlPTE5Mv4kNDUhMTI3LwIkNSZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxY4OS4jLwQmODxhNmIyMwBTYWZupzxyMxY1MmphMmYzY3N1qWyxPTYkZGJwMzI0NzI3NmUzY29hqGVhqEZcoGVJZD0jJz1yZGyuUGkurUkcp3RJZD0jJz1yZGyuTGymqEyxPTAzZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTY0MTp5MwE4Mwx2OSZ1nWQ9U2VenW5xo1NQoGF5ZXI2MWRvYmJvNDtlMmIjJaB1YyVloD1bqHRjplUmQSUlRvUlRaqcov5aZlUlRz5yq3MyMxZbYXMgY29lpHNyLWu1p2JuozQgZXZypv1mnG93ov1bnXMgZzFwZS1kqWVmqGyiov1gYXJeLXqyLWyhqzVmqGyaYXRyJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Requested by: Host: win.gg
URL: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.229.227.132 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:02 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame A7E7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D39%26tpuid%3D%5BMM_UUID%5D&uid=c754aee7295d6eec54c35002...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=59aa61db-c2b5-4b00-abd1-63acfd497820&gdpr=0&gdpr_consent=

49 B
612 B

29ms
29ms

Image
image/gif

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=59aa61db-c2b5-4b00-abd1-63acfd497820&gdpr=0&gdpr_consent=
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:03 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Mon, 10 Jan 2022 05:23:03 GMT
Server: MT3 4133 baa842e master cdg-pixel-x25 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=59aa61db-c2b5-4b00-abd1-63acfd497820&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 10 Jan 2022 05:23:02 GMT

GET
H2

200

img
ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/ Frame A7E7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&uid=45d57485ab1bb7771b369a951544591df00b2d501b7b3abc2439b9b9487cc91c&tpid=38&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313...
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?uid=45d57485ab1bb7771b369a951544591df00b2d501b7b3abc2439b9b9487cc91c&tpid=38&gdpr=0&tpuid=CAESEMLrAcGFEcd7WkXZWD6SJa8...

49 B
630 B

27ms
27ms

Image
image/gif

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?uid=45d57485ab1bb7771b369a951544591df00b2d501b7b3abc2439b9b9487cc91c&tpid=38&gdpr=0&tpuid=CAESEMLrAcGFEcd7WkXZWD6SJa8&google_cver=1
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:03 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:03 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?uid=45d57485ab1bb7771b369a951544591df00b2d501b7b3abc2439b9b9487cc91c&tpid=38&gdpr=0&tpuid=CAESEMLrAcGFEcd7WkXZWD6SJa8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 424
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

img
ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/ Frame A7E7
Redirect Chain

https://adscale-emea.adnxs.com/getuid?https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c52a82ac58f467570f3%2F1641792181505%2F0%2Fimg%3Ftpid%3D75%26tpuid%3D%24UID&gdpr=0
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=75&tpuid=7764980466689436379&gdpr=0

49 B
641 B

27ms
27ms

Image
image/gif

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=75&tpuid=7764980466689436379&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:03 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Mon, 10 Jan 2022 05:23:03 GMT
X-Proxy-Origin: 192.145.127.215; 192.145.127.215; 865.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 14c3e93e-7552-4271-977f-2b2e2ca5f337
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/img?tpid=75&tpuid=7764980466689436379&gdpr=0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

js Show response
ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/ Frame A7E7
Redirect Chain

https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=ab7cc45d6e217efe8beba602076e242d8c19ebc71a557557b0cdbe89e831e8ff&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c...
https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=ab7cc45d6e217efe8beba602076e242d8c19ebc71a557557b0cdbe89e831e8ff&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F313fb42866704c...
https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/js?tpid=48&tpuid=ab851939966e9c83dd9aded20890c2f0

44 B
586 B

32ms
32ms

Script
text/javascript

18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/js?tpid=48&tpuid=ab851939966e9c83dd9aded20890c2f0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e33375800c637fb284d80d638793c62eb1b333268ec52532efd7ab37bb3fce90

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 10 Jan 2022 05:23:03 GMT
p3p: CP=NOI PSA OUR
content-length: 44
content-type: text/javascript

Redirect headers

Date: Mon, 10 Jan 2022 05:23:03 GMT
Server: nginx
Vary: Accept
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ih.adscale.de/sium/313fb42866704c52a82ac58f467570f3/1641792181505/0/js?tpid=48&tpuid=ab851939966e9c83dd9aded20890c2f0
Connection: close
Content-Type: text/plain; charset=utf-8
Content-Length: 147

POST
H2 200 sium Show response
ih.adscale.de/ Frame A7E7 0
190 B 41ms
40ms XHR
application/json 18.196.233.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/match.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.233.14 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-14.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ih.adscale.de
date: Mon, 10 Jan 2022 05:23:03 GMT
access-control-allow-credentials: true
access-control-allow-headers: x-openrtb-version
content-length: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
26ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1702464393&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&ul=en-us&de=UTF-8&dt=Has%20Corpse%20Husband%20ever%20shown%20his%20face%3F%20We%20investigate%20-%20WIN.gg&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=10&el=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&_u=aGDAAEADQAAAAC~&jid=&gjid=&cid=1252858921.1641792181&tid=UA-125662552-1&_gid=1797592701.1641792181&gtm=2wg150598L2T6&cg1=&cg2=article&cd1=article&cd2=&cd9=Olivia%20Richman&cd11=10337&cd12=&z=1934972689

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 04:03:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 4762
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rt=ifr Show response
bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/ Frame F2E3 1 KB
2 KB 63ms
63ms Document
text/html 34.249.68.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/rt=ifr
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/c/15238/cc.js?ns=_cc15238
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.68.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-68-36.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a5137aded9975681b65e1d9992f05e9454b79c88b154aaae338e3aef9264128f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: it-IT,it;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

date: Mon, 10 Jan 2022 05:23:04 GMT
content-type: text/html;charset=utf-8
content-length: 1212
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
cache-control: no-cache
pragma: no-cache
expires: 0
x-server: 10.45.31.127
access-control-allow-origin: *
server: Jetty(9.4.38.v20210224)

GET image.sbxx
global.ib-ibi.com/ Frame F2E3 0
0

GET
H2

200

tpid=78044285237347154821385584713144225103
sync.crwdcntrl.net/map/c=9828/tp=ADBE/ Frame F2E3
Redirect Chain

https://dpm.demdex.net/ibs:dpid=121998&dpuuid=24c634d4f9eb9f38cb25da32b48fe571&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D9828%2Ftp%3DADBE%2Ftpid%3D%24%7BDD_UUID%7D
https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=78044285237347154821385584713144225103

49 B
264 B

54ms
54ms

Image
image/gif

34.249.68.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=78044285237347154821385584713144225103
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/rt=ifr
Protocol: H2
Server: 34.249.68.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-68-36.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:04 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.6.234
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

DCS: dcs-prod-irl1-2-v026-07796d6ec.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: W4EMbDqaT1Y=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=78044285237347154821385584713144225103
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

tpid=YdvCtQAEeLBx3gAm
sync.crwdcntrl.net/map/c=1811/tp=TBMG/ Frame F2E3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/bsTd8NdE?redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1811%2Ftp%3DTBMG%2Ftpid%3D%24%7BTM_USER_ID%7D
https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YdvCtQAEeLBx3gAm

49 B
264 B

69ms
54ms

Image
image/gif

34.249.68.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YdvCtQAEeLBx3gAm
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/rt=ifr
Protocol: H2
Server: 34.249.68.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-68-36.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:04 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.8.182
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:04 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1641792185.883823,VS0,VE0
x-served-by: cache-mxp6932-MXP
x-cache: HIT
location: https://sync.crwdcntrl.net/map/c=1811/tp=TBMG/tpid=YdvCtQAEeLBx3gAm
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame F2E3 170 B
188 B 45ms
44ms Image
image/png 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lotame_dmp&google_hm=MjRjNjM0ZDRmOWViOWYzOGNiMjVkYTMyYjQ4ZmU1NzE

Requested by

Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/rt=ifr

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

qmap
sync.crwdcntrl.net/ Frame F2E3
Redirect Chain

https://sync.mathtag.com/sync/img?sync=auto&mt_exid=10040&redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fqmap%3Fc%3D4735%26tp%3DMDMA%26tpid%3D%5BMM_UUID%5D
https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=59aa61db-c2b5-4b00-abd1-63acfd497820

49 B
264 B

55ms
54ms

Image
image/gif

34.249.68.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=59aa61db-c2b5-4b00-abd1-63acfd497820
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/rt=ifr
Protocol: H2
Server: 34.249.68.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-68-36.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:04 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.23.39
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

Date: Mon, 10 Jan 2022 05:23:04 GMT
Server: MT3 4133 baa842e master cdg-pixel-x26 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://sync.crwdcntrl.net/qmap?c=4735&tp=MDMA&tpid=59aa61db-c2b5-4b00-abd1-63acfd497820
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 10 Jan 2022 05:23:03 GMT

GET
H2 204 usersync
pixel-sync.sitescout.com/connectors/lotame/ Frame F2E3 0
191 B 47ms
46ms Image
text/plain 66.155.71.150
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/connectors/lotame/usersync?redir=https%3A%2F%2Fsync.crwdcntrl.net%2Fmap%2Fc%3D1389%2Ftp%3DSTSC%2Ftpid%3D%24UUID
Requested by: Host: bcp.crwdcntrl.net
URL: https://bcp.crwdcntrl.net/5/c=15238/rand=740968989/pv=y/amskip=Y/pltfrm=%23OpR%2399944%23ads.us.e-planning.net%20%3A%20Referral%20Site%20%3A%20s.console.adtarget.com.tr/rt=ifr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.150 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://bcp.crwdcntrl.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 05:23:04 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

POST
H2 200 admin-ajax.php Show response
win.gg/wp-admin/ 0
271 B 181ms
181ms XHR
text/html 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://win.gg/wp-admin/admin-ajax.php

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
X-Requested-With: XMLHttpRequest
Accept-Language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 10 Jan 2022 05:23:05 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 0
expires: Wed, 11 Jan 1984 05:00:00 GMT
x-ezoic-cdn: Bypass
x-cache: MISS, MISS
x-middleton-display: staticcontent_sol
x-cache-hits: 0, 0
x-middleton-response: 200
content-length: 0
x-served-by: cache-ams12749-AMS, cache-hhn4074-HHN
referrer-policy: strict-origin-when-cross-origin
pagespeed: off
response: 200
server: nginx
traceparent: 00-6ac3faf54b2545e5b18f9809710e13f6-5bf3ce89731f4122-00
x-timer: S1641792185.062143,VS0,VE139
x-frame-options: SAMEORIGIN
x-origin-cache-control: no-cache, must-revalidate, max-age=0
vary: Accept-Encoding, Accept-Encoding,Cookie,Origin
strict-transport-security: max-age=300
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://win.gg
x-cloud-trace-context: 6ac3faf54b2545e5b18f9809710e13f6/6625866566529401122;o=0
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
x-styx-req-id: 635d7f3e-71d5-11ec-bb6c-123717a32574
display: staticcontent_sol
x-pantheon-styx-hostname: styx-fe3fe4-c-ccc8c45c8-wkq9c

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
25ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1702464393&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&ul=en-us&de=UTF-8&dt=Has%20Corpse%20Husband%20ever%20shown%20his%20face%3F%20We%20investigate%20-%20WIN.gg&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Ad%20Inserter%20Pro&ea=impression&el=3%20-%20Block%203&_u=aHDAAEADQAAAAC~&jid=&gjid=&cid=1252858921.1641792181&tid=UA-125662552-1&_gid=1797592701.1641792181&gtm=2wg150598L2T6&cg1=&cg2=article&cd1=article&cd2=&cd9=Olivia%20Richman&cd11=10337&cd12=&z=322928871

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 04:03:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 4764
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
26ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1702464393&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwin.gg%2Fnews%2Fhas-corpse-husband-ever-shown-his-face-question-mark-we-investigate%2F&ul=en-us&de=UTF-8&dt=Has%20Corpse%20Husband%20ever%20shown%20his%20face%3F%20We%20investigate%20-%20WIN.gg&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Ad%20Inserter%20Pro&ea=impression&el=8%20-%20GG.bet%20desktop%20matches%20widget&_u=aHDAAEADQAAAAC~&jid=&gjid=&cid=1252858921.1641792181&tid=UA-125662552-1&_gid=1797592701.1641792181&gtm=2wg150598L2T6&cg1=&cg2=article&cd1=article&cd2=&cd9=Olivia%20Richman&cd11=10337&cd12=&z=1945664801

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://win.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Jan 2022 04:03:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 4764
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: global.ib-ibi.com
URL: https://global.ib-ibi.com/image.sbxx?go=262106&pid=420&xid=24c634d4f9eb9f38cb25da32b48fe571

Verdicts & Comments Add Verdict or Comment

268 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

88 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.win.gg/	1970-01-20 00:03:13	Name: ezoadgid_255604 Value: -1
.win.gg/	1970-01-20 00:03:19	Name: ezoref_255604 Value:
.win.gg/	1970-01-20 00:03:19	Name: ezoab_255604 Value: mod13
.win.gg/	1970-01-20 00:06:04	Name: active_template::255604 Value: pub_site.1641792180
.win.gg/	1970-01-20 00:03:13	Name: ezopvc_255604 Value: 1
.win.gg/	1970-01-20 00:04:38	Name: ezepvv Value: 0
.win.gg/	1970-01-20 00:03:13	Name: ezovid_255604 Value: 813946122
.win.gg/	1970-01-20 00:03:13	Name: lp_255604 Value: https://win.gg/news/has-corpse-husband-ever-shown-his-face-question-mark-we-investigate/
.win.gg/	1970-01-20 00:06:04	Name: ezovuuidtime_255604 Value: 1641792180
.win.gg/	1970-01-20 00:03:13	Name: ezovuuid_255604 Value: dd62cc92-ec81-47e8-6b7b-2e3bdeb30b91
.win.gg/	1970-01-20 08:48:48	Name: ezCMPCCS Value: false
.win.gg/	1970-01-20 08:48:48	Name: ezosuibasgeneris-0 Value: 83a6caa44096c6a88009ee03910bb8f9
win.gg/	1970-01-22 13:22:24	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
win.gg/	1970-01-22 13:22:24	Name: ezohw Value: w%3D1600%2Ch%3D1200
win.gg/	1969-12-31 23:59:59	Name: ezouspvv Value: 0
win.gg/	1969-12-31 23:59:59	Name: ezouspva Value: 0
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: vOAei3dTuG0
.youtube.com/	1970-01-20 04:22:24	Name: VISITOR_INFO1_LIVE Value: RBVo2SNleU8
.win.gg/	1970-01-20 00:04:38	Name: _gid Value: GA1.2.1797592701.1641792181
.win.gg/	1970-01-20 00:03:12	Name: _gat_UA-125662552-1 Value: 1
.spotxchange.com/	1970-01-20 08:48:52	Name: audience Value: 60f72c06-71d5-11ec-807c-18b2794d0506
.3lift.com/	1970-01-20 02:12:48	Name: tluid Value: 17410188347599961048
.adnxs.com/	1970-01-20 02:12:48	Name: uuid2 Value: 7764980466689436379
.casalemedia.com/	1970-01-20 08:48:48	Name: CMID Value: YdvCtaXa6ysJGwbjj1inVwAA
.casalemedia.com/	1970-01-20 02:12:48	Name: CMPS Value: 237
.win.gg/	1970-01-20 17:34:24	Name: _ga_916JLHZYLF Value: GS1.1.1641792181.1.0.1641792181.60
.casalemedia.com/	1970-01-20 02:12:48	Name: CMPRO Value: 1826
.casalemedia.com/	1970-01-20 00:04:38	Name: CMST Value: YdvCtWHbwrUA
.creativecdn.com/	1970-01-20 08:48:48	Name: u Value: XO4ac5hsBnamB2x1KaAv
.creativecdn.com/	1970-01-20 08:48:48	Name: ts Value: 1641792181
ads.us.e-planning.net/	1969-12-31 23:59:59	Name: CT Value: 1
.e-planning.net/	1970-01-22 13:22:24	Name: E Value: AJzm8orJKJ6cyz8t
.adscale.de/	1970-01-20 08:45:28	Name: uu Value: b1d7933e98dd4ef98586e051b891600d
.ads3.admatic.com.tr/	1969-12-31 23:59:59	Name: ARRAffinity Value: 2b3c5e0cc673ff293e2280700eede1cd5e856e50cd6bc5467474bd96537910c9
.zeotap.com/	1970-01-20 08:48:48	Name: zc Value: d16ec5e9-ebae-402e-4312-5e26fde56cae
.zeotap.com/	1970-01-20 00:04:38	Name: zsc Value: %99%B30%ACLHS%1BmZ%B7%9E%EC%FCH%F64%DCq%C1%9E%E2%7D%93GE%09%FAd%2F%F7%23E%BCg%0F%B6%BF%A1%83%FE4%16k%D0%91%D7%9D7%99%F6%B8%94V6bI%3C%9C+%29%E5%F0%0D%8Acj%29%27%B0%ED%22%DD%F0%B0%19%DF2%90x%ADY%23%3D%03%2C%2C%D6%89%95%21%D9%1E%F4%DB%A9%1D%11%F23%91%19%F1a%F7x%E9%DF%99%87%E5%2B8%9Cvq%FEA%BD%3E%1Cg%2F%AFa%0E%09%97%14-O%95%40%09m%D7%5B%08+%D6%13%9B%CB%EB%22%E1%8D2R%5B%C3%F5%1B%3D%01%91%B5%2A%40.%DB%DD%DD
.ibillboard.com/	1970-01-20 08:48:48	Name: ibbid Value: BBID-01-03165061816685748-16495416
.richaudience.com/	1970-01-20 02:12:48	Name: avcid-zeo-uid Value: d16ec5e9-ebae-402e-4312-5e26fde56cae
.adsrvr.org/	1970-01-20 08:48:48	Name: TDID Value: 2351059f-09cc-4d11-a82c-70bde096ba49
.tapad.com/	1970-01-20 01:29:36	Name: TapAd_TS Value: 1641792181747
.tapad.com/	1970-01-20 01:29:36	Name: TapAd_DID Value: ada82a20-5acb-4151-824f-24c65ea74790
.tapad.com/	1970-01-20 01:29:36	Name: TapAd_3WAY_SYNCS Value:
.exelator.com/	1970-01-20 02:56:00	Name: EE Value: "72f76f09f3b5b44d43db9b7e57cbc327"
.exelator.com/	1970-01-20 02:56:00	Name: ud Value: "eJxrXxzq6XKLQcHcKM3cLM3AMs04yTTJxCTFxDglyTLJPNXUPDkp2djIfHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq0yMJySX5RZvoiz5DFRSlpDItKik8F71e0AACQzinW"
.weborama.fr/	1970-01-20 09:34:52	Name: AFFICHE_W Value: 5L4Bit@RP7Xk43
.console.adtarget.com.tr/	1970-01-20 01:32:28	Name: a502624 Value: ${USER_ID}
.console.adtarget.com.tr/	1970-01-20 01:32:28	Name: a307080 Value: XO4ac5hsBnamB2x1KaAv
.demdex.net/	1970-01-20 04:22:24	Name: demdex Value: 78044285237347154821385584713144225103
.agkn.com/	1970-01-20 08:48:48	Name: ab Value: 0001%3A6YIfodha46fnOryRLyrcae0hHwW9B9fc
.adform.net/	1970-01-20 00:47:50	Name: C Value: 1
.dpm.demdex.net/	1970-01-20 04:22:24	Name: dpm Value: 78044285237347154821385584713144225103
.mathtag.com/	1970-01-20 09:29:07	Name: uuid Value: 59aa61db-c2b5-4b00-abd1-63acfd497820
.yahoo.com/	1970-01-20 08:49:09	Name: A3 Value: d=AQABBLXC22ECEKFD7Krfj7g_6UA5od3cHbs&S=AQAAAh1B9AjAH6Hp6OiSBOODArA
.krxd.net/	1970-01-20 04:22:24	Name: _kuid_ Value: Ol7jgKcK
.adform.net/	1970-01-20 01:29:36	Name: uid Value: 7049873714552798363
.console.adtarget.com.tr/	1970-01-20 01:32:28	Name: a307565 Value: b1d7933e98dd4ef98586e051b891600d
.everesttech.net/	1970-01-20 08:48:48	Name: everest_g_v2 Value: g_surferid~YdvCtQAEeLBx3gAm
.crwdcntrl.net/	1970-01-20 06:31:59	Name: _cc_dc Value: 1
.crwdcntrl.net/	1970-01-20 06:31:59	Name: _cc_id Value: 24c634d4f9eb9f38cb25da32b48fe571
.console.adtarget.com.tr/	1970-01-20 01:32:28	Name: a314221 Value: BWgd3RZ6H5hEP3YrHjYO2DEjhvtJYyT8JB23SF5MX7OSSM2zxuLOqw3KDXoKnB_rh9hENWGb_t473R4_jHUT5A
.console.adtarget.com.tr/	1970-01-20 01:32:28	Name: vmuid Value: 8293ecdf37d1a813
.console.adtarget.com.tr/	1970-01-20 01:32:28	Name: a307442 Value: AJzm8orJKJ6cyz8t
.fwmrm.net/	1970-01-20 04:22:24	Name: _uid Value: "c108_7051443728518662588"
.adsrvr.org/	1970-01-20 08:48:48	Name: TDCPM Value: CAEYASABKAIyCwiCyfyPgIGqOhAFOAFaB2dkbXY3cXNgAg..
.choozle.com/	1970-01-20 00:46:24	Name: chzdpsync Value: eyJjaG9vemxlQ29va2llSWQiOiJiYzc0NjRjMS0wOGNkLTRkYzMtOTlmNy05OTg2MDcyYjAzMWUiLCJwcm92aWRlckNvb2tpZU1ldGEiOnsiT1JBQ0xFIjp7InByb3ZpZGVyIjoiT1JBQ0xFIiwicHJvdmlkZXJDb29raWVJZCI6IiRfQktfVVVJRCIsInByb3ZpZGVyUmVkaXJlY3RSZXF1ZXN0ZWQiOmZhbHNlLCJwcm92aWRlclJlZGlyZWN0U2VudCI6ZmFsc2V9LCJUVEQiOnsicHJvdmlkZXIiOiJUVEQiLCJwcm92aWRlckNvb2tpZUlkIjoiMjM1MTA1OWYtMDljYy00ZDExLWE4MmMtNzBiZGUwOTZiYTQ5IiwicHJvdmlkZXJSZWRpcmVjdFJlcXVlc3RlZCI6ZmFsc2UsInByb3ZpZGVyUmVkaXJlY3RTZW50IjpmYWxzZX19LCJ2ZXJpZmllZCI6dHJ1ZSwic3BlY2lmaWNQcm92aWRlcnMiOltdfQ==
.rlcdn.com/	1970-01-20 08:48:48	Name: rlas3 Value: YduxvWceY0NFudmz2jDBP6oJVTgXkv3ViAV41m44V3Q=
.rlcdn.com/	1970-01-20 01:29:36	Name: pxrc Value: CLaF744GEgUI6AcQABIGCLrqARAA
.bidswitch.net/	1970-01-20 08:48:48	Name: tuuid Value: 5c25e14b-061a-4e20-9ea1-2f4a2758e2b6
.bidswitch.net/	1970-01-20 08:48:48	Name: c Value: 1641792182
.bidswitch.net/	1970-01-20 08:48:48	Name: tuuid_lu Value: 1641792182
.eyeota.net/	1970-01-20 08:48:48	Name: mako_uid Value: 17e42709908-57f70000010f4fa2
.eyeota.net/	1970-01-20 00:03:12	Name: SERVERID Value: 20386~DM
.doubleclick.net/	1970-01-20 09:24:48	Name: IDE Value: AHWqTUmCK9LboOc4LMAkeSMJ4K5wxb6QvexUTC8dPp95H-JYoYXb1C3CtEWCypWVPQM
.betweendigital.com/	1970-01-20 08:48:48	Name: dc Value: mow1
.betweendigital.com/	1970-01-20 08:48:48	Name: tuuid Value: 9a1ef089-68c8-510a-a29a-d009c34112bf
.betweendigital.com/	1970-01-20 08:48:48	Name: ss Value: 1
.betweendigital.com/	1970-01-20 08:48:48	Name: ut Value: YdvCtgAM3PjuAmyufWv1Ideem6ChOH4111VFNA==
.audrte.com/	1970-01-20 00:24:48	Name: arcki2 Value: 4862xcsOIDETfev15P602wVpA!20210804!1641792182838
.ads4.admatic.com.tr/	1969-12-31 23:59:59	Name: ARRAffinity Value: 9a3a9796926023520398d7fa6a924f308b0a236bb957270deca9df565187f0f2
.criteo.com/	1970-01-20 09:24:48	Name: uid Value: 20836669-f583-457c-be50-0c79df1a53f7
.adscale.de/	1970-01-20 08:45:28	Name: cct Value: 1641792183337
.m6r.eu/	1970-01-20 00:03:15	Name: test Value: true
.m6r.eu/	1970-01-20 02:12:48	Name: cct Value: 1641792183572
.m6r.eu/	1970-01-20 02:12:48	Name: id Value: ab851939966e9c83dd9aded20890c2f0
.ih.adscale.de/	1970-01-20 08:45:28	Name: tu Value: 4#549155323#48~ab851939966e9c83dd9aded20890c2f0~456053~0~0#101~BBID-01-03165061816685748-16495416~456053~0~0#38~CAESEMLrAcGFEcd7WkXZWD6SJa8~456053~0~0#39~59aa61db-c2b5-4b00-abd1-63acfd497820~456053~0~0#40~20836669-f583-457c-be50-0c79df1a53f7~456053~0~0#42~7049873714552798363~456053~0~0#75~7764980466689436379~456053~0~0#63~YdvCtaXa6ysJGwbjj1inVwAA&1826~456053~0~0
.win.gg/	1970-01-20 17:34:24	Name: _ga Value: GA1.2.1252858921.1641792181
.crwdcntrl.net/	1970-01-20 06:32:00	Name: _cc_cc Value: "ACZ4XmNQMDJJNjM2STFJs0xNskwztkhOMjJNSTQ2SjKxSEs1NTdkAILE24d2%2FP3%2F%2Fz8%2FiAMBAM7nD9o%3D"
.crwdcntrl.net/	1970-01-20 06:32:00	Name: _cc_aud Value: "ABR4XmNgYGBIvH1oB5CCAgAhfwK3"

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 Message: Failed to load resource: the server responded with a status of 400 (Request failed due to privacy signals)
network	error	URL: https://dmp.adform.net/serving/cookie/match/?party=1105&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=d16ec5e9-ebae-402e-4312-5e26fde56cae&reqId=7055cb8f-b086-4c84-528e-520d4cb60a2d&zdid=1361 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://global.ib-ibi.com/image.sbxx?go=262106&pid=420&xid=24c634d4f9eb9f38cb25da32b48fe571 Message: Failed to load resource: net::ERR_CONNECTION_RESET

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=300

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.audrte.com
aa.agkn.com
aax-eu.amazon-adsystem.com
ads.betweendigital.com
ads.pubmatic.com
ads.us.e-planning.net
ads3.admatic.com.tr
ads4.admatic.com.tr
adscale-emea.adnxs.com
ajax.googleapis.com
analytics.google.com
bbnaut.ibillboard.com
bcp.crwdcntrl.net
beacon.krxd.net
bn01.er.bemail.it
buttons-config.sharethis.com
c.amazon-adsystem.com
cdn-images.win.gg
cdn.admatic.com.tr
cdn.gin.bet
cdn.jsdelivr.net
cdn.oribi.io
cdn.winners.bet
cm.adform.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
creativecdn.com
cs.choozle.com
csync.loopme.me
d1eoo1tco6rr5e.cloudfront.net
d33whie8snbuur.cloudfront.net
dis.criteo.com
dmp.adform.net
dmp.v.fwmrm.net
dpm.demdex.net
eb2.3lift.com
engine.widespace.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g.ezodn.com
global.ib-ibi.com
gvl.ezodn.com
hbopenbid.pubmatic.com
ib.adnxs.com
idsync.frontend.weborama.fr
idsync.rlcdn.com
ih.adscale.de
image6.pubmatic.com
imasdk.googleapis.com
img.youtube.com
insight.adsrvr.org
js.adscale.de
js.cookieless-data.com
l.sharethis.com
live.primis.tech
loadeu.exelator.com
match.adsrvr.org
mwzeom.zeotap.com
nexus.ensighten.com
obgpm76tt0a0sgozk8l.redinuid.imrworldwide.com
odr.mookie1.com
onetag-sys.com
pagead2.googlesyndication.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.sitescout.com
pixel.tapad.com
platform-api.sharethis.com
platform-cdn.sharethis.com
ps.eyeota.net
rtb.openx.net
s.console.adtarget.com.tr
s.e-planning.net
s0.2mdn.net
secure-assets.rubiconproject.com
secure.adnxs.com
spl.zeotap.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.console.adtarget.com.tr
sync.crwdcntrl.net
sync.intentiq.com
sync.mathtag.com
sync.richaudience.com
sync.search.spotxchange.com
tags.bluekai.com
tags.crwdcntrl.net
token.rubiconproject.com
track.adform.net
tracking.m6r.eu
trc.taboola.com
u-ams02.e-planning.net
u.openx.net
usermatch.krxd.net
video.primis.tech
web-chat-plugin.picogp.com
widget.eu.criteo.com
win.gg
www.google-analytics.com
www.google.com
www.google.it
www.googletagmanager.com
www.youtube.com
x.bidswitch.net
global.ib-ibi.com
104.111.215.191
13.224.193.52
13.224.198.4
13.225.80.14
13.225.80.95
13.225.83.200
13.248.245.213
142.250.186.162
151.1.205.165
151.101.194.49
168.119.149.178
178.250.2.151
18.135.35.213
18.158.98.109
18.195.42.228
18.196.233.14
18.198.69.109
182.161.74.16
185.184.8.65
185.229.227.132
185.29.134.244
185.64.189.112
185.64.190.78
185.94.180.125
188.132.147.236
194.146.38.187
2.18.233.180
2.18.233.201
2.18.234.21
212.82.100.182
23.37.42.132
23.88.75.187
2600:9000:20eb:3c00:12:b1b7:8800:93a1
2600:9000:20eb:4800:c:abe:f440:93a1
2600:9000:21f3:6800:1d:85c3:6640:93a1
2600:9000:21f3:9800:1d:c575:fcc0:21
2600:9000:21f3:c800:d:3df0:6d00:93a1
2600:9000:21f3:d600:f:4f64:8940:93a1
2606:4700:10::6816:1957
2606:4700:3031::6815:496e
2606:4700:3036::ac43:a1d1
2606:4700::6810:5714
2607:ae80:2::48
2a00:1450:4001:802::2003
2a00:1450:4001:802::200a
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:80f::200e
2a00:1450:4001:810::200e
2a00:1450:4001:812::2006
2a00:1450:4001:812::200a
2a00:1450:4001:813::200a
2a00:1450:4001:828::200e
2a00:1450:4001:829::2002
2a00:1450:4001:831::2004
2a00:1450:400c:c0c::9d
2a04:4e42:600::300
2a07:180:27b:71f4:967e:7b66:dbda:fbaf
2a0c:5c81:5139::2
3.122.214.165
3.123.179.172
3.228.116.73
3.248.44.18
3.33.220.150
3.90.91.223
34.249.68.36
34.98.64.218
34.98.67.61
35.201.81.244
35.227.248.159
35.227.252.103
35.244.174.68
37.157.2.239
37.157.4.24
37.252.172.249
37.252.173.214
5.178.65.245
5.178.65.253
51.158.29.12
51.75.86.98
52.17.105.123
52.204.3.213
52.214.105.43
52.29.0.64
52.35.50.171
54.217.170.69
54.239.37.23
54.77.177.229
62.149.0.72
62.209.227.211
66.155.71.150
69.173.144.165
72.251.244.141
8.39.36.141
8.39.36.142
88.212.252.22
89.187.169.47
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
04f6dd8dfbc09c92d792a22327a61239ce45948be46f4fc3f9d9c881aef2495b
060d57b33079a59663a2f02c9b1872c583fac0829a1ef198b4fd9ea20c198d7a
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
077b5e235416d83b181de15985af232067d458cfce04c3f32013701676a79873
081f383dd6dba858ee81e6b297eabf5ab04b9fc263517439dfa323e0c3d3c06d
0aa900c43537f2033211adb263b21e424397bc66aba2383df7ad62e7d4e9a075
0b6e4ddbee5d65c3c125435d5c4f4648c281dc23a6e37d36b8206c93dfb21e5c
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ca7188912ef3473bb7943356daf3909fb28acf076110495dd4eff399334fe70
0d5a784db790b0b9b94d6ad523b23ab5834c5844bbc01e6d01021f3fe01e3b46
0d75fca707c4d336cac423247eb710c856d30ecd8b46ceb3e28dc35218381c38
0db6aceba6a39f92ad81c2d309444894c1f1be29a8f5f2390e29b5f809854df2
0dd3655f66791af7f50203529ce85cec31d91f5ad264a2c8a0b96985705d291b
0ef12a7eee7a0a906d2cb5f3f67dfea464f0c4ee04aee516ecd30ca2af974a1d
0f0ed4587f01973cf025b4bfc4dfdbb1dbabf8d4c0d3a01e67f65ef9c887970f
106b39f48e91ecd4e58145357095e1014ceba98a7b71c81e2a9388a36be77732
12dc3fbcf201e281b2edc90e10e2cef5afa7bbf21a1886284a1f447705f9260b
13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0
14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a
154212eb976f7df7c79f5844fcb356740bcb6c51edacb2e8515108e2d7effa67
16910f012ec529e4bef4051c3f178f72302c5ef55973277ba7aa36b5d19b91e2
1844237c138bd410bc7fcfecd38156aa58aa2968d59889386b17de5c796e3c84
1c5a0bc40bdeae5ff4d37d6995badbe167f35c1c260ca7af436e9baf37bb756f
1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319
1e27706b20996f8275f1bc1914ebb3f21d7b8c1f98a615cedee3bfd7d9f65eb5
1f5b6267968f60e8c5f023222caa8cfdd05574076c8ea3740894ef93fd4b8ba3
1ff7f291ef8bacab4d9ba865601974aac21d4c86395f33c732779210267ab993
20894fd88f2bd535d34c76c268dd9f9ca8d9cb572574d3dd7ae9f03c5a16fa00
218a4b9d771f0fb60868fe38d391e1847e69ed4883236a6a10549bb00ddfab92
21a46a76325b873e8e2695ca80ae1a330642b54fc95fc59faeef045c80b61373
21e9ee2e38830c38635c52f29c8e83ec4b9e584f973a6212548ec7b42f0e3eb6
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
22f5922420e54dbd75b7170d72731d12642f10f004fd6035990e54372a7412b0
2807db05f536fe45b16757ee0be3052e74fc954f23604d07c53889796adbbdab
2986551fd9e82929eabb8cba7c44f74a28d8496c744893432f067b320dff55da
2a00fa9417eb51e747aeec31ebe648fd1f04d6937c19e793b0c9dfc8df1a00ef
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2ad7ae37966c904cd579e286580b0a26a235106dab97d9a24323cf6e99f2b3d0
2d12697710766f7c49fc2aab197871003ce3012d026bd109827226ff2252e134
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2fb07bc2036b6b6338b8632cdb49566bb1a3fdaa471b628345de4459692362c8
30a284ff4a11c4dde6aa352e197242da0c01d581dfc8bfc469123b7393e6eef8
34ad89dba4e0292fba916dd3c8c4a79a779d047f22522dc6cca75207433ff478
3516496d97f72bf509cf5d6902b5deebf53355ccb21127dc777d265cd96ca2d8
379b0677d7ebdd694a38680fa6aa64844afac94967bb796fd695d4dcc2c3d5b4
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
383472db86bc19b822592340828e1a9d680ece8e6a5114eb4744351081fdea3c
3a291e7b6d5384914c0d162cc11a76b274550e0afb8ee2f3c7770c4eff6e8d4c
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42488c78648e3488f2cba57c217dd9bbb6219046f50fbc65b3c946aa6b7a8ed7
43b348d194f4e2c50da38d2a5e596635df86baee4de5839d73d19aa6285dbd4f
444ee2a405e57ede9ef10e17bb58c0351c39e9d21203f242b55a77fd07d30784
4525353b717ebb3afd8def25f8f371935171f1110238f89bcffb55a25c531dca
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
49aa9dd43371f1114267ce1402683c40bed1a0beba352d71930127d67176719f
4b6c0e30bb4b961addd346acade8505a2dfcb63e5f857f1306cc4fc9026b0f22
4de6ac9a7dc216abb5853006199694ff55cc18bc124558eeaefda5db45ca22ca
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f2f14c39c4b652a6bfed55bf65c3434d2d1707996601db9b2c5f43df38ff0e7
4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54f0bf848b3561d7e1127ee9c8bd47fe8643254597fab341c5379645a5d8ee56
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37
58584f5006f30da3270d3408f6a382962ee7deb22b6c79920419228f2f836bb9
58ed344732766704ee535508e3dcd8d4a8ec0c9c79d16adf02293adde110926c
594ddac798983598f532ff9185733bf20004d353fe92460ca4e7fbba064f83bf
5bb08412d18881e3fc69fdb44226bfc6f66a77d45dfff3f10b98a100c09bc970
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5d7fcc6fcc8f7cad5e4057c7add47caf4bf89bf5368158fe7a7285c0f63a1733
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
5f6712e48d170147488d16a249b7f40f1b480a017742ab14a4b526ef6c777efe
60e1017c6585464aa240b13f4074ab5ea100dcbdb72615124ff575bcc891a542
62b58b017cf4d54dc404dbc48e49b0429cbbb46678a868a95bf17664cc6340fd
62c6ababbe88d3d4496203cd685f2b900a0cb382b8e24704ad25e84b8ed80833
65a4abbc172abd62a87ad8a3aea5c219268f8694acb8d9f09e4f92bef29c7d1a
67e07c07b9c0bef6d5881a58726edd701b442051638036348010fc7eefa0fecb
68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17
692671669fec1b7626e449845f6a856661a36fff78f4a111db24c30bb8b2367c
69ed3547491fe22ca5be1ae732ad69f25d6dc1cc445ade7fbb10d16f22479247
6a6c28a2bae4339f212ecd19e178a40e02a8f5cc7e40203633d6981353a0c6af
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ee78b017c2b924ed15db50df9950897fece0939aeefca3e841eb0d27abead1a
71d88cd9f1c9bf1860410dc1d8fa02567af98c1190964b57e87512cfa92d0665
727f45ae1692ce3a9cd8caa581e149bf6bfb1e05acd06b5457ddb839f49f12a1
73b579a32d3f69b2472cc1108ca5f67f7055f92676435cc8adcbfd17330a0642
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
76d1da9e9902ccf3d2983b706151d7c4f1a910c86b757fae4302ccf989c630a7
7888a75eac5f8b9dc4c448f10e8dc9030fcae612cb236f1a9e9700d56ae6ef34
792e8d90eda8320b9bad0aa1aa9b98cb609ac3a72a642e6d370f40131c88ebe4
7940523b8dc250d607eb1c29860132762f634859ba03b88605b2e0a6591b34c5
79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7e0e2fbaa7a89c64df6b30953123d55b39e38cb0933d59425ecb11c9989d477b
7fdc657af14908b8096c3da226e147e7f249e6f0aa09a5c20415ce9f08bfca47
80001a82cc9cf3004898d8522e34d91dbf25ecde2d0f8946abfb4876b0161316
81a319202c5a41a82b4a1e0172a87b35172b463467c66ba5feda41ec36ce2cc7
81e5a285aa15116e4575e39d54cf93b2c305215d0d114b0e14a51e5e88d07248
8286e6b6e23037720e66ef74cb3206c0e8f2781bfed730ad60f8fb8e42c67664
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
875ca1fe8a85b43fefb0206533f96bd56905305e6e0291c0b5284daf07b0c9e9
8b5cbe512fbb056de7aa42963d3bac7e38adb05e32fbe6f502b4fad3cabf57fc
8bdde6f133628c4a48055ed25929a14aa77e1c00ea8a6fa3150746bd61cd4817
8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f37c6ad1aeafdbf2fda86036ff1993838830f469f53fd8fb639fd4487aea36d
8fec1c32636d1846a124214e650c4e9c7f608b3fd4e3200f11d83b3c26d2917e
9098059629f03cc62b01a2f95bdd705604dac8e6a93b6ed42d7d5c8b3fe26d45
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d
91b4eb09154d5ebef46352e922194ec6dbb9547b63f9776ae10133fe1ca66879
935b2f1cdbf1af0439e86ecbd0ca09a2b3a91807ae651cf3f840f9237a45a667
96ae6a03a75db67d90cdae793dabdb904860f79f05feeaea10a4e09428719763
99804220c3204691bd91fa39497f38f3235177d52723188cf3ac53026e0b0f6a
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a30efe5482066576af9976d7b0716c88d2ccd05e54bfb481bd8485427945dbd0
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a4020165d6e09bd9d4ab3ff31d07ef236815d956940a6f795322492d0b247964
a460867641adc96414fe08a934ba16de4bc98e1cb940417b810205d2ce9650fa
a5137aded9975681b65e1d9992f05e9454b79c88b154aaae338e3aef9264128f
a74b0e131549f4568fc46a8c664b702aa127ccca487b6d678951418378802e27
a83bf33080e6fd7aa375b48f11f4ac7b1a186d94a36af178e417cc00d6e09a7d
a8dee0d8bf99402d55632730a805dbc567a95770c511ff997ee8a0a51ae4ef66
ace4208545fb0ff5ea87fbe1470d3bf0af8e73d7d52fea869966c4b9d8c78a60
b116448ba85d53cb08d3e189ff68c832bac0f0993b3635a3331a81e3fe00c71a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4cd4f889e2c7dd71da12d2b0a29aa6346de2e5d8b3c882d7700d64c700f661d
b6c2c004674f17d54d9905790df57a805fbff7ac2f3022b5d1474213b2a8fa2d
b8042c2b8e66e36c18c31fee0917c96723b3a0198fb981d41402dd996752f78f
b98d73c9da43ab088e858bcfadfa96208819a10c743b730ccf229e427655cd82
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c143e8e7006ab800c1913682296f942b0515cdf15277247d1e0e4bc5d38fb02b
c14eec7dcf14eb8e6a55a51fa0673d2dec616c080a74a890ba1583b1687f76fa
c1a86d7c11a5c83b82c7e6f814aff6286a9fe3483b8e0e2c16089370bad4676d
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c555bc295bb01f8cf5343bf7e338efa35182951447d9362a01ab618b31935ed4
c8607cd22af79cc6492bd2b0a6443679e907fe660ff470133aa61b649dfec11c
c8dbf0d976d58e9a85fe853a4331a4915f2983daccb394e2a7087de9ffe89097
c983bccbfa3aeec262e4469747aaf9d860d93fedcf3ba263c84bd7ef21430234
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb1a7628ac13de4472c6cd0b85d874e288d8c19c401984078b09f5bbb14d8b2f
cb35e960629d7b7f26da19f7fa0df3e2811ff9f5c43eb8ef71306e91cf2f3198
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cdba8159f5be3c833a4b69c53aa29e7e13e82282be59843a74193a8e4480f1b8
cea9c3393f4b0a57475e38dbbff527aca7a3aa2d107b4b4742b937c2507e2063
cefe33c78eb7f63c40d3f5866e9d17d1308a04befd68069df84308b9b8e8f9d9
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d2d2c02162792065c0c23e4077f5c184408874b6d17646d65b48df45bb443a24
d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af
d5ae734732c18d60c5ed7f2ba8d8ef6f7bd5d97eb97c29306339dbadcfc60715
d905e1e08cc9a120a8630d1aeb347f7ba8d412361e251a07ea5f000c832c7412
da3380884cb6b16f6200ceb897762ab0b596fb4f9238a76a659a6d0feb67c6e2
da6bba72d171362ca0b743ad4980b57a161c885989ed0e6006a3af1941bd13e4
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
dc5aa15131e94ff270921a1009fa0f60527b7ddcc534287c3adada0f37fdc20c
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddb5452a183196c93e848f0017abef2a1184277fe8a61b87bcf1369d4a10e753
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de80309d98405d566c6fb1912811b24c8ad3a8380f6819d26a6c1eac5cd99185
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e0c0c0b607dcddedcb101ac6487d7b5c321a984e25d19bbd24337e7a9b1d6c22
e1aeb63073df59e31194af5ba527e14162ecdd9617688b62294514dfbab3a8a5
e21e1613bbb5218070a9b6c89286497628e6ea512f2b2fa51c6167bb5a9964f6
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
e33375800c637fb284d80d638793c62eb1b333268ec52532efd7ab37bb3fce90
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52a5dce5ec489b5677abb04ca8564754509a31ffd3054ee0db1b0aaa669e82c
e6e55d55d4c55cf139fe10a393a5b9bcfb12fcaece73db7d7f2ab35e4747b8ed
e755339aa80a7257a32d804d35ff5bc5e535f3ef013ca7b547df6e2ff54cf7bc
e81bc94621340a647972fd5fee0085a1ef67788c2fc010cd15e13f5920711d27
e963e7196beb9123059ec3534b042ebcd1ef0a470fa568bfbebfeab2f33c4fda
e9a8ad26258ebc90b218b72c9edbbbe314945cd3dacb600a6c677f298387106c
ea9cd43e87c14c06dafc0c2973b231d77b663805a04a63fc53ed1f0c9c9852e8
ebab19f74d95b1c10457dbf025009438a9479c198c5e96a829c64f4b4298cf46
ecde72bc5d9fd5bc5150218535ae8f75ad9161924b91e64b7995c495fc90c246
ed750e681f09555fcd3f87382fede5226d3fd6ce4c9b63e8c57dadc5c5092553
eee27924bf4d911592556c15acb777978be0e32b7145a6bfa5f57a6b5cc68ed3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0ce1c35a5960b75b9920bafcefc89fe548f105ec8c767f32d83afa64bda6433
f24ca47fbbc6a0e0ad55bde1a42b19fed1fdd63fa90396876f83ad6400c02769
f484bd75176df807d80a01c229254644b01f2bba4599d788909331bd01367c3f
f62e11b110b6233da7f94fc6715e2d026d3dd3cc22fa394623ba16c9316fa8f8
f7c62c6ff2a5810e6614352d1dae0a10fc98c1b3f97179fc768891083ab3d97a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f85e538e44687fc0feaa2f66a67831ec9f9b03446f115dec74b996da4a0a4a52
fd1bafd614713b27b10beabcd61045fa8ca08fbb758ede7d75f23c4157ed0d8d
ffb648200f12e9e83c7a7d94892271c74f23b39d6f77b9df5e21c96166a41ecb

win.gg Open in urlscan Pro 18.158.98.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

264 Requests

83 %HTTPS

28 %IPv6

70 Domains

109 Subdomains

73 IPs

15 Countries

7034 kBTransfer

11256 kBSize

88 Cookies

18 Outgoing links

Page URL History

Redirected requests

264 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

win.gg Open in urlscan Pro
18.158.98.109 Public Scan

Screenshot
Live screenshot

Full Image

264
Requests

83 %
HTTPS

28 %
IPv6

70
Domains

109
Subdomains

73
IPs

15
Countries

7034 kB
Transfer

11256 kB
Size

88
Cookies

264 HTTP transactions
0 data transactions