URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Submission: On April 27 via manual from ID — Scanned from DE

Summary

This website contacted 41 IPs in 4 countries across 24 domains to perform 129 HTTP transactions. The main IP is 208.100.58.40, located in United States and belongs to STEADFAST, US. The main domain is www.heromachine.com.
This is the only time www.heromachine.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
34 208.100.58.40 32748 (STEADFAST)
1 23.36.163.245 20940 (AKAMAI-ASN1)
2 2a04:4e42:4b::84 54113 (FASTLY)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
7 2a00:1450:400... 15169 (GOOGLE)
4 2a04:fa87:fff... 2635 (AUTOMATTIC)
3 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:ef:... 20940 (AKAMAI-ASN1)
1 5 23.36.163.232 20940 (AKAMAI-ASN1)
4 142.250.185.130 15169 (GOOGLE)
1 13.32.121.37 16509 (AMAZON-02)
4 8 99.80.117.76 16509 (AMAZON-02)
4 2600:9000:21f... 16509 (AMAZON-02)
2 52.54.164.181 14618 (AMAZON-AES)
1 2 13.225.80.38 16509 (AMAZON-02)
7 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 142.250.186.34 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 3.248.54.145 16509 (AMAZON-02)
5 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:2638::2 44788 (ASN-CRITE...)
1 2a02:2638:1::4 44788 (ASN-CRITE...)
1 13.225.80.21 16509 (AMAZON-02)
1 151.101.0.84 54113 (FASTLY)
7 2a02:2638::3 44788 (ASN-CRITE...)
1 178.250.2.148 44788 (ASN-CRITE...)
2 178.250.2.150 44788 (ASN-CRITE...)
2 2a00:1450:400... 15169 (GOOGLE)
3 34.194.37.39 14618 (AMAZON-AES)
1 2 104.89.33.102 16625 (AKAMAI-AS)
2 63.34.98.248 16509 (AMAZON-02)
1 2600:9000:21f... 16509 (AMAZON-02)
1 151.101.66.133 54113 (FASTLY)
1 104.90.192.27 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
129 41
Apex Domain
Subdomains
Transfer
34 heromachine.com
www.heromachine.com
947 KB
14 imrworldwide.com
secure-us.imrworldwide.com — Cisco Umbrella Rank: 1684
cdn-gl.imrworldwide.com — Cisco Umbrella Rank: 2401
bee.imrworldwide.com — Cisco Umbrella Rank: 95757
zhfvrubtkqqjxslwgemo9cyozbwoo1651037787.nuid.imrworldwide.com
78 KB
13 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 96
tpc.googlesyndication.com — Cisco Umbrella Rank: 127
13892b799720f42beca56691076df1c4.safeframe.googlesyndication.com
209 KB
12 zdbb.net
ns.zdbb.net — Cisco Umbrella Rank: 147436
cdn.static.zdbb.net — Cisco Umbrella Rank: 15863
gurgle.zdbb.net — Cisco Umbrella Rank: 20444
jogger.zdbb.net — Cisco Umbrella Rank: 16108
zdbb.net — Cisco Umbrella Rank: 10227
30 KB
9 criteo.net
static.criteo.net — Cisco Umbrella Rank: 628
csm.eu.criteo.net — Cisco Umbrella Rank: 8498
270 KB
9 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 174
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
171 KB
8 google.com
www.google.com — Cisco Umbrella Rank: 2
adservice.google.com — Cisco Umbrella Rank: 64
42 KB
6 gstatic.com
www.gstatic.com
fonts.gstatic.com
346 KB
4 gravatar.com
2.gravatar.com — Cisco Umbrella Rank: 7812
secure.gravatar.com — Cisco Umbrella Rank: 1620
13 KB
3 criteo.com
rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 15229
ads.eu.criteo.com — Cisco Umbrella Rank: 8495
cat.nl.eu.criteo.com — Cisco Umbrella Rank: 10741
17 KB
3 google.de
adservice.google.de — Cisco Umbrella Rank: 9242
1 KB
3 scorecardresearch.com
b.scorecardresearch.com — Cisco Umbrella Rank: 4075
sb.scorecardresearch.com — Cisco Umbrella Rank: 129
2 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
37 KB
3 pinterest.com
assets.pinterest.com — Cisco Umbrella Rank: 2480
log.pinterest.com — Cisco Umbrella Rank: 3386
19 KB
2 bkrtx.com
tags.bkrtx.com — Cisco Umbrella Rank: 2879
16 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 58
39 KB
1 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 467
338 B
1 krxd.net
cdn.krxd.net — Cisco Umbrella Rank: 1415
629 B
1 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 163
37 KB
1 adsafeprotected.com
pixel.adsafeprotected.com — Cisco Umbrella Rank: 516
2 KB
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 773
646 B
1 pcmag.com
g.pcmag.com — Cisco Umbrella Rank: 67306
323 B
1 bootstrapcdn.com
netdna.bootstrapcdn.com — Cisco Umbrella Rank: 3042
5 KB
1 nsstatic.net
cdn.nsstatic.net — Cisco Umbrella Rank: 138723
105 KB
129 24
Domain Requested by
34 www.heromachine.com www.heromachine.com
8 secure-us.imrworldwide.com 4 redirects secure-us.imrworldwide.com
www.heromachine.com
7 static.criteo.net ads.eu.criteo.com
7 pagead2.googlesyndication.com www.heromachine.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
www.googletagservices.com
5 tpc.googlesyndication.com googleads.g.doubleclick.net
pagead2.googlesyndication.com
tpc.googlesyndication.com
5 googleads.g.doubleclick.net pagead2.googlesyndication.com
googleads.g.doubleclick.net
5 www.google.com www.heromachine.com
www.gstatic.com
www.google.com
tpc.googlesyndication.com
4 www.gstatic.com www.google.com
www.gstatic.com
4 cdn-gl.imrworldwide.com www.heromachine.com
secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
4 cdn.static.zdbb.net 1 redirects www.heromachine.com
cdn.static.zdbb.net
4 securepubads.g.doubleclick.net cdn.nsstatic.net
securepubads.g.doubleclick.net
3 jogger.zdbb.net cdn.static.zdbb.net
3 adservice.google.com pagead2.googlesyndication.com
securepubads.g.doubleclick.net
3 adservice.google.de pagead2.googlesyndication.com
securepubads.g.doubleclick.net
3 secure.gravatar.com www.heromachine.com
secure.gravatar.com
3 www.google-analytics.com www.heromachine.com
www.googletagmanager.com
2 zdbb.net www.heromachine.com
cdn.static.zdbb.net
2 tags.bkrtx.com 1 redirects
2 fonts.gstatic.com www.google.com
2 csm.eu.criteo.net ads.eu.criteo.com
2 sb.scorecardresearch.com 1 redirects www.heromachine.com
2 gurgle.zdbb.net www.heromachine.com
cdn.static.zdbb.net
2 www.googletagmanager.com 1 redirects www.heromachine.com
2 assets.pinterest.com www.heromachine.com
assets.pinterest.com
1 13892b799720f42beca56691076df1c4.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 stags.bluekai.com tags.bkrtx.com
1 cdn.krxd.net cdn.static.zdbb.net
1 zhfvrubtkqqjxslwgemo9cyozbwoo1651037787.nuid.imrworldwide.com
1 cat.nl.eu.criteo.com ads.eu.criteo.com
1 log.pinterest.com www.heromachine.com
1 bee.imrworldwide.com secure-us.imrworldwide.com
1 ads.eu.criteo.com googleads.g.doubleclick.net
1 rtb.fr.eu.criteo.com googleads.g.doubleclick.net
1 www.googletagservices.com googleads.g.doubleclick.net
1 pixel.adsafeprotected.com cdn.nsstatic.net
1 partner.googleadservices.com pagead2.googlesyndication.com
1 b.scorecardresearch.com cdn.nsstatic.net
1 ns.zdbb.net cdn.nsstatic.net
1 g.pcmag.com cdn.nsstatic.net
1 2.gravatar.com www.heromachine.com
1 netdna.bootstrapcdn.com www.heromachine.com
1 cdn.nsstatic.net www.heromachine.com
129 42
Subject Issuer Validity Valid
*.g.doubleclick.net
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
www.google.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.gravatar.com
Sectigo RSA Domain Validation Secure Server CA
2020-08-14 -
2022-11-16
2 years crt.sh
*.pinterest.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-27 -
2022-08-05
a year crt.sh
www.ziffdavis.com
COMODO RSA Organization Validation Secure Server CA
2022-02-07 -
2023-02-07
a year crt.sh
*.zdbb.net
Amazon
2022-04-05 -
2023-05-04
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.googleadservices.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.google.de
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.google.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.fr.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-13 -
2022-06-09
3 months crt.sh
*.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-19 -
2022-06-18
3 months crt.sh
*.imrworldwide.com
DigiCert TLS RSA SHA256 2020 CA1
2022-01-04 -
2023-02-03
a year crt.sh
*.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-04-11 -
2022-07-13
3 months crt.sh
*.nl.eu.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-15 -
2022-06-13
3 months crt.sh
*.eu.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-04-10 -
2022-07-04
3 months crt.sh
zdbb.net
Amazon
2022-01-26 -
2023-02-24
a year crt.sh
*.nuid.imrworldwide.com
Amazon
2021-06-11 -
2022-07-10
a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2022-02-26 -
2023-03-01
a year crt.sh

This page contains 13 frames:

Primary Page: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Frame ID: B845FB981BDA4D993DB991360B8A7A63
Requests: 89 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220425/r20190131/zrt_lookup.html
Frame ID: 2917C90A6C5E9FD9CDB47AA40E171CE5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=280&slotname=4501571694&adk=4109651738&adf=254961017&pi=t.ma~as.4501571694&w=1030&fwrn=4&fwrnh=100&lmt=1651037786&rafmt=1&psa=0&format=1030x280&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1651037786105&bpp=3&bdt=1294&idt=135&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&correlator=235040548260&frm=20&pv=2&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=285&ady=343&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&fsb=1&xpc=px1b8adWnj&p=http%3A//www.heromachine.com&dtd=153
Frame ID: 4178E24FD6532DA0FC4FCA1770DD240B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Frame ID: B559B0E42A00A500D9F02D3BA1FCBD4C
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&adk=1812271804&adf=3025194257&lmt=1651037786&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&ea=0&pra=7&wgl=1&dt=1651037786610&bpp=1&bdt=1799&idt=1&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00e45887a84bcb4d-222f2e5882cd0029%3AT%3D1651037786%3ART%3D1651037786%3AS%3DALNI_MYs3oyun6WzR_8E82IPnNIPJnYaQQ&prev_fmts=1030x280%2C300x250&nras=1&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=3&uci=a!3&fsb=1&dtd=8
Frame ID: E63CF87E9A822D32F50C0022620FDD3C
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
Frame ID: 9D66AED96DF8BA10957EA1E7919FBDED
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Frame ID: 99CC6B998F09160E88B1C2DCD21FC3CB
Requests: 11 HTTP requests in this frame

Frame: https://secure-us.imrworldwide.com/storageframe.html
Frame ID: A4E8BA2DCF6B4EF1D484FC1662B22CD7
Requests: 1 HTTP requests in this frame

Frame: http://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 908E9CAEAC8CB9BD2016FC0B5A4834AD
Requests: 3 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dheromachine.com&phint=referer%3Dhttp%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&phint=__bk_t%3DJoe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&phint=__bk_k%3D&phint=__bk_l%3Dhttp%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&phint=__bk_v%3D3.1.10&limit=10&r=81452057
Frame ID: B8B23930FB15705A9866044624A63106
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: A6955605BB8159D6E9DF90435DE02DBB
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2CDBC04E68A9731CCCD226573A3D2FCB
Requests: 2 HTTP requests in this frame

Frame: https://13892b799720f42beca56691076df1c4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: C54AB918B4171530F29D5974CDD93215
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Joe Biden approval rating drops further with young Americans's Profile | HeroMachine Character Portrait Creator

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
  • wp-embed\.min\.js\?ver=([\d.]+)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js

Overall confidence: 100%
Detected patterns
  • //assets\.pinterest\.com/js/pinit\.js

Overall confidence: 100%
Detected patterns
  • <iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
  • \.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

129
Requests

54 %
HTTPS

53 %
IPv6

24
Domains

42
Subdomains

41
IPs

4
Countries

2386 kB
Transfer

4641 kB
Size

15
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://assets.pinterest.com/js/pinit.js HTTP 307
  • https://assets.pinterest.com/js/pinit.js
Request Chain 2
  • http://www.googletagmanager.com/gtag/js?id=UA-34483098-1 HTTP 302
  • https://www.googletagmanager.com/gtag/js?id=UA-34483098-1
Request Chain 3
  • http://netdna.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css?ver=3.3 HTTP 307
  • https://netdna.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css?ver=3.3
Request Chain 26
  • http://www.google-analytics.com/ga.js HTTP 307
  • https://www.google-analytics.com/ga.js
Request Chain 47
  • https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js HTTP 303
  • https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Request Chain 48
  • https://secure-us.imrworldwide.com/v60.js HTTP 301
  • https://cdn-gl.imrworldwide.com/v60.js
Request Chain 51
  • https://sb.scorecardresearch.com/b?c1=8&c2=6036316&c3=1&ns__t=1651037785922&ns_c=UTF-8&cv=3.5&c8=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&c7=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&c3=1&ns__t=1651037785922&ns_c=UTF-8&cv=3.5&c8=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&c7=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&c9=
Request Chain 52
  • http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1530268844&utmhn=www.heromachine.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&utmhid=137577621&utmr=-&utmp=%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&utmht=1651037786043&utmac=UA-34483098-1&utmcc=__utma%3D177811772.710865485.1651037786.1651037786.1651037786.1%3B%2B__utmz%3D177811772.1651037786.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=90123864&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
  • https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1530268844&utmhn=www.heromachine.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&utmhid=137577621&utmr=-&utmp=%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&utmht=1651037786043&utmac=UA-34483098-1&utmcc=__utma%3D177811772.710865485.1651037786.1651037786.1651037786.1%3B%2B__utmz%3D177811772.1651037786.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=90123864&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Request Chain 81
  • http://secure-us.imrworldwide.com/storageframe.html HTTP 301
  • https://secure-us.imrworldwide.com/storageframe.html
Request Chain 92
  • http://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&sr=1600x1200&id=lstrg-086ba512ae18322aca4736e5a8da6688 HTTP 301
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&sr=1600x1200&id=lstrg-086ba512ae18322aca4736e5a8da6688 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&sr=1600x1200&id=lstrg-086ba512ae18322aca4736e5a8da6688&ja=1
Request Chain 104
  • http://tags.bkrtx.com/js/bk-coretag.js HTTP 302
  • https://tags.bkrtx.com/js/bk-coretag.js

129 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.heromachine.com/forums/users/biden-approval-rating-drops-further/
94 KB
21 KB
Document
General
Full URL
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
215f93877f2bc41566b4f42cf1f690294c39257d9fdb0ee05d7401459c706da2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
close
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 27 Apr 2022 05:36:24 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Link
<http://www.heromachine.com/wp-json/>; rel="https://api.w.org/"
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
heromachine.com.js
cdn.nsstatic.net/ns/
323 KB
105 KB
Script
General
Full URL
http://cdn.nsstatic.net/ns/heromachine.com.js
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
23.36.163.245 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-245.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c88cbe284d1606e1b1792d4667db7f337d2426c65b27a1e97ec77eed0080c15e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-version-id
C7P3kBDN7LpiXx0Z4sEYDK_hDSuSrwVf
Content-Encoding
gzip
Last-Modified
Fri, 11 Mar 2022 00:30:30 GMT
x-amz-request-id
BNAHSBQ5JX4Y77Z1
ETag
"78570e1faf2504224d658d969a2b20d7"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=3551
Date
Wed, 27 Apr 2022 05:36:25 GMT
x-amz-replication-status
COMPLETED
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
107381
x-amz-id-2
dDpfsaZPHpsDkUEDaX3sVQx4fuy9NuK/f3zEfL4hhPU3euyfjyJTAbyWp0F7jDmDxFBKeHe3+V8=
Expires
Wed, 27 Apr 2022 06:35:36 GMT
pinit.js
assets.pinterest.com/js/
Redirect Chain
  • http://assets.pinterest.com/js/pinit.js
  • https://assets.pinterest.com/js/pinit.js
361 B
431 B
Script
General
Full URL
https://assets.pinterest.com/js/pinit.js
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
2a04:4e42:4b::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:24 GMT
content-encoding
br
x-cdn
fastly
etag
"62d32c28f14783b94192cd8d35bc010d"
vary
Accept-Encoding, Origin
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-max-age
86400
cache-control
max-age=300
content-length
203
access-control-expose-headers
X-CDN

Redirect headers

Location
https://assets.pinterest.com/js/pinit.js
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=UA-34483098-1
  • https://www.googletagmanager.com/gtag/js?id=UA-34483098-1
98 KB
38 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-34483098-1
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c82fd92fd9c32352b380c884289011e4ea3580e2fc177ff294445318e94e0394
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38799
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 27 Apr 2022 05:36:26 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=UA-34483098-1
Date
Wed, 27 Apr 2022 05:36:25 GMT
Cross-Origin-Resource-Policy
cross-origin
Server
Google Tag Manager
Content-Length
254
X-XSS-Protection
0
Content-Type
text/html; charset=UTF-8
font-awesome.min.css
netdna.bootstrapcdn.com/font-awesome/4.1.0/css/
Redirect Chain
  • http://netdna.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css?ver=3.3
  • https://netdna.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css?ver=3.3
20 KB
5 KB
Stylesheet
General
Full URL
https://netdna.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css?ver=3.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
723
age
9504740
cdn-cachedat
11/16/2021 10:00:11
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver
1.0
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:53 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
24fea2aa9e2be8670849a6e610f17afd
cf-ray
7025334b7b0c693d-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True

Redirect headers

Location
https://netdna.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.min.css?ver=3.3
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
render.min.css
www.heromachine.com/wp-content/plugins/gd-bbpress-toolbox/css/
7 KB
2 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/plugins/gd-bbpress-toolbox/css/render.min.css?ver=3.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
b09af8371ef89e585e232893cde65965b6350efab85ad0f475842c8b3d04ef4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Oct 2014 22:53:23 GMT
Server
nginx
ETag
W/"542dd763-1c57"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
style.min.css
www.heromachine.com/wp-includes/css/dist/block-library/
53 KB
8 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-includes/css/dist/block-library/style.min.css?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:24 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Nov 2020 10:14:11 GMT
Server
nginx
ETag
W/"5fb796f3-d293"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
bbpress.min.css
www.heromachine.com/wp-content/themes/coraline-heromachine/css/
24 KB
5 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/themes/coraline-heromachine/css/bbpress.min.css?ver=2.6.6
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
24def41a5286b761e56aeb283ea22fc2f9a31c3a140d74ac3840515245f5689b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Oct 2014 01:16:13 GMT
Server
nginx
ETag
W/"542ca75d-5f10"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
style.css
www.heromachine.com/wp-content/plugins/better-forum-list-widget/css/
300 B
525 B
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/plugins/better-forum-list-widget/css/style.css?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
3502ed38d3be1c4cb6eb0fa376cc0941389b647b51179eb4f54cf4470670f00c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:24 GMT
Last-Modified
Sat, 25 Jul 2015 04:35:13 GMT
Server
nginx
ETag
"55b31201-12c"
Content-Type
text/css
Connection
close
Accept-Ranges
bytes
Content-Length
300
styles.css
www.heromachine.com/wp-content/plugins/contact-form-7/includes/css/
2 KB
1001 B
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
fbf8ab57db7f9981bd71d79c7daaa01a3c578ffa0aa8e9b4a9b2bfe2e9927427

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:24 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Nov 2020 10:14:54 GMT
Server
nginx
ETag
W/"5fb7971e-780"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
style_login_widget.css
www.heromachine.com/wp-content/plugins/login-sidebar-widget/css/
996 B
1 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/plugins/login-sidebar-widget/css/style_login_widget.css?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
66073b3f60b0a2027d4ec6fa41f8662aae2610bec3905aed697f13da1b8e28e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:00 GMT
Server
nginx
ETag
"5fb79724-3e4"
Content-Type
text/css
Connection
close
Accept-Ranges
bytes
Content-Length
996
swipebox.min.css
www.heromachine.com/wp-content/plugins/responsive-lightbox/assets/swipebox/
4 KB
1 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/plugins/responsive-lightbox/assets/swipebox/swipebox.min.css?ver=2.2.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
8348fe66b515449f719cb7b8278e1c84009bdaa96e18981641bc1e77d9e4cf1a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 Nov 2020 10:15:06 GMT
Server
nginx
ETag
W/"5fb7972a-1080"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
style.css
www.heromachine.com/wp-content/themes/coraline-heromachine/
4 KB
2 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/themes/coraline-heromachine/style.css?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
c46642e7bfe3ef8e774edf6b15d3ff962e9affcd61972eea571c4cfd9220905e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Jul 2015 22:04:43 GMT
Server
nginx
ETag
W/"55aacd7b-10ad"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
jetpack.css
www.heromachine.com/wp-content/plugins/jetpack/css/
75 KB
14 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/plugins/jetpack/css/jetpack.css?ver=9.1.1
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
7772a9cc35fc902c0cccb8871670ec3e45e4695e1bc6941aee1c24db3de8c544

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 03 Jun 2021 10:02:25 GMT
Server
nginx
ETag
W/"60b8a8b1-12cc3"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
s2member-o.php
www.heromachine.com/wp-content/plugins/s2member/
9 KB
2 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/plugins/s2member/s2member-o.php?ws_plugin__s2member_css=1&qcABC=1&ver=200301-730065376
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
03ddfd0df287bc18b8a7782a61457610b2bcdfdbbc4656e9657c5da106e72d38

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
public
Date
Wed, 27 Apr 2022 05:36:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 27 Apr 2022 05:36:25 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css; charset=UTF-8
Cache-Control
max-age=604800
Transfer-Encoding
chunked
Connection
close
Expires
Wed, 04 May 2022 05:36:25 GMT
quote-comments.js
www.heromachine.com/wp-content/plugins/quote-comments/
6 KB
6 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/quote-comments/quote-comments.js?ver=1.0
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
badbad062f2e942c3eab0d49366f65e2ff7e705a80deeac6a2bcdbcb824d6bd8

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Sun, 12 Feb 2017 16:47:47 GMT
Server
nginx
ETag
"58a091b3-16c1"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
5825
jquery.js
www.heromachine.com/wp-includes/js/jquery/
95 KB
95 KB
Script
General
Full URL
http://www.heromachine.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:14:11 GMT
Server
nginx
ETag
"5fb796f3-17a69"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
96873
frontend-gtag.min.js
www.heromachine.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/
12 KB
12 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=8.5.0
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
ad94ea1bc50aaf3b69323cbcc73629348c0abf5796d15ed15238ac4e01b81680

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Thu, 31 Mar 2022 20:07:27 GMT
Server
nginx
ETag
"624609ff-2e19"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
11801
gcommerce-ada-fixes.js
www.heromachine.com/wp-content/plugins/gcommerce-ada-fixes/public/js/
8 KB
9 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/gcommerce-ada-fixes/public/js/gcommerce-ada-fixes.js?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
3e264ce8d7843d9a72cdd470a66c47e8b86bf9ba060d6e6cb6b0b0ac848f561b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Wed, 03 Jan 2018 17:53:37 GMT
Server
nginx
ETag
"5a4d18a1-215e"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
8542
jquery.validate.min.js
www.heromachine.com/wp-content/plugins/login-sidebar-widget/js/
23 KB
23 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/login-sidebar-widget/js/jquery.validate.min.js?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:00 GMT
Server
nginx
ETag
"5fb79724-5a1e"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
23070
additional-methods.js
www.heromachine.com/wp-content/plugins/login-sidebar-widget/js/
40 KB
40 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/login-sidebar-widget/js/additional-methods.js?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
e49dd69e982be2567da47515b224f8df28a3b40255c9bdac2fb367b6b46e9f8b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:00 GMT
Server
nginx
ETag
"5fb79724-9fc8"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
40904
jquery.swipebox.min.js
www.heromachine.com/wp-content/plugins/responsive-lightbox/assets/swipebox/
13 KB
13 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/responsive-lightbox/assets/swipebox/jquery.swipebox.min.js?ver=2.2.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
9fecc6157919ffc41b052ae7e49726e205c75b847aef46daab8d75e29a48b95f

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:06 GMT
Server
nginx
ETag
"5fb7972a-32a0"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
12960
infinite-scroll.pkgd.min.js
www.heromachine.com/wp-content/plugins/responsive-lightbox/assets/infinitescroll/
25 KB
25 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/responsive-lightbox/assets/infinitescroll/infinite-scroll.pkgd.min.js?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
6f97fb27fc5a2b0b2ef192937aeea30f869e026c98518e154a796755e3d0d864

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:06 GMT
Server
nginx
ETag
"5fb7972a-640f"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
25615
front.js
www.heromachine.com/wp-content/plugins/responsive-lightbox/js/
26 KB
27 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/responsive-lightbox/js/front.js?ver=2.2.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
48555977de52a497e0dd8fe5aaf9ebf2df20bf16340340f4012baaa8153e490b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:06 GMT
Server
nginx
ETag
"5fb7972a-6912"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
26898
banner-newad2.jpg
www.heromachine.com/wp-content/uploads/2014/09/
79 KB
79 KB
Image
General
Full URL
http://www.heromachine.com/wp-content/uploads/2014/09/banner-newad2.jpg
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
c3de7124ddd330ae2c46d3cc38c65e3c99da044c12a1aba9ed231190fa7f153d

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Tue, 30 Sep 2014 03:04:49 GMT
Server
nginx
ETag
"542a1dd1-13c84"
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
81028
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
157 KB
54 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
cdb0a643b3677148228615a289cedf8ef67c5dd052c4dd40ed9cda7cbebd2c6d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54530
x-xss-protection
0
server
cafe
etag
8986107761774100739
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 27 Apr 2022 05:36:25 GMT
8ba60e7ba01f98bf77d88d37f20e1e10
2.gravatar.com/avatar/
2 KB
3 KB
Image
General
Full URL
http://2.gravatar.com/avatar/8ba60e7ba01f98bf77d88d37f20e1e10?s=150&d=mm&r=g
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5fb967d10f49ce514c908cc021755e29791fbf475d8653faf0940c9a25235c87

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

X-nc
HIT hhn 1
Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Wed, 11 Jan 1984 08:00:00 GMT
Server
nginx
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
Content-Disposition
inline; filename="8ba60e7ba01f98bf77d88d37f20e1e10.png"
Connection
keep-alive
Accept-Ranges
bytes
Link
<https://www.gravatar.com/avatar/8ba60e7ba01f98bf77d88d37f20e1e10?s=150&d=mm&r=g>; rel="canonical"
Content-Length
2131
Expires
Wed, 27 Apr 2022 05:41:25 GMT
ga.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/ga.js
  • https://www.google-analytics.com/ga.js
45 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/ga.js
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
777
date
Wed, 27 Apr 2022 05:23:28 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Wed, 27 Apr 2022 07:23:28 GMT

Redirect headers

Location
https://www.google-analytics.com/ga.js
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
wp-emoji-release.min.js
www.heromachine.com/wp-includes/js/
14 KB
14 KB
Script
General
Full URL
http://www.heromachine.com/wp-includes/js/wp-emoji-release.min.js?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
07e4203b9f313b587b1d53f896e63771ec85f9b0d4c2ac5fa64089457784d847

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Last-Modified
Thu, 15 Apr 2021 10:02:45 GMT
Server
nginx
ETag
"60780f45-3795"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
14229
nerdmudgeon-header.png
www.heromachine.com/wp-content/uploads/2020/05/
469 KB
469 KB
Image
General
Full URL
http://www.heromachine.com/wp-content/uploads/2020/05/nerdmudgeon-header.png
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
2760f22cbb9f2be24c10ef518346bc0b9ba7a7d357635c1578e1e3f52690a668

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Sat, 23 May 2020 16:24:06 GMT
Server
nginx
ETag
"5ec94e26-754d3"
Content-Type
image/png
Connection
close
Accept-Ranges
bytes
Content-Length
480467
render.min.js
www.heromachine.com/wp-content/plugins/gd-bbpress-toolbox/js/
6 KB
6 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/gd-bbpress-toolbox/js/render.min.js?ver=3.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
d121b7dadeed0929280551f66eb34b2debe9891bf0b4c2b461829a2756d6d627

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Thu, 02 Oct 2014 22:53:31 GMT
Server
nginx
ETag
"542dd76b-1769"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
5993
editor.min.js
www.heromachine.com/wp-content/plugins/bbpress/templates/default/js/
974 B
1 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/bbpress/templates/default/js/editor.min.js?ver=2.6.6
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
df92bde186580a41df772f82ec6f18fd310f31f0eb410ef54b15c8fc96064df6

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:14:54 GMT
Server
nginx
ETag
"5fb7971e-3ce"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
974
scripts.js
www.heromachine.com/wp-content/plugins/contact-form-7/includes/js/
14 KB
14 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
125ec330f66081e7dc9f2814e9ec18f4e2d0baa1936d497375eedfda7ac12e5c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Last-Modified
Fri, 20 Nov 2020 10:14:54 GMT
Server
nginx
ETag
"5fb7971e-37c8"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
14280
api.js
www.google.com/recaptcha/
884 B
999 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?render=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&ver=3.0
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
b581028d6391255ecdf713359eaafeade21c9f2e70a8f6127483b2255a62c969
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
586
x-xss-protection
1; mode=block
expires
Wed, 27 Apr 2022 05:36:25 GMT
script.js
www.heromachine.com/wp-content/plugins/contact-form-7/modules/recaptcha/
1 KB
1 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/contact-form-7/modules/recaptcha/script.js?ver=5.3
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
aef711d1643073ab593de1d958ee854d6f63339cb216eda43666fb9dfcebffd0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Last-Modified
Fri, 20 Nov 2020 10:14:54 GMT
Server
nginx
ETag
"5fb7971e-4f3"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
1267
gprofiles.js
secure.gravatar.com/js/
23 KB
7 KB
Script
General
Full URL
https://secure.gravatar.com/js/gprofiles.js?ver=202217
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b8ddfe2786718750e37a2a7d2841e4e6a110a1877e21a03675d47c591d4a7f03

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:25 GMT
content-encoding
br
last-modified
Fri, 25 Feb 2022 16:03:16 GMT
server
nginx
etag
W/"6218fdc4-5df8"
content-type
application/javascript
cache-control
max-age=604800
expires
Wed, 04 May 2022 05:36:25 GMT
wpgroho.js
www.heromachine.com/wp-content/plugins/jetpack/modules/
2 KB
2 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/jetpack/modules/wpgroho.js?ver=9.1.1
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
ccd911729403decd6e3b74702fdc4d2c1b1e3ecf35a147f7e5373669932cc708

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Last-Modified
Thu, 03 Jun 2021 10:02:25 GMT
Server
nginx
ETag
"60b8a8b1-7a1"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
1953
s2member-o.php
www.heromachine.com/wp-content/plugins/s2member/
18 KB
5 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/s2member/s2member-o.php?ws_plugin__s2member_js_w_globals=1&qcABC=1&ver=200301-730065376
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
2059bfd3d47fc29d4d383177e5728ad209413416679e93a3a4f56a9a680f991a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
public
Date
Wed, 27 Apr 2022 05:36:26 GMT
Content-Encoding
gzip
Last-Modified
Wed, 27 Apr 2022 05:36:26 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript; charset=UTF-8
Cache-Control
max-age=604800
Transfer-Encoding
chunked
Connection
close
Expires
Wed, 04 May 2022 05:36:26 GMT
jquery.colorbox.min.js
www.heromachine.com/wp-content/plugins/wp-ajax-edit-comments/js/
12 KB
12 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/wp-ajax-edit-comments/js/jquery.colorbox.min.js?ver=6.1
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
41bc4d4fe88139d6ee89abfcb2abac71e1430d85dbffc0be7c8f6bd36f4ced7e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:04 GMT
Server
nginx
ETag
"5fb79728-2eb8"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
11960
jquery.atd.textarea.js
www.heromachine.com/wp-content/plugins/wp-ajax-edit-comments/js/
27 KB
27 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/wp-ajax-edit-comments/js/jquery.atd.textarea.js?ver=6.1
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
59eea5789a6787902ce1ec6a71b34f32808d75f6a0be489cd4f5910d7bed804b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:04 GMT
Server
nginx
ETag
"5fb79728-6bd5"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
27605
frontend.js
www.heromachine.com/wp-content/plugins/wp-ajax-edit-comments/js/
1 KB
2 KB
Script
General
Full URL
http://www.heromachine.com/wp-content/plugins/wp-ajax-edit-comments/js/frontend.js?ver=6.1
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
cf929e11b42b085a4f5d5385314f7b7104d2e260a10691955ab6eed27f5c241f

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Last-Modified
Fri, 20 Nov 2020 10:15:04 GMT
Server
nginx
ETag
"5fb79728-589"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
1417
wp-embed.min.js
www.heromachine.com/wp-includes/js/
1 KB
2 KB
Script
General
Full URL
http://www.heromachine.com/wp-includes/js/wp-embed.min.js?ver=3fedd506bbdda28ad909bcdb4f890497
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Last-Modified
Thu, 15 Apr 2021 10:02:45 GMT
Server
nginx
ETag
"60780f45-592"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
1426
pinit_main.js
assets.pinterest.com/js/
66 KB
18 KB
Script
General
Full URL
https://assets.pinterest.com/js/pinit_main.js?0.3026635399971134
Requested by
Host: assets.pinterest.com
URL: http://assets.pinterest.com/js/pinit.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:4b::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
20f0315c97ff7007f2e7a94d659e094a7efc01b8306da53987538c1101489e0e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:25 GMT
content-encoding
br
x-cdn
fastly
etag
"3725764cf05d1a0938de73d398772331"
vary
Accept-Encoding, Origin
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-max-age
86400
cache-control
max-age=300
content-length
18679
access-control-expose-headers
X-CDN
geocc.js
g.pcmag.com/
184 B
323 B
Script
General
Full URL
https://g.pcmag.com/geocc.js
Requested by
Host: cdn.nsstatic.net
URL: http://cdn.nsstatic.net/ns/heromachine.com.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:ef::5f65:4d33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
99ecb14ec0a4e706ee386f1bde1a4684119fa8e100f24821f71f7fa75ccd481d

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Connection
keep-alive
Content-Length
184
Content-Type
application/javascript
nsgpt.jsonp
ns.zdbb.net/
190 B
442 B
Script
General
Full URL
https://ns.zdbb.net/nsgpt.jsonp?u=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F
Requested by
Host: cdn.nsstatic.net
URL: http://cdn.nsstatic.net/ns/heromachine.com.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3dc119694e1216e1749dbb003335c802449eaf4afd47d1b16606ad00ecacee88

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
http://www.heromachine.com
cache-control
max-age=55
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Cache-Control
content-length
178
expires
Wed, 27 Apr 2022 05:37:21 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/
84 KB
29 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.nsstatic.net
URL: http://cdn.nsstatic.net/ns/heromachine.com.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
sffe /
Resource Hash
f7156b45752a71503d0c62be49c8108aa203626ae44dd1c8addd658881f848f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28718
x-xss-protection
0
server
sffe
etag
"1198 / 442 of 1000 / last-modified: 1651010823"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 27 Apr 2022 05:36:26 GMT
style.css
www.heromachine.com/wp-content/themes/coraline/
29 KB
6 KB
Stylesheet
General
Full URL
http://www.heromachine.com/wp-content/themes/coraline/style.css
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/wp-content/themes/coraline-heromachine/style.css?ver=3fedd506bbdda28ad909bcdb4f890497
Protocol
HTTP/1.1
Server
208.100.58.40 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
heromachine.com
Software
nginx /
Resource Hash
ffe780d5ad2bceb03604357aa85727c5808151170a8f49bfc02619c58a20735c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/wp-content/themes/coraline-heromachine/style.css?ver=3fedd506bbdda28ad909bcdb4f890497
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 01 Jul 2015 18:40:59 GMT
Server
nginx
ETag
W/"5594343b-7481"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
close
beacon.js
b.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
http://b.scorecardresearch.com/beacon.js
Requested by
Host: cdn.nsstatic.net
URL: http://cdn.nsstatic.net/ns/heromachine.com.js
Protocol
HTTP/1.1
Server
13.32.121.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-37.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
Date
Wed, 27 Apr 2022 04:04:20 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Fri, 26 Feb 2021 14:35:05 GMT
Server
AmazonS3
Age
8027
ETag
W/"1827f116c73f319409b97f10b8a58ade"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront)
Connection
keep-alive
X-Amz-Cf-Pop
FRA60-P1
X-Amz-Cf-Id
1R7snIpcf57gkpDyp4xCNGgRAPBWd1DVsNZiTEO1VywggDCTHy0t7g==
z0WVjCBSEeGLoxIxOQVEwQ.min.js
cdn.static.zdbb.net/eu/js/
Redirect Chain
  • https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
  • https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
93 KB
26 KB
Script
General
Full URL
https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b01ab209fbb92b0b7f9e3dc84c3fb7d615e19e78dc774194fcef9247108dc1c5

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-version-id
Z8KutEx1Yu8KnOXxgaPeJpb1kHmlsKHo
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 15:15:27 GMT
x-amz-request-id
6W4FGVB0BACZYQXQ
date
Wed, 27 Apr 2022 05:36:26 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
26627
x-amz-id-2
hUbu4ywhMbxX686BsIqPDdLtchabLDbEJU3uGuL6VplHe5e8vm94Ct054NaDj52bknZgBOc6DvY=
expires
Thu, 28 Apr 2022 05:36:26 GMT

Redirect headers

location
https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
date
Wed, 27 Apr 2022 05:36:26 GMT
cache-control
max-age=86400
core-eu
Yes
content-length
0
expires
Thu, 28 Apr 2022 05:36:26 GMT
v60.js
cdn-gl.imrworldwide.com/
Redirect Chain
  • https://secure-us.imrworldwide.com/v60.js
  • https://cdn-gl.imrworldwide.com/v60.js
21 KB
7 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/v60.js
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
2600:9000:21f3:9800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
75481bc06d1b02e50fd1cc921a7838e3af6caa9b8c0745b50182ebf29f195e20

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Tue, 26 Apr 2022 06:49:57 GMT
content-encoding
gzip
last-modified
Mon, 12 Oct 2020 13:35:53 GMT
server
AmazonS3
age
81990
etag
W/"cc7339d315e5ab16597dd66d153a0e7e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
.KrDWJ6YcsmnfI6j8sx8eWw9CjCealBE
via
1.1 590590f04f79f692591f9db0e720a31c.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
FRA2-C2
content-type
application/javascript
x-amz-cf-id
XTduX8pI-Ov4f2LbaUuMllsNgiQ9lHbv13E6sDfoC-iIjypyVlTY1Q==

Redirect headers

location
https://cdn-gl.imrworldwide.com:443/v60.js
date
Wed, 27 Apr 2022 05:36:26 GMT
server
awselb/2.0
content-length
134
content-type
text/html
/
gurgle.zdbb.net/
43 B
368 B
Image
General
Full URL
http://gurgle.zdbb.net/?domain=netshelter.net
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
HTTP/1.1
Server
52.54.164.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-164-181.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
http://www.heromachine.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type, Cache-Control
Content-Length
43
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
859adbfc48bb0b06c58fe109db4909585fbca5df398d49185fc0f486bad1ac96

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/svg+xml
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=8&c2=6036316&c3=1&ns__t=1651037785922&ns_c=UTF-8&cv=3.5&c8=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20H...
  • https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&c3=1&ns__t=1651037785922&ns_c=UTF-8&cv=3.5&c8=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20...
0
189 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&c3=1&ns__t=1651037785922&ns_c=UTF-8&cv=3.5&c8=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&c7=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&c9=
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
13.225.80.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-38.fra2.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
via
1.1 ec9e3bc729d9c6d55ed32446408ad62e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
2u8exyHKKB0gtBou99huaSUGWWiwjA9Z_nuRTxnwx7SjAT60wAcqFQ==
x-cache
Miss from cloudfront

Redirect headers

location
/b2?c1=8&c2=6036316&c3=1&ns__t=1651037785922&ns_c=UTF-8&cv=3.5&c8=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&c7=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&c9=
date
Wed, 27 Apr 2022 05:36:26 GMT
via
1.1 ec9e3bc729d9c6d55ed32446408ad62e.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
content-length
0
x-amz-cf-id
cilAnxv_U5ZHXVuEi6HtXFa9UIbK0lT-YaYYeuMCS8SV6pNZCbRzaA==
x-cache
Miss from cloudfront
__utm.gif
www.google-analytics.com/r/
Redirect Chain
  • http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1530268844&utmhn=www.heromachine.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=J...
  • https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1530268844&utmhn=www.heromachine.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=...
35 B
197 B
Image
General
Full URL
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1530268844&utmhn=www.heromachine.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&utmhid=137577621&utmr=-&utmp=%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&utmht=1651037786043&utmac=UA-34483098-1&utmcc=__utma%3D177811772.710865485.1651037786.1651037786.1651037786.1%3B%2B__utmz%3D177811772.1651037786.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=90123864&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:26 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1530268844&utmhn=www.heromachine.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Joe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&utmhid=137577621&utmr=-&utmp=%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&utmht=1651037786043&utmac=UA-34483098-1&utmcc=__utma%3D177811772.710865485.1651037786.1651037786.1651037786.1%3B%2B__utmz%3D177811772.1651037786.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=90123864&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/
305 KB
109 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
27cb2db9bca695c28c5688b5942cfb1d25fdf024eaf2fac1e449bd910d4063bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
111276
x-xss-protection
0
server
cafe
etag
16595822695063354719
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Wed, 27 Apr 2022 05:36:26 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20220425/r20190131/ Frame 2917
10 KB
5 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20220425/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
44466
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
gzip
content-length
4404
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 17:15:20 GMT
etag
3347421328414474149
expires
Tue, 10 May 2022 17:15:20 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
info
gurgle.zdbb.net/
237 B
454 B
XHR
General
Full URL
https://gurgle.zdbb.net/info?url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&fp=0
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.54.164.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-164-181.compute-1.amazonaws.com
Software
/
Resource Hash
f455d7418fb903d2a050af703a227f3c83fc7588cd721237b9519d9b207ae169

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin
http://www.heromachine.com
date
Wed, 27 Apr 2022 05:36:26 GMT
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Cache-Control
content-length
237
access-control-allow-methods
GET, OPTIONS
content-type
application/json
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: http://www.googletagmanager.com/gtag/js?id=UA-34483098-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
96
date
Wed, 27 Apr 2022 05:34:50 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Wed, 27 Apr 2022 07:34:50 GMT
pubads_impl_2022042101.js
securepubads.g.doubleclick.net/gpt/
362 KB
123 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
sffe /
Resource Hash
baa7346a51ac22b01b0f63ef8be8a7b0946a67fbe68ccf2c8a783a769bad8870
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 20:06:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
34177
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
126124
x-xss-protection
0
last-modified
Thu, 21 Apr 2022 08:41:17 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 26 Apr 2023 20:06:49 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/
90 B
111 B
XHR
General
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.heromachine.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
3e414400ff2bb19c0d21cb51da8fb1ecbbba1fda12d841fdb70e5c3bd8557b56
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
86
x-xss-protection
0
expires
Wed, 27 Apr 2022 05:36:26 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/
364 KB
145 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&ver=3.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a4d47dd6793fe24c23ab3c34f630ce5d0f42ef12a9e19eabd2fba286296647e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.heromachine.com/
Origin
http://www.heromachine.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 22:17:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
26319
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
147479
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 04:06:57 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 26 Apr 2023 22:17:47 GMT
cookie.js
partner.googleadservices.com/gampad/
219 B
646 B
Script
General
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=www.heromachine.com&callback=_gfp_s_&client=ca-pub-8918086678620138
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
cafe /
Resource Hash
ff6d43dd81cbe9bc3ba370bb9942e6c61792184a730707ca0ac512554c0e8e41
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
202
x-xss-protection
0
integrator.js
adservice.google.de/adsid/
107 B
792 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.heromachine.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
549 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.heromachine.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 4178
430 B
230 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=280&slotname=4501571694&adk=4109651738&adf=254961017&pi=t.ma~as.4501571694&w=1030&fwrn=4&fwrnh=100&lmt=1651037786&rafmt=1&psa=0&format=1030x280&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&dt=1651037786105&bpp=3&bdt=1294&idt=135&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&correlator=235040548260&frm=20&pv=2&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=285&ady=343&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&fsb=1&xpc=px1b8adWnj&p=http%3A//www.heromachine.com&dtd=153
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
47380069c0219b67b6f43c99d352c5acf3638ef654c70a4c7a16c30991824e62
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
br
content-length
207
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:26 GMT
expires
Wed, 27 Apr 2022 05:36:26 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame B559
23 KB
10 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
714cf5037b1c26152ff83b6f11a8c345fc0035184128443abb8a712c4f223179
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
br
content-length
9754
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:26 GMT
expires
Wed, 27 Apr 2022 05:36:26 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
pub
pixel.adsafeprotected.com/services/
1 KB
2 KB
XHR
General
Full URL
http://pixel.adsafeprotected.com/services/pub?anId=7529&slot=%7Bid:nsgpt-oop-footer,s:1.1,p:/4585/ns.heromachine/general,t:display%7D&slot=%7Bid:nsgpt-oop-stitials,s:1.1,p:/4585/ns.heromachine/general,t:display%7D&slot=%7Bid:nsgpt-oop-inpage,s:1.1,p:/4585/ns.heromachine/general,t:display%7D&slot=%7Bid:nsgpt-oop-skin,s:1.1,p:/4585/ns.heromachine/general,t:display%7D&slot=%7Bid:nsgpt-oop-inline,s:1.1,p:/4585/ns.heromachine/general,t:display%7D&slot=%7Bid:nsgpt-oop-masthead,s:1.1,p:/4585/ns.heromachine/general,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=b70038cb-9983-ed69-e1a1-de618658c0d6&url=http%253A%252F%252Fwww.heromachine.com%252Fforums%252Fusers%252Fbiden-approval-rating-drops-further%252F
Requested by
Host: cdn.nsstatic.net
URL: http://cdn.nsstatic.net/ns/heromachine.com.js
Protocol
HTTP/1.1
Server
3.248.54.145 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-54-145.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
0fe8d6536fec91280e859d0ef7367d60ca8deff3ee5258a893993c2a23aa7d69

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
X-Server-Name
app04.ie.303net.net
Transfer-Encoding
chunked
Content-Type
application/json;charset=UTF-8
Access-Control-Allow-Origin
http://www.heromachine.com
Access-Control-Expose-Headers
X-Server-Name
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
Server
nginx
integrator.js
adservice.google.de/adsid/
107 B
122 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.heromachine.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
122 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.heromachine.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame E63C
9 KB
4 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&adk=1812271804&adf=3025194257&lmt=1651037786&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&ea=0&pra=7&wgl=1&dt=1651037786610&bpp=1&bdt=1799&idt=1&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D00e45887a84bcb4d-222f2e5882cd0029%3AT%3D1651037786%3ART%3D1651037786%3AS%3DALNI_MYs3oyun6WzR_8E82IPnNIPJnYaQQ&prev_fmts=1030x280%2C300x250&nras=1&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=3&uci=a!3&fsb=1&dtd=8
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a8729d2f646503894ef80b047ab4690d600796744b3f8300a7baa8350664a77e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
br
content-length
4019
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:26 GMT
expires
Wed, 27 Apr 2022 05:36:26 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
hovercard.min.css
secure.gravatar.com/dist/css/
8 KB
2 KB
Stylesheet
General
Full URL
http://secure.gravatar.com/dist/css/hovercard.min.css?ver=202217
Requested by
Host: secure.gravatar.com
URL: https://secure.gravatar.com/js/gprofiles.js?ver=202217
Protocol
HTTP/1.1
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Content-Encoding
gzip
Last-Modified
Wed, 11 Nov 2020 15:57:10 GMT
Server
nginx
ETag
W/"5fac09d6-1e86"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=604800
Connection
keep-alive
Expires
Wed, 04 May 2022 05:36:26 GMT
services.min.css
secure.gravatar.com/dist/css/
3 KB
847 B
Stylesheet
General
Full URL
http://secure.gravatar.com/dist/css/services.min.css?ver=202217
Requested by
Host: secure.gravatar.com
URL: https://secure.gravatar.com/js/gprofiles.js?ver=202217
Protocol
HTTP/1.1
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:26 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Mar 2018 09:46:04 GMT
Server
nginx
ETag
W/"5ab37b5c-a54"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=604800
Connection
keep-alive
Expires
Wed, 04 May 2022 05:36:26 GMT
anchor
www.google.com/recaptcha/api2/ Frame 9D66
42 KB
21 KB
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7fe1d053ce2ea30ac6f945a742bb757c89db0536e0b051e91df314e7e537e81e
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-gsDxdruLVcnNJycJYxE3oA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-length
21923
content-security-policy
script-src 'report-sample' 'nonce-gsDxdruLVcnNJycJYxE3oA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:26 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/ Frame 9D66
51 KB
24 KB
Stylesheet
General
Full URL
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 17:45:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42655
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24237
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 04:06:57 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 26 Apr 2023 17:45:31 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/ Frame 9D66
364 KB
144 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a4d47dd6793fe24c23ab3c34f630ce5d0f42ef12a9e19eabd2fba286296647e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 22:17:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
26319
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
147479
x-xss-protection
0
last-modified
Mon, 18 Apr 2022 04:06:57 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 26 Apr 2023 22:17:47 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220425/r20110914/client/ Frame B559
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220425/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 04:51:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2709
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 11 May 2022 04:51:17 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame B559
119 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36950
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1650454428054601"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 27 Apr 2022 05:36:27 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220425/r20110914/client/ Frame B559
15 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220425/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bdc0c59701784258f143dfd4201f28353f080e0900a3530a83702e08c9ff353f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1184
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6415
x-xss-protection
0
server
cafe
etag
567849196274905959
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 11 May 2022 05:16:42 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame B559
0
0
Fetch
General
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=C5EmAWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5AFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOW7mw8sBnPX1zv5IZIcFY_zo8-2Lwp_moNl4L49H9nYALriaxHXhqABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi04OTE4MDg2Njc4NjIwMTM4GAA&sigh=7rhYqSx_Q3I&uach_m=[UACH]&cid=CAQSGwCNIrLM-Olft76fz80uXXiTONuYGPpRxwPZtRgB
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Wed, 27 Apr 2022 05:36:26 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
notify
rtb.fr.eu.criteo.com/google/auction/ Frame B559
0
0
Fetch
General
Full URL
https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kP2jEt2BMKwC-gGdg2ICAgAAAHep1LWZ5GCHEFnWaGKchk0do5WDCCvHMgASAAA&wp=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
server
Kestrel
server-processing-duration-in-ticks
352700
content-length
0
strict-transport-security
max-age=31536000; preload;
afr.php
ads.eu.criteo.com/delivery/r/ Frame 99CC
44 KB
17 KB
Document
General
Full URL
https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8918086678620138&output=html&h=250&slotname=7406952544&adk=3849478878&adf=931056912&pi=t.ma~as.7406952544&w=300&lmt=1651037786&psa=0&format=300x250&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&wgl=1&dt=1651037786108&bpp=2&bdt=1297&idt=173&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&prev_fmts=1030x280&correlator=235040548260&frm=20&pv=1&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1025&ady=731&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31065825&oid=2&pvsid=3975605269653886&pem=654&tmod=1447384107&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=dlKzArcRrO&p=http%3A//www.heromachine.com&dtd=176
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
eb956c4d7ba7839b892642dd0f23cbc8ca3d0f558d270105a63a6ca11641a59f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1000
cache-control
private, max-age=0, no-cache
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:26 GMT
expires
Mon, 26 Jul 1997 05:00:00 GMT
link
<pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p
CP='CUR ADM OUR NOR STA NID'
pragma
no-cache
report-to
{"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=wNVhCTHMBMd_5dS1XOpK0cpQjv-j8ObQ_qvtpuWEs_w0XiCFdyEfeo1Cqvo_UaERv9amp-BrK3gaxNZ6QBZ6kWP3u7rId8w1trM17PcFRTL1GEJVrWZEyOqqYPQuwP5EDr5riKSBlak7bCKQUU6hZsSTCNqLSnNTEDOUp4yQl-Ba6ALSE06tCMtqI-Q3hTzrK0iFgsLfyYrRceI33KzCDlhQi8zDXIz5de_i-ax84f-g5utE5mJ95oS2uXD64oTe2ZfbV6EjBibGyjKa"}], "max_age": 86400}
server
Kestrel
server-processing-duration-in-ticks
4944501
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
match
bee.imrworldwide.com/v1/clients/
39 B
495 B
XHR
General
Full URL
https://bee.imrworldwide.com/v1/clients/match?client_id=ziffdavis&url=http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Requested by
Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-21.fra2.r.cloudfront.net
Software
/
Resource Hash
0210bcf8c6f9fb41e1db722e8ec3c318101342f5922c59331321c993df1720d1
Security Headers
Name Value
Strict-Transport-Security max-age=25920000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-amz-cf-pop
FRA2-C2
x-frame-options
DENY
x-cache
Miss from cloudfront
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
access-control-allow-credentials
true
strict-transport-security
max-age=25920000; includeSubDomains
vary
Accept-Encoding
content-length
63
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
x-amz-cf-id
40lCsuvB1cKzW7kTEA_O09mV9-_tGxIlCZ8kpsy4p6JeFlzmiFSrrw==
storageframe.html
secure-us.imrworldwide.com/ Frame A4E8
Redirect Chain
  • http://secure-us.imrworldwide.com/storageframe.html
  • https://secure-us.imrworldwide.com/storageframe.html
11 KB
4 KB
Document
General
Full URL
https://secure-us.imrworldwide.com/storageframe.html
Requested by
Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.117.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-80-117-76.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods
POST, OPTIONS
access-control-allow-origin
*
content-encoding
gzip
content-length
3489
content-type
text/html
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:26 GMT
etag
"625f09b2-da1"
last-modified
Tue, 19 Apr 2022 19:12:50 GMT
server
nginx

Redirect headers

Connection
keep-alive
Content-Length
134
Content-Type
text/html
Date
Wed, 27 Apr 2022 05:36:26 GMT
Location
https://secure-us.imrworldwide.com:443/storageframe.html
Server
awselb/2.0
/
log.pinterest.com/
0
333 B
Image
General
Full URL
https://log.pinterest.com/?type=pidget&guid=f95VmCtC71ZQ&tv=2021110201&event=init&sub=www&button_count=1&follow_count=0&pin_count=0&profile_count=0&board_count=0&section_count=0&lang=en&nvl=en-US&via=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.0.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
via
1.1 varnish
x-cache
MISS
x-envoy-upstream-service-time
0
x-cache-hits
0
content-length
0
x-served-by
cache-hhn4064-HHN
pragma
no-cache
server
envoy
x-timer
S1651037787.931756,VS0,VE93
access-control-max-age
86400
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache,no-store,must-revalidate,max-age=0
x-pinterest-rid
7724426066005587
accept-ranges
bytes
expires
Sat, 01 Jan 2000 00:00:00 GMT
privacy_small.svg
static.criteo.net/flash/icon/ Frame 99CC
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/privacy_small.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
last-modified
Tue, 11 Feb 2020 14:30:28 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42ba84-6aa"
strict-transport-security
max-age=31536000; preload;
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 22 Apr 2023 05:36:27 GMT
adchoices_de.svg
static.criteo.net/flash/icon/ Frame 99CC
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/adchoices_de.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
last-modified
Tue, 11 Feb 2020 14:27:58 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e42b9ee-763"
strict-transport-security
max-age=31536000; preload;
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 22 Apr 2023 05:36:27 GMT
close_button.svg
static.criteo.net/flash/icon/ Frame 99CC
308 B
636 B
Image
General
Full URL
https://static.criteo.net/flash/icon/close_button.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
last-modified
Fri, 14 Feb 2020 13:51:32 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"5e46a5e4-134"
strict-transport-security
max-age=31536000; preload;
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
308
expires
Sat, 22 Apr 2023 05:36:27 GMT
back_button.svg
static.criteo.net/flash/icon/ Frame 99CC
507 B
835 B
Image
General
Full URL
https://static.criteo.net/flash/icon/back_button.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
last-modified
Thu, 01 Apr 2021 14:03:13 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"6065d2a1-1fb"
strict-transport-security
max-age=31536000; preload;
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
507
expires
Sat, 22 Apr 2023 05:36:27 GMT
lg.php
cat.nl.eu.criteo.com/delivery/ Frame 99CC
43 B
348 B
Image
General
Full URL
https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=h2T4QAn4vvZV5CDdlLNOexD51yluDSHBgvqwIBO0dAKZqqnSZ4_GIaeVBZqG08ifdocAEV-ku414aA6B2C3TntD_zwmG44ejRZXurFUmZd16dNKg28-GCsLmmca6GvN08jPk-5xaNYYNbeo7t7ykGJrdA-JnM7v8k7xvaiO4eeF5gvuW0_v-IDAk5KKMoyk4xI2buDdU_UPsAAyhEONqjiLgyKcMBmOeIzCGmeFDbE7lYbkq590ksYhgl52ulmwnfoHdaelLdbimbjmA_zGSRivko_gUD3YYtsJ8mpMMOgYdK6P-LAab-658sEmjhaex0JNeLibRhkZN7tjR8gnLDQ0KpDmcz-8Y-IhMU5rmgVpqm1-GivwV_H01q3Jn1xL3TwdqBWOuHvN5e4f0fHsC-YeRL_PdZ92JHWSyjULisF5IP4HufZ7YwwC2lptoaCA-Txzi-Q
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:26 GMT
server
Kestrel
strict-transport-security
max-age=31536000; preload;
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
2022898
content-type
image/gif
expires
Mon, 26 Jul 1997 05:00:00 GMT
2d112036c77d4afab9d89c88dc3241ee_image_ad_300x250.gif
static.criteo.net/design/dt/90764/220415/ Frame 99CC
262 KB
263 KB
Image
General
Full URL
https://static.criteo.net/design/dt/90764/220415/2d112036c77d4afab9d89c88dc3241ee_image_ad_300x250.gif
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
9f0f06f248aba9887a722a3e9f52d799bd14f50ff1e2e90de6e824e47b4d6ec3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
last-modified
Fri, 15 Apr 2022 14:42:12 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
"62598444-41972"
strict-transport-security
max-age=31536000; preload;
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
268658
expires
Sat, 22 Apr 2023 05:36:27 GMT
all
csm.eu.criteo.net/ Frame 99CC
0
128 B
Ping
General
Full URL
https://csm.eu.criteo.net/all?cppv=3&cpp=wNVhCTHMBMd_5dS1XOpK0cpQjv-j8ObQ_qvtpuWEs_w0XiCFdyEfeo1Cqvo_UaERv9amp-BrK3gaxNZ6QBZ6kWP3u7rId8w1trM17PcFRTL1GEJVrWZEyOqqYPQuwP5EDr5riKSBlak7bCKQUU6hZsSTCNqLSnNTEDOUp4yQl-Ba6ALSE06tCMtqI-Q3hTzrK0iFgsLfyYrRceI33KzCDlhQi8zDXIz5de_i-ax84f-g5utE5mJ95oS2uXD64oTe2ZfbV6EjBibGyjKa&sds=2&rev=81237&sendBeacon=true
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://ads.eu.criteo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Wed, 27 Apr 2022 05:36:26 GMT
cross-origin-resource-policy
cross-origin
server
Finatra
content-length
0
strict-transport-security
max-age=31536000; preload;
criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 99CC
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/criteo_logo_2021.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
last-modified
Thu, 27 May 2021 13:21:59 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"60af9cf7-891"
strict-transport-security
max-age=31536000; preload;
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 22 Apr 2023 05:36:27 GMT
privacy.svg
static.criteo.net/flash/icon/ Frame 99CC
2 KB
1 KB
Image
General
Full URL
https://static.criteo.net/flash/icon/privacy.svg
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.eu.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
last-modified
Wed, 19 Feb 2020 10:57:21 GMT
server
nginx
cross-origin-embedder-policy
require-corp
etag
W/"5e4d1491-646"
strict-transport-security
max-age=31536000; preload;
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31104000, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 22 Apr 2023 05:36:27 GMT
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • http://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2F...
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2...
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2...
44 B
596 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&sr=1600x1200&id=lstrg-086ba512ae18322aca4736e5a8da6688&ja=1
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Server
99.80.117.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-80-117-76.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:27 GMT
server
nginx
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:27 GMT
server
nginx
location
https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1651037787008&ci=ziffdavis&js=1&cg=0&ts=wpgroho.js?ver=9.1.1&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&sr=1600x1200&id=lstrg-086ba512ae18322aca4736e5a8da6688&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
config250.js
cdn-gl.imrworldwide.com/conf/
12 KB
5 KB
Script
General
Full URL
http://cdn-gl.imrworldwide.com/conf/config250.js
Requested by
Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol
HTTP/1.1
Server
2600:9000:21f3:9800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fd6365e05e9f4dd0f0bbedbcce84a0c052396f0ab4d56513b4172961cd67313a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-version-id
ag9XiUb_aPc3HhtEvyyt7J_Ueak7.As2
Content-Encoding
gzip
ETag
W/"6c9b0610d16db24b0f5ea4435470e07a"
Age
1100
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 27 Apr 2022 03:21:56 GMT
Server
AmazonS3
Date
Wed, 27 Apr 2022 05:18:15 GMT
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 ec9e3bc729d9c6d55ed32446408ad62e.cloudfront.net (CloudFront)
Cache-Control
max-age=86400,s-maxage=86400
X-Amz-Cf-Pop
FRA2-C2
X-Amz-Cf-Id
GT_eluJ9fiPa1CJO7Atpxyoab8pF5zTaF2Y5qBpEa60Ubv0Cclk-lg==
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 9D66
2 KB
2 KB
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Thu, 21 Apr 2022 19:40:09 GMT
x-content-type-options
nosniff
age
467778
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Thu, 28 Apr 2022 19:40:09 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 9D66
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 11:18:05 GMT
x-content-type-options
nosniff
age
65902
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 26 Apr 2023 11:18:05 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 9D66
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 18:59:48 GMT
x-content-type-options
nosniff
age
38199
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 26 Apr 2023 18:59:48 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 9D66
102 B
134 B
Other
General
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
20b97f4764680efdd44b021cb57bfb2b93850d0aaf8af024986393b0cb80f2d0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Wed, 27 Apr 2022 05:36:27 GMT
truncated
/ Frame B559
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e6288aaed3cc058d83e75942dce7079c4158e1a3310c507922c8e2e53faf71d7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Type
image/png
nlsSDK600.bundle.min.js
cdn-gl.imrworldwide.com/novms/js/2/
194 KB
55 KB
Script
General
Full URL
http://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: http://cdn-gl.imrworldwide.com/conf/config250.js
Protocol
HTTP/1.1
Server
2600:9000:21f3:9800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d6a02948be8e5e63277fd8aa74f7796824a553f94d4ddd2da72649b2db4d8d0c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-version-id
LaI3bgJFKmjFiMIqcskrgsRPNVDoCjEs
Content-Encoding
gzip
ETag
W/"6e735658822e2140abf2d7f08d51fdc8"
Age
2277
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Tue, 29 Mar 2022 13:42:22 GMT
Server
AmazonS3
Date
Wed, 27 Apr 2022 04:58:30 GMT
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 ec9e3bc729d9c6d55ed32446408ad62e.cloudfront.net (CloudFront)
Cache-Control
max-age=86400
X-Amz-Cf-Pop
FRA2-C2
X-Amz-Cf-Id
qAflmowY8opJGLvVjfyu2O6xO1zJ012XV5zGH779cSDAnAEBOK3smw==
ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame 908E
12 KB
4 KB
Document
General
Full URL
http://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by
Host: cdn-gl.imrworldwide.com
URL: http://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol
HTTP/1.1
Server
2600:9000:21f3:9800:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Age
2720
Cache-Control
max-age=86400
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Wed, 27 Apr 2022 04:51:08 GMT
ETag
W/"7fa83dfc7b78314b137e2eb13834daa7"
Last-Modified
Tue, 29 Mar 2022 13:42:22 GMT
Server
AmazonS3
Transfer-Encoding
chunked
Vary
Accept-Encoding
Via
1.1 ec9e3bc729d9c6d55ed32446408ad62e.cloudfront.net (CloudFront)
X-Amz-Cf-Id
JK6PQ6hvA9PBO6t-iL1nqZ2ITPInr1_hP2PvyOqdPDGf3uAskugn_w==
X-Amz-Cf-Pop
FRA2-C2
X-Cache
Hit from cloudfront
x-amz-server-side-encryption
AES256
x-amz-version-id
R2mBDLPdj1BePEBHouDc59M0pIzpEWKh
reload
www.google.com/recaptcha/api2/ Frame 9D66
31 KB
18 KB
XHR
General
Full URL
https://www.google.com/recaptcha/api2/reload?k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
42e3875bbcbb773f1fa0928b6ebc2a75165e7b260166497a3bfe3ad2a66c5c9f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdG1IMUAAAAAP7jpSd9iJ0kejQjU9rP7aGEsfdP&co=aHR0cDovL3d3dy5oZXJvbWFjaGluZS5jb206ODA.&hl=de&v=QENb_qRrX0-mQMyENQjD6Fuj&size=invisible&cb=dc0g0uylc6xw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/x-protobuffer

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
private, max-age=0
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18110
x-xss-protection
1; mode=block
expires
Wed, 27 Apr 2022 05:36:27 GMT
check
jogger.zdbb.net/
4 B
364 B
XHR
General
Full URL
http://jogger.zdbb.net/check?href=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
HTTP/1.1
Server
34.194.37.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-194-37-39.compute-1.amazonaws.com
Software
/
Resource Hash
dfe88090c5ed7ac2f32571f0fc822fda4d8cd281fc7138c7cd6db656f6e2d081

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Wed, 27 Apr 2022 05:36:27 GMT
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Cache-control
private, max-age=0, no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type, Cache-Control
Content-Length
4
zd-core-olt.min.js
cdn.static.zdbb.net/js/
844 B
1 KB
Script
General
Full URL
https://cdn.static.zdbb.net/js/zd-core-olt.min.js?v=5
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-version-id
k8jPpOD2H7VJ8uXPaK3cbQMkkpsyCeap
last-modified
Mon, 18 Apr 2022 15:15:24 GMT
x-amz-request-id
6W40AKA4R95TZ9BJ
date
Wed, 27 Apr 2022 05:36:27 GMT
content-type
application/javascript
cache-control
max-age=604800
accept-ranges
bytes
content-length
844
x-amz-id-2
hMRePtsxER8q4/iJsJqWBXGQ2fXTqStSzGLTvdhNLkGjHKRSIdYp+jF4UnKpFufPgswImYobfIYaV7RWxRldrg==
expires
Wed, 04 May 2022 05:36:27 GMT
bk-coretag.js
tags.bkrtx.com/js/
Redirect Chain
  • http://tags.bkrtx.com/js/bk-coretag.js
  • https://tags.bkrtx.com/js/bk-coretag.js
51 KB
16 KB
Script
General
Full URL
https://tags.bkrtx.com/js/bk-coretag.js
Protocol
HTTP/1.1
Server
104.89.33.102 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-33-102.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Encoding
gzip
Last-Modified
Fri, 21 May 2021 19:14:21 GMT
Server
nginx/1.15.8
ETag
W/"60a8068d-cbc2"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=604800
Date
Wed, 27 Apr 2022 05:36:27 GMT
Connection
keep-alive
Content-Length
16078
Expires
Wed, 04 May 2022 05:36:27 GMT

Redirect headers

Date
Wed, 27 Apr 2022 05:36:27 GMT
Server
AkamaiGHost
Cache-Control
max-age=604800
Location
https://tags.bkrtx.com/js/bk-coretag.js
X-N
S
Connection
keep-alive
Content-Length
0
Expires
Wed, 04 May 2022 05:36:27 GMT
krux-coretag.js
cdn.static.zdbb.net/js/
335 B
629 B
Script
General
Full URL
https://cdn.static.zdbb.net/js/krux-coretag.js
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.232 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4f30bdeed794aeb92d85e55d901c0bdb634df32432010792e3b569ea73cae443

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-version-id
_KweYS4v8XHMUbNCHMEiZOmpfuflijlN
last-modified
Mon, 18 Apr 2022 15:15:17 GMT
x-amz-request-id
6W4BA81ZXC1SCP08
date
Wed, 27 Apr 2022 05:36:27 GMT
content-type
application/javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
335
x-amz-id-2
et1h2XkOQJjbHijiVcqnNG2zYMIIa3Xjr6iFZK49fGkdNbQVr3GYMSoSyeGRlTqOcQ+Z7dfSz30=
expires
Thu, 28 Apr 2022 05:36:27 GMT
z0WVjCBSEeGLoxIxOQVEwQ
zdbb.net/l/
43 B
109 B
Image
General
Full URL
https://zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ?additionalInformation=&cms_page_id=&local_uid=&referrer=&zd_pageview_id=a45cc0d8-ed9b-45eb-b1ec-b4f47a4404ed&zd_session_id=3cfd42d2-69b6-432c-8921-8ab81364ba7e&zd_location=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&evidon_consent=undefined&third_party_consent=&fu=true
Requested by
Host: www.heromachine.com
URL: http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.34.98.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-63-34-98-248.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-length
43
content-type
image/gif
sodar
pagead2.googlesyndication.com/getconfig/
14 KB
10 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220425&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fe8b9ef253dacc8f236b585575d50d5de23401a0ed6002a7fa8ce17ef01e05b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10563
x-xss-protection
0
gn
secure-us.imrworldwide.com/cgi-bin/ Frame 908E
44 B
596 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/gn?prd=session&c9=devid,&c13=asid,NA&sessionId=zhfvrubtkqqjxslwgemo9cyozbwoo1651037787&c16=sdkv,bj.6.0.0&retry=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.117.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-80-117-76.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cdn-gl.imrworldwide.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:27 GMT
server
nginx
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
/
zhfvrubtkqqjxslwgemo9cyozbwoo1651037787.nuid.imrworldwide.com/ Frame 908E
35 B
347 B
Image
General
Full URL
https://zhfvrubtkqqjxslwgemo9cyozbwoo1651037787.nuid.imrworldwide.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:3a00:1d:667e:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://cdn-gl.imrworldwide.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 02:50:08 GMT
via
1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront)
last-modified
Tue, 11 Sep 2018 17:05:20 GMT
server
AmazonS3
age
9980
etag
"c2196de8ba412c60c22ab491af7b1409"
x-cache
Hit from cloudfront
content-type
image/gif
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
35
x-amz-cf-id
Ps2mCbBV-sxj8aHTwJhb_fdQvIn6P9Akj17BN9qFaOcRYnbakysZNg==
spgdj7g8u.js
cdn.krxd.net/controltag/
2 B
629 B
Script
General
Full URL
http://cdn.krxd.net/controltag/spgdj7g8u.js
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/krux-coretag.js
Protocol
HTTP/1.1
Server
151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

X-CDN-Backend
4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
Date
Wed, 27 Apr 2022 05:36:27 GMT
Via
1.1 varnish, 1.1 varnish
Age
933
X-Cache
MISS, HIT, HIT
X-App-Cache
MISS
Connection
keep-alive
Content-Encoding
gzip
Content-Length
22
X-Served-By
config-service-a005-ash-prod.krxd.net, cache-iad-kcgs7200071-IAD, cache-hhn4024-HHN
X-Response-Time
0
X-Do-Esi
esi
X-Timer
S1651037787.306152,VS0,VE0
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
public, max-age=1200
Accept-Ranges
bytes
X-Age
0
X-Cache-Hits
0, 1, 63
30629
stags.bluekai.com/site/ Frame B8B2
71 B
338 B
Document
General
Full URL
https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dheromachine.com&phint=referer%3Dhttp%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&phint=__bk_t%3DJoe%20Biden%20approval%20rating%20drops%20further%20with%20young%20Americans%27s%20Profile%20%7C%20HeroMachine%20Character%20Portrait%20Creator&phint=__bk_k%3D&phint=__bk_l%3Dhttp%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&phint=__bk_v%3D3.1.10&limit=10&r=81452057
Requested by
Host: tags.bkrtx.com
URL: http://tags.bkrtx.com/js/bk-coretag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.90.192.27 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-90-192-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

BK-Server
fc20
Connection
keep-alive
Content-Length
71
Content-Type
text/html
Date
Wed, 27 Apr 2022 05:36:27 GMT
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
X-N
S
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8918086678620138&plah=www.heromachine.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 27 Apr 2022 05:36:27 GMT
4dae8469-5bbd-40de-bc3f-b3685fd12358
http://www.heromachine.com/
34 KB
0
Other
General
Full URL
blob:http://www.heromachine.com/4dae8469-5bbd-40de-bc3f-b3685fd12358
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
06e5061665609f258ffb869944f46380a7d169f1244495c63ad1d288f265b0ad

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/forums/users/biden-approval-rating-drops-further/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Length
35241
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame A695
13 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
32214
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 26 Apr 2022 20:39:33 GMT
expires
Wed, 26 Apr 2023 20:39:33 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 2CDB
783 B
534 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
f575802496a5c764a63672d6a79e56a40dedf33f68aaedcfe4ae015c97162136
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ly5Ck5TP7nLfxO/NaL2ipA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
512
content-security-policy
script-src 'report-sample' 'nonce-ly5Ck5TP7nLfxO/NaL2ipA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:27 GMT
expires
Wed, 27 Apr 2022 05:36:27 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
LE6A1jkwhzHIveaC2PWdXlafu4EKGxRoxiYl273qJjE.js
pagead2.googlesyndication.com/bg/ Frame A695
35 KB
13 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/LE6A1jkwhzHIveaC2PWdXlafu4EKGxRoxiYl273qJjE.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2c4e80d639308731c8bde682d8f59d5e569fbb810a1b1468c62625dbbdea2631
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Fri, 22 Apr 2022 06:20:32 GMT
content-encoding
br
x-content-type-options
nosniff
age
429355
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13647
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 11:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 22 Apr 2023 06:20:32 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 2CDB
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220425&jk=3975605269653886&rc=05ACztih7sI8kmkU1Q1q5VbFzEOgK88TXnHh2GFdvL0ONxjG--BGrFjLR-ViHZDB0DjTp7MPI61ZCOduYAbqX1GqBhiE1Wvft7-fUDdwU-Ul-jOq3A8O0kHgR2rvgAzA8JJwYXIXpqVi6FSfWi9OT2-ShgCoqzPlWnfM4jQcCWEHKwcMvpsIxIxogzfkFaFoeqLQdo5ryvWi-HuSXRjh1AWTmgoAsKu14KymNMTA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

receive_uint8
jogger.zdbb.net/ Frame
0
0
Preflight
General
Full URL
http://jogger.zdbb.net/receive_uint8
Protocol
HTTP/1.1
Server
34.194.37.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-194-37-39.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
cache-control,content-type
Access-Control-Request-Method
POST
Origin
http://www.heromachine.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Content-Type, Cache-Control
Access-Control-Allow-Methods
GET, OPTIONS
Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Length
2
Content-Type
text/plain; charset=utf-8
Date
Wed, 27 Apr 2022 05:36:27 GMT
receive_uint8
jogger.zdbb.net/
2 B
317 B
XHR
General
Full URL
http://jogger.zdbb.net/receive_uint8
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
HTTP/1.1
Server
34.194.37.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-194-37-39.compute-1.amazonaws.com
Software
/
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Cache-Control
no-cache
Referer
http://www.heromachine.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/octet-stream

Response headers

Date
Wed, 27 Apr 2022 05:36:28 GMT
Access-Control-Allow-Methods
GET, OPTIONS
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type, Cache-Control
Content-Length
2
generate_204
tpc.googlesyndication.com/ Frame A695
0
9 B
Image
General
Full URL
https://tpc.googlesyndication.com/generate_204?YgAuxA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
all
csm.eu.criteo.net/ Frame 99CC
0
127 B
Ping
General
Full URL
https://csm.eu.criteo.net/all?cppv=3&cpp=wNVhCTHMBMd_5dS1XOpK0cpQjv-j8ObQ_qvtpuWEs_w0XiCFdyEfeo1Cqvo_UaERv9amp-BrK3gaxNZ6QBZ6kWP3u7rId8w1trM17PcFRTL1GEJVrWZEyOqqYPQuwP5EDr5riKSBlak7bCKQUU6hZsSTCNqLSnNTEDOUp4yQl-Ba6ALSE06tCMtqI-Q3hTzrK0iFgsLfyYrRceI33KzCDlhQi8zDXIz5de_i-ax84f-g5utE5mJ95oS2uXD64oTe2ZfbV6EjBibGyjKa&sds=2&rev=81237&sendBeacon=true
Requested by
Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YmjWWgAF2iACO8K0AAK5Qc-4Ip_5PDk6S74HtA&u=%7CGiZ1S%2F5GIDasfj%2FK5H994Hl3fw7L1mAwC6oalFPWvao%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqyDsvBp4X-0QD3WoDqftjeOi_RL70L9wdExIWBwky5ilLPNjEJe3oZt44fJbsmwke8Dxk4aUn6WcJiczmx-x30c6M54YkrEEWeDpM5BJFXs_WZWk2S_wInrVovQgd-M7Ceymm4XQ1cP-tvMGteeE4flJmkVLlX7_9fIo2CP79j5DoZ8hAs702ySMYnvbxbAS2UKfyCNcMjfX6aN-Fe4iG61QuNuALGMNNiSwRorfHNAIh2DATqtw1YgLCDHxnkfqu20ewF5Rpf2npNNYIxe42ZzWSeroBDzsHtca17BelgYKU4g-vWqq2GBQBeACCJ3vNj31zHDM4PNayDHdPDbnw5qzzegWXnjEcZjJNtjcQXw3ODdv591W8jwHcnVicgBCoEnyAgIe97Zaxl7eBrLgXKUQshMswllc4B_Pn6rUOLeDRpEW_cWioj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuArJWtZoYqC0F7SF78EPwfKKqAzJntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTg5MTgwODY2Nzg2MjAxMzigAdW20uoDyAEJqQKP2hbrhNyxPqgDAaoE5wFP0OlCCzrRUabpfWbYTjhpuRdLcis5UD-ExHfQu-Fucbb5qHcD13voaelY_lMsGKQ4mP1aWMonMdUQOhgTTtWafGz7huHqhYAQ5bYz6yqL-xaupCI0kPEedyT_CmavAbLbbr4B4dZ3cSrNv4pYeNkEWfjAsAnPfoGnr6Y-tziOUbDUtRIs8rMjMpsoISbiw4P-LO3DlezR04RLrZh8oNPfR7IK39tAHsD2phEKGad3uUOgY-snv6Ho66BQjgOWrG4dIp5Aw09QeJLroGuZNoYq0goj0HKPI0rFUo3Yfi7zDAbDTaW4h8eABq7fmaCz9ord-AGgBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1MeIDwPUdkp-I6oa1Qd6K5-1DbcA%26client%3Dca-pub-8918086678620138%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://ads.eu.criteo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Wed, 27 Apr 2022 05:36:27 GMT
cross-origin-resource-policy
cross-origin
server
Finatra
content-length
0
strict-transport-security
max-age=31536000; preload;
activeview
pagead2.googlesyndication.com/pcs/ Frame B559
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstd8mbakWQT7Iez6CJ9Uz8vGYlmgCFIuDVf5TVZNpxTmkKie949VGWpGMBxrsjyjdps_3-TfoUwDRlU1WSDVQP3&sig=Cg0ArKJSzKg-Ysp3PQIwEAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3849478878&rs=2&la=0&cr=0&vs=4&r=v&rst=1651037786285&rpt=839&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220425&jk=3975605269653886&bg=!GhmlGV3NAAYXWUUuN1k7ACkAdvg8Wsm94KkAXep9azyK7nrcjM2woRjqr81suP6P4h8WRWd56MCVkQIAAABGUgAAAAhoAQcKAJzvxRmDjdN2MeP2aJqO_BqB8HvqReT-qqy7q5UQIPfAlAg7m49dUrcqSuj2v8cDb0OcIQMDV8b1D_NZBE6WrfrTzQYj6HZTaT-9T6Xrs6_skqIIUMaUfuf1OenyiCMUQ67PeEDIRuIABkFc0eTp0VhYhE-cAv156WtNVnATBecF-cOpS_ANIo7MOnttRYXM3u0db-PyqNh7rFGxBJ6ZApz3xXje-0HvcYkUGWFBrSSWrQ1x3VR13YSr7Sfc3d3q6D8RqxpBhHxrsp50dvxoyx8VcLmdJIWd5BOEsFm-tY8h_fedbO38qP5qpdrAblwwewlI2GC7C9DIGtYnfTcg2GivrhXTrPnJgvUvnjParC4oSTGIHJ-9PuZ_eKI08GW4ZLxSfOu5gaSCseNRveho42fJP3IPf7Wa50wwEHSl0_qEHGXGT_H9T88y_FPOzPAX1Sdwem5G5YL0wfYMXFX5ti2NWxTU1DPCj5LTDa72jeFz-Fg2pDtjxYTOrSYTMO7688VDVfxlh85-q3p6_lkl8QalBLD8iurnLTfmT-6Ax2-zOFgYvV7vdOGIP-tVMafAYJhTs6BIzEM5J2eDMhaDLrcXRhD2pUB4HsY2nuckizPnb5UoWiJNFQmyvPkW_iY4ykEp_oq0nENIYo9ov4iC6cuuvElUFXjsP5whw2t7BRuWqQA1JmfjLrjAZbFprn353N31m9_TqHqc_OLXkJy18fje-vA8RvWCcWUhLBEVfZyYYbxQdMMPZ0469gkvFmvh68bFFZ6DhGSQ2B4kuq6jqQW9jjtWnJVcso7f264YfQNR5bOzlzgOYRhoxHwfU21VboFLh4LZkbQcwHpufzy2MJktkff7XQddal78MbBxXH4C2nfNm0iQkn9U23dIB3x6sOubiXDOGRB2TWIlLEEFIe-r3VB8h2yYlVIZehnU4obJF5CYOZGxGpmCQfbIWbvye6UIJ0wnX6TIRBLQ0hQYjr-TO72gQ69Z5mn3DEr_pq2Zhvq7mzKoTPNhccWUaBSoaVA6uuaSF0WzYHpMa5gcHo16PSzdlzGT-9GJd6tSIRdu7p1LQrxD6h0sIccS84919h84Q_bnCdeQDXkYYQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

check_c
zdbb.net/
0
233 B
XHR
General
Full URL
https://zdbb.net/check_c
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.34.98.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-63-34-98-248.eu-west-1.compute.amazonaws.com
Software
Ziff Davis BuyerBase /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:28 GMT
server
Ziff Davis BuyerBase
p3p
CP="ALL DSP COR NID"
access-control-allow-origin
http://www.heromachine.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
text/plain; charset=utf-8
content-length
0
expires
0
integrator.js
adservice.google.de/adsid/
107 B
122 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.heromachine.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
122 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.heromachine.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 27 Apr 2022 05:36:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
2 KB
282 B
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3975605269653886&correlator=1923270903558962&eid=31067152%2C31067239%2C31065825%2C31065517&output=ldjh&gdfp_req=1&vrg=2022042101&ptt=17&impl=fifs&iu_parts=4585%2Cns.heromachine%2Cgeneral&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C1x1%2C1x1%2C1x1%2C1x1%2C120x30&ifi=4&adks=637991384%2C1318831111%2C813085424%2C1286759580%2C812342080%2C1422874705&didk=1451468919~1163669365~968639880~1039880424~968716408~3288322767&sfv=1-0-38&ecs=20220427&ists=62&fsapi=false&prev_scp=ad_group%3Dad_opt%26OOP_type%3Dfooter%26rfr%3Dfalse%26OOF%3Dfalse%26id%3Dfb30f99c-c5eb-11ec-ab14-061b2abdf756%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%2C50%2C60%2C70%7Cad_group%3Dad_opt%26OOP_type%3Dstitials%26rfr%3Dfalse%26OOF%3Dfalse%26id%3Dfb30f99d-c5eb-11ec-ab14-061b2abdf756%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%2C50%2C60%2C70%7Cad_group%3Dad_ex4%26OOP_type%3Dinpage%26rfr%3Dfalse%26OOF%3Dfalse%26id%3Dfb30f99e-c5eb-11ec-ab14-061b2abdf756%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%2C50%2C60%2C70%7Cad_group%3Dad_opt%26OOP_type%3Dskin%26rfr%3Dfalse%26OOF%3Dfalse%26id%3Dfb30f99f-c5eb-11ec-ab14-061b2abdf756%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%2C50%2C60%2C70%7Cad_group%3Dad_opt%26OOP_type%3Dinline%26rfr%3Dfalse%26OOF%3Dfalse%26id%3Dfb30f9a0-c5eb-11ec-ab14-061b2abdf756%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%2C50%2C60%2C70%7Cad_group%3Dad_ex8%26OOP_type%3Dmasthead%26rfr%3Dfalse%26OOF%3Dfalse%26id%3Dfb30f9a1-c5eb-11ec-ab14-061b2abdf756%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%2C50%2C60%2C70&eri=4&cust_params=url%3D%252Fforums%252Fusers%252Fbiden-approval-rating-drops-further%252F%26ref%3D%26gdpr%3D0%26zcp%3Da7d0b2aa172a66fa7823d%26cpid%3D32a668991a7696d6da193fa5022a2a3f%26mop%3Dy%26amznslots%3D%26zdid%3D32a668991a7696d6da193fa5022a2a3f%26zc%3Dbecc579a-e306-4cb3-9615-978a101a1954%26zdbb%3D%26pageviewid%3Da45cc0d8-ed9b-45eb-b1ec-b4f47a4404ed%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow%26ias-kw%3DIAS_1506123_PG%252CIAS_6537_KW%252CIAS_6491_KW%252CIAS_3005122_PG%252CIAS_6539_KW%252CIAS_1500918_PG%252CIAS_1505947_PG%252CIAS_1500692_PG%252CIAS_1500903_PG%252CIAS_6494_KW%252CIAS_1500902_PG%252CIAS_1507653_PG%26s%3D%26p2%3D&sc=0&cookie=ID%3D00e45887a84bcb4d-222f2e5882cd0029%3AT%3D1651037786%3ART%3D1651037786%3AS%3DALNI_MYs3oyun6WzR_8E82IPnNIPJnYaQQ&abxe=1&dt=1651037789031&dlt=1651037784811&idt=1484&biw=1600&bih=1200&adxs=0%2C0%2C0%2C0%2C0%2C0&adys=1200%2C1200%2C1200%2C1200%2C1200%2C1170&ucis=1%7C2%7C3%7C4%7C5%7C6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&bc=23&nvt=1&url=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x3817%7C1600x3817%7C1600x3817%7C1600x3817%7C1600x3817%7C1600x3817&msz=0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C120x-1&fws=0%2C0%2C0%2C0%2C0%2C512&ohw=0%2C0%2C0%2C0%2C0%2C0&ga_vid=710865485.1651037786&ga_sid=1651037786&ga_hid=137577621&ga_fc=true&btvi=1%7C2%7C3%7C4%7C5%7C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
cbcbcd7ece03838e0d61df03ee49190ff6af74f11b8f22c2b6f1a1e0f4560c9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 27 Apr 2022 05:36:29 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
253
x-xss-protection
0
google-lineitem-id
-2,-2,-2,-2,-2,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,-2,-2,-2,-2,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
http://www.heromachine.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
13892b799720f42beca56691076df1c4.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C54A
6 KB
4 KB
Document
General
Full URL
https://13892b799720f42beca56691076df1c4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022042101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://www.heromachine.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 27 Apr 2022 05:36:29 GMT
expires
Thu, 27 Apr 2023 05:36:29 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
gn
secure-us.imrworldwide.com/cgi-bin/
44 B
596 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=au-408075&ch=au-408075_b99_0&sessionId=zhfvrubtkqqjxslwgemo9cyozbwoo1651037787&asn=0&prv=1&c6=vc,b99&ca=NA&c13=asid,NA&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,v60Bsdk&sup=0&segment2=&segment1=&forward=1&ad=0&cr=V&c9=devid,&enc=true&c1=nuid,jvsueyoor7dpfzvcnofwp2opkusap1651037787&at=view&rt=text&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,16510377872438001&c30=bldv,6.0.0.618&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&devtypid=&pc=NA&si=http%3A%2F%2Fwww.heromachine.com%2Fforums%2Fusers%2Fbiden-approval-rating-drops-further%2F&c73=phtype,&c74=dvcnm,&uoo=&c62=sendTime,1651037790&rnd=825531
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.117.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-80-117-76.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.heromachine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 27 Apr 2022 05:36:30 GMT
server
nginx
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Verdicts & Comments Add Verdict or Comment

224 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 function| structuredClone object| oncontextlost object| oncontextrestored object| _gaq string| mi_version boolean| mi_track_user string| mi_no_track_reason object| disableStrs function| __gtagTrackerIsOptedOut undefined| index function| __gtagTrackerOptout function| gaOptout function| __gtagDataLayer function| __gtagTracker object| dataLayer object| MonsterInsightsDualTracker function| gtag function| __gaTracker object| _wpemojiSettings number| PIN_19109 object| $jscomp function| $jscomp$lookupPolyfilledValue object| __stitialW function| __NSGPTB object| pbjs function| __NSGPTDummyCMP object| NSGPT object| stitial function| pbjsChunk object| __core-js_shared__ object| diagPixSentCodes object| __iasPET object| __iasAdRefreshConfig object| Adomik string| google_page_url object| googletag function| jsEncode function| quote function| inlinereply function| addQuote undefined| $ function| jQuery function| MonsterInsights object| MonsterInsightsObject object| monsterinsights_frontend object| jQuery112407667505124317524 function| jQueryBridget function| EvEmitter function| matchesSelector object| fizzyUIUtils function| InfiniteScroll function| imagesLoaded object| rlArgs object| gdbxRender_Data object| adsbygoogle function| ga object| _comscore boolean| __NSGPTBp object| PIN_1651037785901 object| value object| PinUtils function| udm_ object| ns_p object| COMSCORE object| _gat object| gaGlobal object| wpcf7 object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue function| google_process_slots boolean| google_apltlad function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map object| google_tag_manager object| zd function| lr_Envelope object| ats object| google_tag_data string| GoogleAnalyticsObject object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| wpcf7_recaptcha object| Gravatar object| GProfile number| hexcase string| b64pad number| chrsz function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| md5_vm_test function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 object| WPGroHo object| gaplugins function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages function| __cmp function| NolTracker function| nol_t function| logger undefined| _rsCC undefined| _rsCG undefined| _rsDN undefined| v52v53_pvar undefined| v52v53_trac undefined| _rsEvent undefined| _rsLinkTrack undefined| _rsClick object| recaptcha string| __ZD_CPID_ object| __ZD_USEG_ object| __ZD_SEG_ boolean| S2MEMBER_CURRENT_USER_IS_LOGGED_IN boolean| S2MEMBER_CURRENT_USER_IS_LOGGED_IN_AS_MEMBER string| S2MEMBER_CURRENT_USER_FIRST_NAME string| S2MEMBER_CURRENT_USER_LAST_NAME string| S2MEMBER_CURRENT_USER_LOGIN string| S2MEMBER_CURRENT_USER_EMAIL number| S2MEMBER_CURRENT_USER_DOWNLOADS_ALLOWED boolean| S2MEMBER_CURRENT_USER_DOWNLOADS_ALLOWED_IS_UNLIMITED number| S2MEMBER_CURRENT_USER_DOWNLOADS_CURRENTLY number| S2MEMBER_CURRENT_USER_DOWNLOADS_ALLOWED_DAYS object| aec_frontend object| EXPORTED_SYMBOLS function| AtDCore function| TokenIterator object| AtD object| CSSHttpRequest object| wp boolean| ws_plugin__s2member_skip_all_file_confirmations function| ws_plugin__s2member_passwordMinLength function| ws_plugin__s2member_passwordMinStrengthCode function| ws_plugin__s2member_passwordMinStrengthLabel function| ws_plugin__s2member_passwordMinStrengthScore function| ws_plugin__s2member_passwordStrengthMeter function| ws_plugin__s2member_passwordStrength function| ws_plugin__s2member_validationErrors function| ws_plugin__s2member_animateProcessing function| ws_plugin__s2member_escHtml function| ws_plugin__s2member_escAttr function| ws_plugin__s2member_escjQAttr function| $j function| rl_view_image function| rl_hide_image string| hash string| new_css object| closure_lm_50230 object| twemoji object| pvar object| V60 object| NOLBUNDLE string| localstorageframe object| ciDdrs string| key function| _typeof object| ns object| paramsPassed object| stateObject object| errorState string| BUILDVERSION object| stateEvents object| zdcoreSignalBuffer object| zdcoreGurgleCallbacks function| Krux object| tags object| BKTAG function| bk_addUserCtx function| bk_addPageCtx function| bk_addEmailHash function| bk_addPhoneHash function| bk_doJSTag function| bk_doJSTag2 function| bk_doCarsJSTag function| bk_doPartnerAltTag function| bk_doCallbackTag function| bk_doCallbackTagWithTimeOut object| GoogleGcLKhOms object| google_image_requests

15 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09ACztih7wnKGFd0oXfq8srnXiLLVpe2ABHeQZZCr1iaPAyHfJEFAyuzV7XGcdP0NnAwPOAHuX57-KuVSlUoeyEDA
www.heromachine.com/ Name: gdbbx_session_activity
Value: 0
www.heromachine.com/ Name: PHPSESSID
Value: uujl04kk2slsf3bt91cekki888
www.heromachine.com/ Name: geoCC
Value: DE
.heromachine.com/ Name: __utma
Value: 177811772.710865485.1651037786.1651037786.1651037786.1
.heromachine.com/ Name: __utmc
Value: 177811772
.heromachine.com/ Name: __utmz
Value: 177811772.1651037786.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.heromachine.com/ Name: __utmt
Value: 1
.heromachine.com/ Name: __utmb
Value: 177811772.1.10.1651037786
.scorecardresearch.com/ Name: UID
Value: 17Cc69ab539e5311f2e66111651037786
www.heromachine.com/ Name: gdbbx_tracking_activity
Value: 1651037786
.doubleclick.net/ Name: IDE
Value: AHWqTUleHHXDacZGH2flFoF4RxUDfLa2tcYjS_o1U5Vj6si7Uf18p1NUaD8ymlMrxg0
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.imrworldwide.com/ Name: IMRID
Value: fb95aec0-c5eb-11ec-9ea1-dfb3ba83fd7c
.heromachine.com/ Name: __gads
Value: ID=00e45887a84bcb4d:T=1651037786:S=ALNI_MZ2JpyLlNwNA-hMzYSxIMy_jwc0GA

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13892b799720f42beca56691076df1c4.safeframe.googlesyndication.com
2.gravatar.com
ads.eu.criteo.com
adservice.google.com
adservice.google.de
assets.pinterest.com
b.scorecardresearch.com
bee.imrworldwide.com
cat.nl.eu.criteo.com
cdn-gl.imrworldwide.com
cdn.krxd.net
cdn.nsstatic.net
cdn.static.zdbb.net
csm.eu.criteo.net
fonts.gstatic.com
g.pcmag.com
googleads.g.doubleclick.net
gurgle.zdbb.net
jogger.zdbb.net
log.pinterest.com
netdna.bootstrapcdn.com
ns.zdbb.net
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.adsafeprotected.com
rtb.fr.eu.criteo.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.gravatar.com
securepubads.g.doubleclick.net
stags.bluekai.com
static.criteo.net
tags.bkrtx.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.heromachine.com
zdbb.net
zhfvrubtkqqjxslwgemo9cyozbwoo1651037787.nuid.imrworldwide.com
104.89.33.102
104.90.192.27
13.225.80.21
13.225.80.38
13.32.121.37
142.250.185.130
142.250.186.34
151.101.0.84
151.101.66.133
178.250.2.148
178.250.2.150
208.100.58.40
23.36.163.232
23.36.163.245
2600:9000:21f3:3a00:1d:667e:2a40:93a1
2600:9000:21f3:9800:2:42d9:3100:93a1
2606:4700::6812:bcf
2a00:1450:4001:801::2002
2a00:1450:4001:810::2002
2a00:1450:4001:812::2003
2a00:1450:4001:812::200e
2a00:1450:4001:813::2001
2a00:1450:4001:827::2003
2a00:1450:4001:829::2008
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:4001:831::2004
2a02:2638:1::4
2a02:2638::2
2a02:2638::3
2a02:26f0:ef::5f65:4d33
2a04:4e42:4b::84
2a04:fa87:fffe::c000:4902
3.248.54.145
34.194.37.39
52.54.164.181
63.34.98.248
99.80.117.76
0210bcf8c6f9fb41e1db722e8ec3c318101342f5922c59331321c993df1720d1
03ddfd0df287bc18b8a7782a61457610b2bcdfdbbc4656e9657c5da106e72d38
06e5061665609f258ffb869944f46380a7d169f1244495c63ad1d288f265b0ad
07e4203b9f313b587b1d53f896e63771ec85f9b0d4c2ac5fa64089457784d847
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0fe8d6536fec91280e859d0ef7367d60ca8deff3ee5258a893993c2a23aa7d69
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
125ec330f66081e7dc9f2814e9ec18f4e2d0baa1936d497375eedfda7ac12e5c
1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2059bfd3d47fc29d4d383177e5728ad209413416679e93a3a4f56a9a680f991a
20b97f4764680efdd44b021cb57bfb2b93850d0aaf8af024986393b0cb80f2d0
20f0315c97ff7007f2e7a94d659e094a7efc01b8306da53987538c1101489e0e
215f93877f2bc41566b4f42cf1f690294c39257d9fdb0ee05d7401459c706da2
24def41a5286b761e56aeb283ea22fc2f9a31c3a140d74ac3840515245f5689b
2760f22cbb9f2be24c10ef518346bc0b9ba7a7d357635c1578e1e3f52690a668
27cb2db9bca695c28c5688b5942cfb1d25fdf024eaf2fac1e449bd910d4063bc
2c4e80d639308731c8bde682d8f59d5e569fbb810a1b1468c62625dbbdea2631
3502ed38d3be1c4cb6eb0fa376cc0941389b647b51179eb4f54cf4470670f00c
3dc119694e1216e1749dbb003335c802449eaf4afd47d1b16606ad00ecacee88
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e264ce8d7843d9a72cdd470a66c47e8b86bf9ba060d6e6cb6b0b0ac848f561b
3e414400ff2bb19c0d21cb51da8fb1ecbbba1fda12d841fdb70e5c3bd8557b56
3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de
41bc4d4fe88139d6ee89abfcb2abac71e1430d85dbffc0be7c8f6bd36f4ced7e
42e3875bbcbb773f1fa0928b6ebc2a75165e7b260166497a3bfe3ad2a66c5c9f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
47380069c0219b67b6f43c99d352c5acf3638ef654c70a4c7a16c30991824e62
48555977de52a497e0dd8fe5aaf9ebf2df20bf16340340f4012baaa8153e490b
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f30bdeed794aeb92d85e55d901c0bdb634df32432010792e3b569ea73cae443
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
59eea5789a6787902ce1ec6a71b34f32808d75f6a0be489cd4f5910d7bed804b
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5fb967d10f49ce514c908cc021755e29791fbf475d8653faf0940c9a25235c87
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
66073b3f60b0a2027d4ec6fa41f8662aae2610bec3905aed697f13da1b8e28e4
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6f97fb27fc5a2b0b2ef192937aeea30f869e026c98518e154a796755e3d0d864
714cf5037b1c26152ff83b6f11a8c345fc0035184128443abb8a712c4f223179
7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65
75481bc06d1b02e50fd1cc921a7838e3af6caa9b8c0745b50182ebf29f195e20
7772a9cc35fc902c0cccb8871670ec3e45e4695e1bc6941aee1c24db3de8c544
7fe1d053ce2ea30ac6f945a742bb757c89db0536e0b051e91df314e7e537e81e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8348fe66b515449f719cb7b8278e1c84009bdaa96e18981641bc1e77d9e4cf1a
859adbfc48bb0b06c58fe109db4909585fbca5df398d49185fc0f486bad1ac96
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422
99ecb14ec0a4e706ee386f1bde1a4684119fa8e100f24821f71f7fa75ccd481d
9f0f06f248aba9887a722a3e9f52d799bd14f50ff1e2e90de6e824e47b4d6ec3
9fecc6157919ffc41b052ae7e49726e205c75b847aef46daab8d75e29a48b95f
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4d47dd6793fe24c23ab3c34f630ce5d0f42ef12a9e19eabd2fba286296647e9
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a8729d2f646503894ef80b047ab4690d600796744b3f8300a7baa8350664a77e
ad94ea1bc50aaf3b69323cbcc73629348c0abf5796d15ed15238ac4e01b81680
aef711d1643073ab593de1d958ee854d6f63339cb216eda43666fb9dfcebffd0
b01ab209fbb92b0b7f9e3dc84c3fb7d615e19e78dc774194fcef9247108dc1c5
b09af8371ef89e585e232893cde65965b6350efab85ad0f475842c8b3d04ef4f
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b581028d6391255ecdf713359eaafeade21c9f2e70a8f6127483b2255a62c969
b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0
b8ddfe2786718750e37a2a7d2841e4e6a110a1877e21a03675d47c591d4a7f03
baa7346a51ac22b01b0f63ef8be8a7b0946a67fbe68ccf2c8a783a769bad8870
badbad062f2e942c3eab0d49366f65e2ff7e705a80deeac6a2bcdbcb824d6bd8
bdc0c59701784258f143dfd4201f28353f080e0900a3530a83702e08c9ff353f
c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1
c3de7124ddd330ae2c46d3cc38c65e3c99da044c12a1aba9ed231190fa7f153d
c46642e7bfe3ef8e774edf6b15d3ff962e9affcd61972eea571c4cfd9220905e
c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc
c82fd92fd9c32352b380c884289011e4ea3580e2fc177ff294445318e94e0394
c88cbe284d1606e1b1792d4667db7f337d2426c65b27a1e97ec77eed0080c15e
cbcbcd7ece03838e0d61df03ee49190ff6af74f11b8f22c2b6f1a1e0f4560c9e
ccd911729403decd6e3b74702fdc4d2c1b1e3ecf35a147f7e5373669932cc708
cdb0a643b3677148228615a289cedf8ef67c5dd052c4dd40ed9cda7cbebd2c6d
cf929e11b42b085a4f5d5385314f7b7104d2e260a10691955ab6eed27f5c241f
d121b7dadeed0929280551f66eb34b2debe9891bf0b4c2b461829a2756d6d627
d6a02948be8e5e63277fd8aa74f7796824a553f94d4ddd2da72649b2db4d8d0c
df92bde186580a41df772f82ec6f18fd310f31f0eb410ef54b15c8fc96064df6
dfe88090c5ed7ac2f32571f0fc822fda4d8cd281fc7138c7cd6db656f6e2d081
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e49dd69e982be2567da47515b224f8df28a3b40255c9bdac2fb367b6b46e9f8b
e6288aaed3cc058d83e75942dce7079c4158e1a3310c507922c8e2e53faf71d7
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
eb956c4d7ba7839b892642dd0f23cbc8ca3d0f558d270105a63a6ca11641a59f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
f455d7418fb903d2a050af703a227f3c83fc7588cd721237b9519d9b207ae169
f575802496a5c764a63672d6a79e56a40dedf33f68aaedcfe4ae015c97162136
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
f7156b45752a71503d0c62be49c8108aa203626ae44dd1c8addd658881f848f8
fbf8ab57db7f9981bd71d79c7daaa01a3c578ffa0aa8e9b4a9b2bfe2e9927427
fd6365e05e9f4dd0f0bbedbcce84a0c052396f0ab4d56513b4172961cd67313a
fe8b9ef253dacc8f236b585575d50d5de23401a0ed6002a7fa8ce17ef01e05b5
ff6d43dd81cbe9bc3ba370bb9942e6c61792184a730707ca0ac512554c0e8e41
ffe780d5ad2bceb03604357aa85727c5808151170a8f49bfc02619c58a20735c