urlscan.io logo urlscan.io
SecurityTrails logo

credit.duvetsrc.com Open in urlscan Pro
67.225.161.113  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.credit.duvetsrc.com/
Effective URL: https://credit.duvetsrc.com/
Submission: On October 01 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 24 IPs in 6 countries across 34 domains to perform 94 HTTP transactions. The main IP is 67.225.161.113, located in United States and belongs to LIQUIDWEB, US. The main domain is credit.duvetsrc.com.
TLS certificate: Issued by R3 on August 10th 2021. Valid for: 3 months.
This is the only time credit.duvetsrc.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 28 67.225.161.113 32244 (LIQUIDWEB)
2 2a00:1450:400... 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
25 172.66.41.9 13335 (CLOUDFLAR...)
1 2a04:4e42::485 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 216.58.212.162 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 67.202.105.31 32748 (STEADFAST)
2 8 23.218.208.246 16625 (AKAMAI-AS)
1 51.38.120.206 16276 (OVH)
4 4 185.64.189.216 62713 (AS-PUBMATIC)
3 3 142.250.185.194 15169 (GOOGLE)
1 1 185.64.189.110 62713 (AS-PUBMATIC)
2 2 185.64.189.114 62713 (AS-PUBMATIC)
4 4 37.252.173.22 29990 (ASN-APPNEX)
2 2 35.244.159.8 15169 (GOOGLE)
3 3 18.156.0.31 16509 (AMAZON-02)
3 3 213.19.147.44 3356 (LEVEL3)
2 3 13.248.242.197 16509 (AMAZON-02)
1 1 64.202.112.191 23352 (SERVERCEN...)
1 178.162.133.149 60781 (LEASEWEB-...)
1 34.243.225.216 16509 (AMAZON-02)
1 174.137.133.49 27257 (WEBAIR-IN...)
2 2 18.159.118.206 16509 (AMAZON-02)
1 38.27.122.126 174 (COGENT-174)
2 2 216.52.2.19 29791 (VOXEL-DOT...)
2 2 193.0.160.129 54312 (ROCKETFUEL)
1 208.100.17.175 32748 (STEADFAST)
1 2 209.54.176.128 16509 (AMAZON-02)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 1 52.19.99.3 16509 (AMAZON-02)
1 1 18.214.253.211 14618 (AMAZON-AES)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
94 24
28    67.225.161.113 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: storm2.duvetsrc.com
www.credit.duvetsrc.com
credit.duvetsrc.com
2    2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
9    2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
25    172.66.41.9 (United States)

ASN13335 (CLOUDFLARENET, US)
resources.infolinks.com
router.infolinks.com
rt3003.infolinks.com
1    2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
2    2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
5    2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    216.58.212.162 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f2.1e100.net
partner.googleadservices.com
1    2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
1    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
1    2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
2    67.202.105.31 (United States)

ASN32748 (STEADFAST, US)
PTR: ip31.67-202-105.static.steadfastdns.net
de.tynt.com
8    23.218.208.246 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-218-208-246.deploy.static.akamaitechnologies.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
1    51.38.120.206 (France)

ASN16276 (OVH, FR)
PTR: ip206.ip-51-38-120.eu
onetag-sys.com
4    185.64.189.216 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
3    142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net
cm.g.doubleclick.net
1    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
2    185.64.189.114 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
4    37.252.173.22 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
2    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
u.openx.net
3    18.156.0.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
3    213.19.147.44 (United Kingdom)

ASN3356 (LEVEL3, US)
sync.1rx.io
sync.targeting.unrulymedia.com
3    13.248.242.197 (United States)

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com
match.adsrvr.org
1    64.202.112.191 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
1    178.162.133.149 (Rotterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
1    34.243.225.216 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-243-225-216.eu-west-1.compute.amazonaws.com
s.cpx.to
1    174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)
dsp.adkernel.com
2    18.159.118.206 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-118-206.eu-central-1.compute.amazonaws.com
pixel.advertising.com
1    38.27.122.126 (Chestertown, United States)

ASN174 (COGENT-174, US)
match.bnmla.com
2    216.52.2.19 (United States)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
2    193.0.160.129 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
1    208.100.17.175 (United States)

ASN32748 (STEADFAST, US)
PTR: ip175.208-100-17.static.steadfastdns.net
ssc-cms.33across.com
2    209.54.176.128 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
1    2606:4700:20::681a:bd1 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
1    52.19.99.3 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-99-3.eu-west-1.compute.amazonaws.com
d.adroll.com
1    18.214.253.211 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-253-211.compute-1.amazonaws.com
nep.advangelists.com
2    2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
1    2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
Apex Domain
Subdomains		 Transfer
28 duvetsrc.com
www.credit.duvetsrc.com
credit.duvetsrc.com
1 MB
25 infolinks.com
resources.infolinks.com
router.infolinks.com
rt3003.infolinks.com
284 KB
11 googlesyndication.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
179 KB
8 casalemedia.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
9 KB
7 pubmatic.com
image8.pubmatic.com
image2.pubmatic.com
image4.pubmatic.com
2 KB
5 gstatic.com
fonts.gstatic.com
109 KB
5 doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
7 KB
4 adnxs.com
ib.adnxs.com
4 KB
3 adsrvr.org
match.adsrvr.org
1 KB
3 yahoo.com
ups.analytics.yahoo.com
3 KB
2 amazon-adsystem.com
s.amazon-adsystem.com
1 KB
2 rfihub.com
p.rfihub.com
1 KB
2 lijit.com
ap.lijit.com
1 KB
2 advertising.com
pixel.advertising.com
677 B
2 1rx.io
sync.1rx.io
1 KB
2 openx.net
u.openx.net
599 B
2 tynt.com
de.tynt.com
710 B
2 google.com
adservice.google.com
www.google.com
2 KB
2 googleapis.com
fonts.googleapis.com
2 KB
1 advangelists.com
nep.advangelists.com
233 B
1 adroll.com
d.adroll.com
112 B
1 ad4m.at
ad4m.at
1 33across.com
ssc-cms.33across.com
72 B
1 bnmla.com
match.bnmla.com
112 B
1 adkernel.com
dsp.adkernel.com
233 B
1 cpx.to
s.cpx.to
945 B
1 sonobi.com
sync.go.sonobi.com
478 B
1 zemanta.com
b1sync.zemanta.com
288 B
1 unrulymedia.com
sync.targeting.unrulymedia.com
475 B
1 onetag-sys.com
onetag-sys.com
823 B
1 googletagservices.com
www.googletagservices.com
28 KB
1 google.de
adservice.google.de
853 B
1 googleadservices.com
partner.googleadservices.com
656 B
1 jsdelivr.net
cdn.jsdelivr.net
13 KB
94 34
Domain Requested by
27 credit.duvetsrc.com credit.duvetsrc.com
cdn.jsdelivr.net
15 router.infolinks.com resources.infolinks.com
router.infolinks.com
ssum-sec.casalemedia.com
9 pagead2.googlesyndication.com credit.duvetsrc.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
5 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
5 rt3003.infolinks.com resources.infolinks.com
5 fonts.gstatic.com fonts.googleapis.com
5 resources.infolinks.com credit.duvetsrc.com
resources.infolinks.com
4 ib.adnxs.com 4 redirects
4 image8.pubmatic.com 4 redirects
3 match.adsrvr.org 2 redirects ssum-sec.casalemedia.com
3 ups.analytics.yahoo.com 3 redirects
3 cm.g.doubleclick.net 3 redirects
3 ssum-sec.casalemedia.com 1 redirects router.infolinks.com
ssum-sec.casalemedia.com
2 tpc.googlesyndication.com pagead2.googlesyndication.com
tpc.googlesyndication.com
2 s.amazon-adsystem.com 1 redirects ssum-sec.casalemedia.com
2 p.rfihub.com 2 redirects
2 ap.lijit.com 2 redirects
2 pixel.advertising.com 2 redirects
2 sync.1rx.io 2 redirects
2 u.openx.net 2 redirects
2 image4.pubmatic.com 2 redirects
2 de.tynt.com 1 redirects router.infolinks.com
2 googleads.g.doubleclick.net pagead2.googlesyndication.com
2 fonts.googleapis.com credit.duvetsrc.com
1 www.google.com tpc.googlesyndication.com
1 nep.advangelists.com 1 redirects
1 d.adroll.com 1 redirects
1 ad4m.at ssum-sec.casalemedia.com
1 ssc-cms.33across.com router.infolinks.com
1 match.bnmla.com router.infolinks.com
1 dsp.adkernel.com router.infolinks.com
1 s.cpx.to router.infolinks.com
1 sync.go.sonobi.com router.infolinks.com
1 b1sync.zemanta.com 1 redirects
1 sync.targeting.unrulymedia.com 1 redirects
1 image2.pubmatic.com 1 redirects
1 onetag-sys.com router.infolinks.com
1 www.googletagservices.com pagead2.googlesyndication.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 cdn.jsdelivr.net credit.duvetsrc.com
1 www.credit.duvetsrc.com 1 redirects
94 43

This site contains links to these domains. Also see Links.

Domain
mortgage.funituresited.com
afthemes.com
Subject Issuer Validity Valid
www.credit.duvetsrc.com
R3		 2021-08-10 -
2021-11-08		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-15 -
2022-07-14		 a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2020		 2021-04-30 -
2022-06-01		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.google.de
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
onetag-sys.com
R3		 2021-07-26 -
2021-10-24		 3 months crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2020-12-06 -
2022-01-07		 a year crt.sh
s.cpx.to
Sectigo RSA Domain Validation Secure Server CA		 2021-02-03 -
2022-02-09		 a year crt.sh
*.adkernel.com
Sectigo RSA Domain Validation Secure Server CA		 2020-12-22 -
2022-01-05		 a year crt.sh
*.bnmla.com
Go Daddy Secure Certificate Authority - G2		 2021-01-06 -
2022-02-07		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
s.amazon-adsystem.com
Amazon		 2021-07-14 -
2022-06-27		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh
www.google.com
GTS CA 1C3		 2021-09-13 -
2021-11-20		 2 months crt.sh

This page contains 9 frames:

Primary Page: https://credit.duvetsrc.com/
Frame ID: 63E8C9DA5806B01BF485829750C6C02C
Requests: 59 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210928/r20190131/zrt_lookup.html
Frame ID: FF48224FCBCE8260B017AFA7E9D10CCD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2975953302835633&output=html&adk=1812271804&adf=3025194257&lmt=1633093417&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&tp=site_kit&format=0x0&url=https%3A%2F%2Fcredit.duvetsrc.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633093417013&bpp=17&bdt=979&idt=127&shv=r20210928&mjsv=m202109240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1696917412699&frm=20&pv=2&ga_vid=835524595.1633093417&ga_sid=1633093417&ga_hid=932755639&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062579%2C42530892%2C182982100%2C182982300%2C44748552&oid=3&pvsid=1915440762118009&pem=577&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=1&uci=a!1&fsb=1&dtd=144
Frame ID: CFC2BD6FD74731E411B49B22F477A276
Requests: 1 HTTP requests in this frame

Frame: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Frame ID: 94EBFD0FFF1B4E07BACE7E4C4969445C
Requests: 17 HTTP requests in this frame

Frame: https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Frame ID: 6EE4431BD2DAE5E2510C63A4CBDBBD17
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Frame ID: 8A48444D022CF9400027C9A0C3C80B23
Requests: 10 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Frame ID: E7F1C694E1766079E9CA9891679655D4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 8ECEC4545E399E814E0CFAB6F818732A
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A5582A7BB0437AB749D15D8B1C1F1E0F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Credit News Network - Credit News Network

Page URL History Show full URLs

  1. https://www.credit.duvetsrc.com/ HTTP 301
    https://credit.duvetsrc.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
  • wp-embed\.min\.js\?ver=([\d.]+)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/slick(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

94
Requests

100 %
HTTPS

29 %
IPv6

34
Domains

43
Subdomains

24
IPs

6
Countries

1825 kB
Transfer

2782 kB
Size

44
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.credit.duvetsrc.com/ HTTP 301
    https://credit.duvetsrc.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49
  • https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV HTTP 307
  • https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Request Chain 50
  • https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Request Chain 52
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MEQwMTFBNDEtQUMxQy00MDI3LUJFQkMtMjIyN0NDREZFMkQx&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D0D011A41-AC1C-4027-BEBC-2227CCDFE2D1 HTTP 302
  • https://router.infolinks.com/dyn/pbm-usync?uid=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
Request Chain 53
  • https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID HTTP 302
  • https://router.infolinks.com/dyn/apn-usync?user_id=9097066428773806962
Request Chain 54
  • https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D HTTP 302
  • https://u.openx.net/w/1.0/cm?cc=1&id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D HTTP 302
  • https://router.infolinks.com/dyn/ox-usync?uid=8c341ee6-95d5-4bf4-a6c3-3a5b5f22d367
Request Chain 55
  • https://ups.analytics.yahoo.com/ups/58422/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58422/occ?verify=true HTTP 302
  • https://router.infolinks.com/dyn/VR-usync?uid=y-52xQSWhE2uEb5dCW5Kv.C1AFhUVWOfFMKD0zAxk-~A
Request Chain 56
  • https://sync.1rx.io/usersync2/infolinks HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8379950509 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8379950509 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/848b0a32-d5cb-4f4a-bd21-1968d22628dd HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fr1-usync%3Fuid%3DRX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003 HTTP 302
  • https://router.infolinks.com/dyn/r1-usync?uid=RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003
Request Chain 57
  • https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__ HTTP 302
  • https://router.infolinks.com/dyn/zmn-usync?uid=
Request Chain 59
  • https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fcredit.duvetsrc.com%252F&pid=12306&adnxs_uid=$UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttps%25253A%25252F%25252Fcredit.duvetsrc.com%25252F%26pid%3D12306%26adnxs_uid%3D%24UID HTTP 302
  • https://s.cpx.to/ca.png?ref=https%3A%2F%2Fcredit.duvetsrc.com%2F&pid=12306&adnxs_uid=9097066428773806962
Request Chain 61
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPfdcbe381-22b7-11ec-b5b8-06584a1aed54 HTTP 302
  • https://router.infolinks.com/dyn/outh-usync?uid=y-0SV0YYZE2uF4kD34izWeInlyr1BIFK0Y~A~UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
Request Chain 63
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true HTTP 307
  • https://router.infolinks.com/dyn/sovrn-usync?uid=ab1d157d4e17fcd109b644ca
Request Chain 64
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fusersync%253Fpmuservalue%253D%2523PMUID HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=60809&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fusersync%3Fpmuservalue%3D0D011A41-AC1C-4027-BEBC-2227CCDFE2D1 HTTP 302
  • https://router.infolinks.com/dyn/usersync?pmuservalue=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
Request Chain 66
  • https://p.rfihub.com/cm?pub=43153&in=1 HTTP 302
  • https://router.infolinks.com/dyn/zeta-usync?uid=1870471598397078066
Request Chain 69
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB&dcc=t
Request Chain 70
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YVcHKaY6CKnhAkelz3Mn5QAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESED9t59FwFJvNCJV1JFMPKNE&google_cver=1&gdpr=1
Request Chain 72
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEF9VuWXrqU9OzPktNT004Pg&google_cver=1
Request Chain 74
  • https://p.rfihub.com/cm?in=1&pub=2079&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1871878973395767241
Request Chain 75
  • https://d.adroll.com/cm/index/ssp?gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Request Chain 76
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-ca85598a-7341-4a48-af8e-b1de364b441b

94 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
credit.duvetsrc.com/
Redirect Chain
  • https://www.credit.duvetsrc.com/
  • https://credit.duvetsrc.com/
121 KB
122 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
953bf37ba1ece541eade29ea097cacc1e7e733d5835d681c9e41fc09ee068be3

Request headers

:method
GET
:authority
credit.duvetsrc.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Fri, 01 Oct 2021 13:03:35 GMT
server
Apache
link
<https://credit.duvetsrc.com/wp-json/>; rel="https://api.w.org/"
cache-control
max-age=600
expires
Fri, 01 Oct 2021 13:13:35 GMT
content-type
text/html; charset=UTF-8

Redirect headers

date
Fri, 01 Oct 2021 13:03:35 GMT
server
Apache
x-redirect-by
WordPress
location
https://credit.duvetsrc.com/
cache-control
max-age=600
expires
Fri, 01 Oct 2021 13:13:35 GMT
content-length
0
content-type
text/html; charset=UTF-8
style.min.css
credit.duvetsrc.com/wp-includes/css/dist/block-library/ 		79 KB
79 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

:path
/wp-includes/css/dist/block-library/style.min.css?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Mon, 13 Sep 2021 16:37:55 GMT
server
Apache
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
80574
expires
Sun, 31 Oct 2021 13:03:36 GMT
css
fonts.googleapis.com/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Oswald:300,400,700
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
cd109685aad091ac9e233f99deedc4ff3aa2302a7d7d8a7064d6a14d1f87db77
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 01 Oct 2021 11:20:35 GMT
server
ESF
date
Fri, 01 Oct 2021 13:03:36 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Fri, 01 Oct 2021 13:03:36 GMT
bootstrap.min.css
credit.duvetsrc.com/wp-content/themes/covernews/assets/bootstrap/css/ 		118 KB
119 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/bootstrap/css/bootstrap.min.css?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
ebf968e400976b579ea9dcff5f0bc247a2b2371f9ce49c3b5829da4b7179f4f9

Request headers

:path
/wp-content/themes/covernews/assets/bootstrap/css/bootstrap.min.css?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
121224
expires
Sun, 31 Oct 2021 13:03:36 GMT
style.css
credit.duvetsrc.com/wp-content/themes/covernews/ 		172 KB
173 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/style.css?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
00212879f20605920244d4f6db3433eeceb5a8290d4503c776a28c04c0982fdd

Request headers

:path
/wp-content/themes/covernews/style.css?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
175941
expires
Sun, 31 Oct 2021 13:03:36 GMT
style.css
credit.duvetsrc.com/wp-content/themes/hardnews/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/hardnews/style.css?ver=1.1.0
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
8921fc1d5c033cc206990cb0fbf63e2c3b813929ee04e841fe13d0b80417f1a3

Request headers

:path
/wp-content/themes/hardnews/style.css?ver=1.1.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Wed, 15 Sep 2021 15:49:28 GMT
server
Apache
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
5346
expires
Sun, 31 Oct 2021 13:03:36 GMT
fontawesome-all.min.css
credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/ 		35 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
4080b83d8afc4487b8229308be2f196372bd2123613b46388048f14159f07181

Request headers

:path
/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
35359
expires
Sun, 31 Oct 2021 13:03:36 GMT
slick.css
credit.duvetsrc.com/wp-content/themes/covernews/assets/slick/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/slick/css/slick.css?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5

Request headers

:path
/wp-content/themes/covernews/assets/slick/css/slick.css?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1776
expires
Sun, 31 Oct 2021 13:03:36 GMT
css
fonts.googleapis.com/ 		12 KB
1020 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,400i,700,700i|Lato:400,300,400italic,900,700&subset=latin,latin-ext
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3663c660ba4a97493c560be909411c02135cbdde88906d2af88e70d825703d97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 01 Oct 2021 12:04:49 GMT
server
ESF
date
Fri, 01 Oct 2021 13:03:36 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires
Fri, 01 Oct 2021 13:03:36 GMT
jquery.min.js
credit.duvetsrc.com/wp-includes/js/jquery/ 		87 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

:path
/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Mon, 13 Sep 2021 16:37:55 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
89521
expires
Sun, 31 Oct 2021 13:03:36 GMT
jquery-migrate.min.js
credit.duvetsrc.com/wp-includes/js/jquery/ 		11 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

:path
/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
last-modified
Mon, 13 Sep 2021 16:37:55 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
11224
expires
Sun, 31 Oct 2021 13:03:36 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		141 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2975953302835633
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fa3f1ae4ed26ed6ccb2f100292b9534770c28cebb5d69af748e6d316e4a26908
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://credit.duvetsrc.com/
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50337
x-xss-protection
0
server
cafe
etag
17425492956741555041
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 01 Oct 2021 13:03:36 GMT
cropped-news-header-credit-1.png
credit.duvetsrc.com/wp-content/uploads/2020/04/ 		67 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://credit.duvetsrc.com/wp-content/uploads/2020/04/cropped-news-header-credit-1.png
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
8ebedb88998d4ef19bb0bbc1bc57c3492b405e9800ced755a90460baa8016e06

Request headers

:path
/wp-content/uploads/2020/04/cropped-news-header-credit-1.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Fri, 10 Apr 2020 19:37:57 GMT
server
Apache
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
68246
expires
Sun, 31 Oct 2021 13:03:37 GMT
wp-emoji-release.min.js
credit.duvetsrc.com/wp-includes/js/ 		18 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

:path
/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
pragma
no-cache
cookie
logglytrackingsession=723df0d8-6edb-4f2e-8774-808a76a092cb
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Mon, 13 Sep 2021 16:37:55 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
18181
expires
Sun, 31 Oct 2021 13:03:37 GMT
credit-costs-soar-despite-rock-bottom-base-rate-the-times-150x150.jpg
credit.duvetsrc.com/wp-content/uploads/2020/05/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://credit.duvetsrc.com/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-150x150.jpg
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
27ac4ae0b8cfa0b79ad181287f05c6df6e6f8c519bb62de083acfd685c727a1f

Request headers

:path
/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-150x150.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Sun, 10 May 2020 14:00:29 GMT
server
Apache
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
8096
expires
Sun, 31 Oct 2021 13:03:37 GMT
infolinks_main.js
resources.infolinks.com/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/infolinks_main.js
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3be0a5a4f4980d0f231ca381f2ff37a91b9adcb061efe6d814cdb1c5a4f7f724

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray
6975e4604c474001-CDG
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Fri, 01 Oct 2021 09:28:11 GMT
server
cloudflare
age
12924
etag
W/"d75-5cd472e8f79e3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=3600
content-encoding
gzip
expires
Fri, 01 Oct 2021 10:28:13 GMT
navigation.js
credit.duvetsrc.com/wp-content/themes/covernews/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/js/navigation.js?ver=20151215
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
fbc199bf7f97061c41664b040e84616a0cb54441a2efc5801d5d401d3a049f3c

Request headers

:path
/wp-content/themes/covernews/js/navigation.js?ver=20151215
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2967
expires
Sun, 31 Oct 2021 13:03:37 GMT
skip-link-focus-fix.js
credit.duvetsrc.com/wp-content/themes/covernews/js/ 		685 B
717 B 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/js/skip-link-focus-fix.js?ver=20151215
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
14af47320898bd93f367026f7833c9956f14e24856976e4f9e10be31155cdcf2

Request headers

:path
/wp-content/themes/covernews/js/skip-link-focus-fix.js?ver=20151215
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
685
expires
Sun, 31 Oct 2021 13:03:37 GMT
slick.min.js
credit.duvetsrc.com/wp-content/themes/covernews/assets/slick/js/ 		52 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/slick/js/slick.min.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
032699f5abc60e8e1b3c28bfa7a9a046addb1777420acb4c599871b5d64f0888

Request headers

:path
/wp-content/themes/covernews/assets/slick/js/slick.min.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
53179
expires
Sun, 31 Oct 2021 13:03:37 GMT
bootstrap.min.js
credit.duvetsrc.com/wp-content/themes/covernews/assets/bootstrap/js/ 		57 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/bootstrap/js/bootstrap.min.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
7209e11a45cef119e8d3539afb2689835d17b16a0a22f8334d867cf77a220d2a

Request headers

:path
/wp-content/themes/covernews/assets/bootstrap/js/bootstrap.min.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
58031
expires
Sun, 31 Oct 2021 13:03:37 GMT
jquery.matchHeight.min.js
credit.duvetsrc.com/wp-content/themes/covernews/assets/jquery-match-height/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/jquery-match-height/jquery.matchHeight.min.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7

Request headers

:path
/wp-content/themes/covernews/assets/jquery-match-height/jquery.matchHeight.min.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3380
expires
Sun, 31 Oct 2021 13:03:37 GMT
jquery.marquee.js
credit.duvetsrc.com/wp-content/themes/covernews/assets/marquee/ 		22 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/marquee/jquery.marquee.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
02decb76d37d026d332be0228facdbdf013a429f404a9283bf37fcc3cda99cbd

Request headers

:path
/wp-content/themes/covernews/assets/marquee/jquery.marquee.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
22865
expires
Sun, 31 Oct 2021 13:03:37 GMT
script.js
credit.duvetsrc.com/wp-content/themes/covernews/assets/ 		16 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/script.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
126efd547bdd0ee931514152089da92b546103f4f21a33e5bddb55f004931511

Request headers

:path
/wp-content/themes/covernews/assets/script.js?ver=5.8.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
16378
expires
Sun, 31 Oct 2021 13:03:37 GMT
fixed-header-script.js
credit.duvetsrc.com/wp-content/themes/covernews/assets/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/fixed-header-script.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
98fbdd524b447115aadfe74af66f5a7d75faa1cefd318f3854acdff3d4f2e25b

Request headers

:path
/wp-content/themes/covernews/assets/fixed-header-script.js?ver=5.8.1
pragma
no-cache
cookie
logglytrackingsession=723df0d8-6edb-4f2e-8774-808a76a092cb
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1689
expires
Sun, 31 Oct 2021 13:03:37 GMT
wp-slimstat.min.js
cdn.jsdelivr.net/wp/wp-slimstat/tags/4.8.8.1/ 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/wp/wp-slimstat/tags/4.8.8.1/wp-slimstat.min.js
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d9a556c830024a4105d859c0a1824c5ecfcb2741e3602ed04fa2789f15576a33
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
1892202
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
content-length
12971
etag
W/"9528-ibunHRgV3PlNaAz6vnmPhMZzQGk"
x-served-by
cache-fra19176-FRA, cache-mxp6921-MXP
date
Fri, 01 Oct 2021 13:03:37 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
wp-embed.min.js
credit.duvetsrc.com/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-includes/js/wp-embed.min.js?ver=5.8.1
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path
/wp-includes/js/wp-embed.min.js?ver=5.8.1
pragma
no-cache
cookie
logglytrackingsession=723df0d8-6edb-4f2e-8774-808a76a092cb
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Thu, 15 Apr 2021 05:40:04 GMT
server
Apache
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1426
expires
Sun, 31 Oct 2021 13:03:37 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/ 		255 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2975953302835633
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
edba456dcd0b465ed088a43286de54023b36de71e3659a9ce7435b50ba1cb054
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
96644
x-xss-protection
0
server
cafe
etag
17695994262533134128
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Fri, 01 Oct 2021 13:03:37 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210928/r20190131/ Frame FF48 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20210928/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2975953302835633
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20210928/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://credit.duvetsrc.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 30 Sep 2021 23:27:01 GMT
expires
Thu, 14 Oct 2021 23:27:01 GMT
content-type
text/html; charset=UTF-8
etag
297313706323796346
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4617
x-xss-protection
0
age
48996
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,400i,700,700i|Lato:400,300,400italic,900,700&subset=latin,latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 26 Sep 2021 06:39:46 GMT
x-content-type-options
nosniff
age
455031
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23484
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:19:01 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Sep 2022 06:39:46 GMT
TK3iWkUHHAIjg752GT8G.woff2
fonts.gstatic.com/s/oswald/v40/ 		31 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/oswald/v40/TK3iWkUHHAIjg752GT8G.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald:300,400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d287da709652059aee8af366398fb5597fa3bf2e9cbe53b7c8ffe3da44f19ff8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 26 Sep 2021 17:32:54 GMT
x-content-type-options
nosniff
age
415843
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31624
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:16:38 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Sep 2022 17:32:54 GMT
fa-solid-900.woff2
credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/webfonts/ 		39 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/webfonts/fa-solid-900.woff2
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3

Request headers

:path
/wp-content/themes/covernews/assets/font-awesome-v5/webfonts/fa-solid-900.woff2
pragma
no-cache
origin
https://credit.duvetsrc.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
font/woff2
cache-control
max-age=172800
accept-ranges
bytes
content-length
40148
expires
Sun, 03 Oct 2021 13:03:37 GMT
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ 		22 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,400i,700,700i|Lato:400,300,400italic,900,700&subset=latin,latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 04:13:08 GMT
x-content-type-options
nosniff
age
291029
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22992
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:18:57 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 28 Sep 2022 04:13:08 GMT
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,400i,700,700i|Lato:400,300,400italic,900,700&subset=latin,latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 03:52:06 GMT
x-content-type-options
nosniff
age
292291
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15764
x-xss-protection
0
last-modified
Tue, 15 Sep 2020 18:10:17 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 28 Sep 2022 03:52:06 GMT
fa-regular-400.woff2
credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/webfonts/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/webfonts/fa-regular-400.woff2
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
4d2883443b24e424527f6a0a7aa2897b3df71f239db40373c4ff760e48147801

Request headers

:path
/wp-content/themes/covernews/assets/font-awesome-v5/webfonts/fa-regular-400.woff2
pragma
no-cache
origin
https://credit.duvetsrc.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://credit.duvetsrc.com/wp-content/themes/covernews/assets/font-awesome-v5/css/fontawesome-all.min.css?ver=5.8.1
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Wed, 15 Sep 2021 15:49:32 GMT
server
Apache
content-type
font/woff2
cache-control
max-age=172800
accept-ranges
bytes
content-length
12240
expires
Sun, 03 Oct 2021 13:03:37 GMT
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,400i,700,700i|Lato:400,300,400italic,900,700&subset=latin,latin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://credit.duvetsrc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 27 Sep 2021 17:27:37 GMT
x-content-type-options
nosniff
age
329760
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16112
x-xss-protection
0
last-modified
Tue, 15 Sep 2020 18:10:09 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 27 Sep 2022 17:27:37 GMT
credit-costs-soar-despite-rock-bottom-base-rate-the-times-936x897.jpg
credit.duvetsrc.com/wp-content/uploads/2020/05/ 		180 KB
181 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://credit.duvetsrc.com/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-936x897.jpg
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
5de682611970bff82cae30195c595d1e4c4351c930522135a479667e7f251ff1

Request headers

:path
/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-936x897.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Sun, 10 May 2020 14:00:31 GMT
server
Apache
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
183940
expires
Sun, 31 Oct 2021 13:03:37 GMT
credit-costs-soar-despite-rock-bottom-base-rate-the-times-300x169.jpg
credit.duvetsrc.com/wp-content/uploads/2020/05/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://credit.duvetsrc.com/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-300x169.jpg
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
a8c411b5b92d763e3cc49d348b2321ba9b6c8134e6f29fe0eac89e18fe680b53

Request headers

:path
/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-300x169.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Sun, 10 May 2020 14:00:29 GMT
server
Apache
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
13884
expires
Sun, 31 Oct 2021 13:03:37 GMT
credit-costs-soar-despite-rock-bottom-base-rate-the-times-720x380.jpg
credit.duvetsrc.com/wp-content/uploads/2020/05/ 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://credit.duvetsrc.com/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-720x380.jpg
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
030f19957296dc542ce439d8fe48c3308852bcc7219cbc151c4276b454990c25

Request headers

:path
/wp-content/uploads/2020/05/credit-costs-soar-despite-rock-bottom-base-rate-the-times-720x380.jpg
pragma
no-cache
cookie
logglytrackingsession=723df0d8-6edb-4f2e-8774-808a76a092cb; __gads=ID=ef85356fb3d1a711-22c4e90c66c9009d:T=1633093417:RT=1633093417:S=ALNI_Ma0mm0cuAUIyVGbWNIK9N2hy816iQ
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
last-modified
Sun, 10 May 2020 14:00:31 GMT
server
Apache
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
61309
expires
Sun, 31 Oct 2021 13:03:37 GMT
ice.js
resources.infolinks.com/js/1757.010-3.025/ 		584 KB
187 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/1757.010-3.025/ice.js
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc8562872dc541ccfe9ab57d0d85581b33b22924c126651f11d1dc3456ad7961

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray
6975e460bd0e4001-CDG
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Sat, 11 Sep 2021 18:19:48 GMT
server
cloudflare
age
8759
etag
W/"91e1d-5cbbc46f1d11c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
expires
Sun, 31 Oct 2021 10:37:38 GMT
cookie.js
partner.googleadservices.com/gampad/ 		202 B
656 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=credit.duvetsrc.com&callback=_gfp_s_&client=ca-pub-2975953302835633
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
0b70862730ee79a79a9fdef3ed2947b9677bfbb363822a53874d3c6fb6a1e580
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
191
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fcredit.duvetsrc.com%2F&tn=DIV&id=loader-wrapper&ign=false&pw=1600&ph=1200&x=0&y=1060.8
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ 		0
121 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fcredit.duvetsrc.com%2F&tn=DIV&id=loader-wrapper&ign=false&pw=1600&ph=1200&x=0&y=0
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
integrator.js
adservice.google.de/adsid/ 		107 B
853 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=credit.duvetsrc.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 01 Oct 2021 13:03:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
570 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=credit.duvetsrc.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 01 Oct 2021 13:03:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame CFC2 		603 B
221 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2975953302835633&output=html&adk=1812271804&adf=3025194257&lmt=1633093417&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&tp=site_kit&format=0x0&url=https%3A%2F%2Fcredit.duvetsrc.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633093417013&bpp=17&bdt=979&idt=127&shv=r20210928&mjsv=m202109240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1696917412699&frm=20&pv=2&ga_vid=835524595.1633093417&ga_sid=1633093417&ga_hid=932755639&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062579%2C42530892%2C182982100%2C182982300%2C44748552&oid=3&pvsid=1915440762118009&pem=577&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=1&uci=a!1&fsb=1&dtd=144
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-2975953302835633&output=html&adk=1812271804&adf=3025194257&lmt=1633093417&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&tp=site_kit&format=0x0&url=https%3A%2F%2Fcredit.duvetsrc.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633093417013&bpp=17&bdt=979&idt=127&shv=r20210928&mjsv=m202109240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1696917412699&frm=20&pv=2&ga_vid=835524595.1633093417&ga_sid=1633093417&ga_hid=932755639&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062579%2C42530892%2C182982100%2C182982300%2C44748552&oid=3&pvsid=1915440762118009&pem=577&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=1&uci=a!1&fsb=1&dtd=144
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://credit.duvetsrc.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 01 Oct 2021 13:03:37 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Fri, 01-Oct-2021 13:18:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/ 		72 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c72976d3b4c427a85952b5cea1ad2efafcc4b2dc6fdd9ef5a505e5e582e62928
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27601
x-xss-protection
0
server
sffe
etag
"1632957222552500"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="active-view-scs-read-write-acl"
expires
Fri, 01 Oct 2021 13:03:37 GMT
pbice.js
resources.infolinks.com/js/pbice/3.025/ 		279 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/pbice/3.025/pbice.js
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95efc6a1b0e18636b608c1280049e1e31e5dac2f28c111ae489cea912f8b927b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray
6975e4618e674001-CDG
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Wed, 30 Jun 2021 09:40:59 GMT
server
cloudflare
age
14217
etag
W/"45adc-5c5f8851c3ea8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
expires
Sun, 31 Oct 2021 09:06:40 GMT
manage
router.infolinks.com/usync/ Frame 94EB 		9 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
147ddfdfdc5ff3b7f5291adc141fa9ea6aef59deec5f970a3190901a4eecafce

Request headers

:method
GET
:authority
router.infolinks.com
:scheme
https
:path
/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://credit.duvetsrc.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
content-type
text/html;charset=UTF-8
cache-control
no-store
p3p
CP="NON DSP NID OUR COR"
via
1.1 google
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6975e461bec54001-CDG
content-encoding
gzip
lcmanage
router.infolinks.com/usync/ 		0
37 B 		Script
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/usync/lcmanage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cache-control
no-store
cf-ray
6975e461cee54001-CDG
content-length
0
gsd
router.infolinks.com/ 		319 B
488 B 		Script
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/gsd?evt=afterGSD&pid=3257151&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F&jsv=1757.010-3.025&_cb=16330934172420
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ebb00fd762c4d5f08474ca1028e88651dce5c6a7a0aa7ed5a8d54500afe6e32b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
text/javascript;charset=UTF-8
content-encoding
gzip
cache-control
max-age=0
cf-ray
6975e461dee74001-CDG
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
de.tynt.com/deb/ Frame 6EE4
Redirect Chain
  • https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
  • https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
75 B
289 B 		Document
General
Check archive.org
Download Go to
Full URL
https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.31 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip31.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
e170d20dbbd5a22f50118e25fa2eefb1e85d2ad780e5477ed3a9643186090442

Request headers

:method
GET
:authority
de.tynt.com
:scheme
https
:path
/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://router.infolinks.com/
accept-encoding
gzip, deflate, br
cookie
uid=heF6cWFXBylfxtdqIJe5vQ==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/

Response headers

cache-control
max-age=86400
expires
Sat, 02 Oct 2021 13:03:37 GMT
referrer-policy
unsafe-url
content-type
text/html
content-length
75
date
Fri, 01 Oct 2021 13:03:36 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location
https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires
Sat, 26 Jul 1997 05:00:00 GMT
set-cookie
uid=heF6cWFXBylfxtdqIJe5vQ==;Version=1;Comment=;SameSite=None;Domain=tynt.com;Path=/;Max-Age=31536000;Secure
referrer-policy
unsafe-url
content-length
0
date
Fri, 01 Oct 2021 13:03:36 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
Cookie set usermatch
ssum-sec.casalemedia.com/ Frame 8A48
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b6365b22ea21dfe8d55af0887a1191b3829307d72653e24e48fd1354bd08be80

Request headers

Host
ssum-sec.casalemedia.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://router.infolinks.com/
Accept-Encoding
gzip, deflate, br
Cookie
CMID=YVcHKaY6CKnhAkelz3Mn5QAA; CMPS=5221
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
241|45|39|230|5|57|105|195
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1596
Expires
Fri, 01 Oct 2021 13:03:37 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Connection
keep-alive
Set-Cookie
CMID=YVcHKaY6CKnhAkelz3Mn5QAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 01 Oct 2022 13:03:37 GMT CMPS=5221;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Thu, 30 Dec 2021 13:03:37 GMT CMPRO=1101;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Thu, 30 Dec 2021 13:03:37 GMT CMST=YVcHKWFXBykA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 02 Oct 2021 13:03:37 GMT CMRUM3=e6615707292760&396157072905a0&27615707290b40&696157072905a0&056157072905a0&c36157072905a00&f16157072905a0&2d6157072905a0;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 01 Oct 2022 13:03:37 GMT

Redirect headers

Server
Apache
Content-Length
311
Content-Type
text/html; charset=iso-8859-1
Location
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires
Fri, 01 Oct 2021 13:03:37 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Connection
keep-alive
Set-Cookie
CMID=YVcHKaY6CKnhAkelz3Mn5QAA;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Sat, 01 Oct 2022 13:03:37 GMT CMPS=5221;domain=casalemedia.com;path=/;sameSite=None;Secure;expires=Thu, 30 Dec 2021 13:03:37 GMT
/
onetag-sys.com/usync/ Frame E7F1 		2 KB
823 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.38.120.206 , France, ASN16276 (OVH, FR),
Reverse DNS
ip206.ip-51-38-120.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

:method
GET
:authority
onetag-sys.com
:scheme
https
:path
/usync/?pubId=598ce3ddaee8c90
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://router.infolinks.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/

Response headers

content-type
text/html
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
strict-transport-security
max-age=15552000
pbm-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MEQwMTFBNDEtQUMxQy00MDI3LUJFQkMtMjIyN0NDREZFMkQx&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
  • https://router.infolinks.com/dyn/pbm-usync?uid=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/pbm-usync?uid=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
text/html;charset=UTF-8
cache-control
no-store, no-cache, private
cf-ray
6975e465ef3b4001-CDG
content-length
0
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

location
https://router.infolinks.com/dyn/pbm-usync?uid=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
date
Fri, 01 Oct 2021 13:03:36 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
apn-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID
  • https://router.infolinks.com/dyn/apn-usync?user_id=9097066428773806962
35 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/apn-usync?user_id=9097066428773806962
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e46319204001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
5a0c956f-b266-4f79-a63d-9a63d10368ff
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://router.infolinks.com/dyn/apn-usync?user_id=9097066428773806962
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ox-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
  • https://u.openx.net/w/1.0/cm?cc=1&id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
  • https://router.infolinks.com/dyn/ox-usync?uid=8c341ee6-95d5-4bf4-a6c3-3a5b5f22d367
35 B
200 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/ox-usync?uid=8c341ee6-95d5-4bf4-a6c3-3a5b5f22d367
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e46329504001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

date
Fri, 01 Oct 2021 13:03:37 GMT
content-encoding
gzip
server
OXGW/16.216.4
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://router.infolinks.com/dyn/ox-usync?uid=8c341ee6-95d5-4bf4-a6c3-3a5b5f22d367
content-type
image/gif
alt-svc
clear
content-length
0
via
1.1 google
VR-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58422/occ
  • https://ups.analytics.yahoo.com/ups/58422/occ?verify=true
  • https://router.infolinks.com/dyn/VR-usync?uid=y-52xQSWhE2uEb5dCW5Kv.C1AFhUVWOfFMKD0zAxk-~A
35 B
210 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/VR-usync?uid=y-52xQSWhE2uEb5dCW5Kv.C1AFhUVWOfFMKD0zAxk-~A
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e463293f4001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
ATS/7.1.2.138
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://router.infolinks.com/dyn/VR-usync?uid=y-52xQSWhE2uEb5dCW5Kv.C1AFhUVWOfFMKD0zAxk-~A
Connection
keep-alive
Content-Length
0
r1-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://sync.1rx.io/usersync2/infolinks
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8379950509
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8379950509
  • https://sync.1rx.io/usersync/tradedesk/848b0a32-d5cb-4f4a-bd21-1968d22628dd
  • https://sync.targeting.unrulymedia.com/csync/RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fr1-usync%3Fuid%3DRX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003
  • https://router.infolinks.com/dyn/r1-usync?uid=RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003
35 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/r1-usync?uid=RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e465ef404001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:38 GMT

Redirect headers

location
https://router.infolinks.com/dyn/r1-usync?uid=RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003
date
Fri, 01 Oct 2021 13:03:37 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX1da9d60143c54cb3a388f039d10f6c97003
content-type
text/html
zmn-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
  • https://router.infolinks.com/dyn/zmn-usync?uid=
35 B
178 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/zmn-usync?uid=
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e465ef3f4001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/zmn-usync?uid=
Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
70
Content-Type
text/html; charset=utf-8
us
sync.go.sonobi.com/ Frame 94EB 		0
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
ca.png
s.cpx.to/ Frame 94EB
Redirect Chain
  • https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fcredit.duvetsrc.com%252F&pid=12306&adnxs_uid=$UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.cpx.to%2Fca.png%3Fref%3Dhttps%25253A%25252F%25252Fcredit.duvetsrc.com%25252F%26pid%3D12306%26adnxs_uid%3D%24UID
  • https://s.cpx.to/ca.png?ref=https%3A%2F%2Fcredit.duvetsrc.com%2F&pid=12306&adnxs_uid=9097066428773806962
95 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fcredit.duvetsrc.com%2F&pid=12306&adnxs_uid=9097066428773806962
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.243.225.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-243-225-216.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache, no-cache
Content-Security-Policy
default-src 'self'
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Date
Fri, 01 Oct 2021 13:03:37 GMT
X-Frame-Options
sameorigin
Connection
keep-alive
P3P
CP="NOI DEV ADM"
Cache-Control
no-store, must-revalidate, private, max-age=0, no-store, must-revalidate, private, max-age=0
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/png
Content-Length
95
Expires
Fri, 01 Oct 2021 13:03:37 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
X-Proxy-Origin
194.36.108.20; 194.36.108.20; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
a836d0c3-e172-41b0-99ee-02b8d83c59b9
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fcredit.duvetsrc.com%2F&pid=12306&adnxs_uid=9097066428773806962
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
dsp.adkernel.com/ Frame 94EB 		42 B
233 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsp.adkernel.com/sync?exchange=202&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fearn-usync%3Fuid%3D%7BUID%7D
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
nginx
Age
0
Content-Type
image/gif
Cache-Control
no-store
Connection
keep-alive
Content-Length
42
outh-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
  • https://router.infolinks.com/dyn/outh-usync?uid=y-0SV0YYZE2uF4kD34izWeInlyr1BIFK0Y~A~UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
35 B
290 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/outh-usync?uid=y-0SV0YYZE2uF4kD34izWeInlyr1BIFK0Y~A~UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e463396e4001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
ATS/7.1.2.138
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://router.infolinks.com/dyn/outh-usync?uid=y-0SV0YYZE2uF4kD34izWeInlyr1BIFK0Y~A~UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
Connection
keep-alive
Content-Length
0
usersync
match.bnmla.com/ Frame 94EB 		0
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.bnmla.com/usersync?sspid=1000361&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fenbd-usync%3Fuid%3D%5BUUID%5D
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
38.27.122.126 Chestertown, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
sovrn-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
  • https://router.infolinks.com/dyn/sovrn-usync?uid=ab1d157d4e17fcd109b644ca
35 B
216 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/sovrn-usync?uid=ab1d157d4e17fcd109b644ca
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e4648c8b4001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

Date
Fri, 01 Oct 2021 13:03:37 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://router.infolinks.com/dyn/sovrn-usync?uid=ab1d157d4e17fcd109b644ca
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap4ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
usersync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
  • https://image4.pubmatic.com/AdServer/SPug?p=60809&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fusersync%3Fpmuservalue%3D0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
  • https://router.infolinks.com/dyn/usersync?pmuservalue=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
0
156 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/usersync?pmuservalue=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
cache-control
no-store
cf-ray
6975e4647c6b4001-CDG
content-length
0

Redirect headers

location
https://router.infolinks.com/dyn/usersync?pmuservalue=0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
date
Fri, 01 Oct 2021 13:03:36 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
iq-usync
router.infolinks.com/dyn/ Frame 94EB 		0
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/iq-usync
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cache-control
no-store
cf-ray
6975e463fb604001-CDG
content-length
0
zeta-usync
router.infolinks.com/dyn/ Frame 94EB
Redirect Chain
  • https://p.rfihub.com/cm?pub=43153&in=1
  • https://router.infolinks.com/dyn/zeta-usync?uid=1870471598397078066
35 B
258 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/zeta-usync?uid=1870471598397078066
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e465ef414001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/zeta-usync?uid=1870471598397078066
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
/
ssc-cms.33across.com/ps/ Frame 94EB 		0
72 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3257151&wsid=0&pdom=credit.duvetsrc.com&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.175 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip175.208-100-17.static.steadfastdns.net
Software
33XP002 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-33x-status
2000208
date
Fri, 01 Oct 2021 13:03:37 GMT
server
33XP002
doq.htm
rt3003.infolinks.com/action/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://rt3003.infolinks.com/action/doq.htm?pcode=utf-8&r=16330934174051
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df4f90fbc3978c00215ac3ffd1d9f5b89488d12eb75a8a636e60d718ec897f17

Request headers

Referer
https://credit.duvetsrc.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
p3p
CP="NON DSP NID OUR COR"
content-type
text/html;charset=UTF-8
x-application-context
application:prod
pragma
no-cache
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-language
de-DE
access-control-allow-origin
https://credit.duvetsrc.com
cache-control
no-cache,no-store
access-control-allow-credentials
true
cf-ray
6975e4632c333b73-CDG
expires
Thu, 01 Jan 1970 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 8A48
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB&dcc=t
43 B
645 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
PKKR45G6N4F7H1Z05GNG
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
AXRPT0280BRESN8H2WW8
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 8A48
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YVcHKaY6CKnhAkelz3Mn5QAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESED9t59FwFJvNCJV1JFMPKNE&google_cver=1&gdpr=1
43 B
1001 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESED9t59FwFJvNCJV1JFMPKNE&google_cver=1&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 01 Oct 2021 13:03:37 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESED9t59FwFJvNCJV1JFMPKNE&google_cver=1&gdpr=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
325
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame 8A48 		70 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.242.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usermatchredir
ssum-sec.casalemedia.com/ Frame 8A48
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YVcHKaY6CKnhAkelz3Mn5QAABE0AAAAB&gdpr_consent=&us_privacy=&gdpr=1
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEF9VuWXrqU9OzPktNT004Pg&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEF9VuWXrqU9OzPktNT004Pg&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Fri, 01 Oct 2021 13:03:37 GMT

Redirect headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEF9VuWXrqU9OzPktNT004Pg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ix
ad4m.at/ad/sim/ Frame 8A48 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad4m.at/ad/sim/ix?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
crum
dsum-sec.casalemedia.com/ Frame 8A48
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=2079&gdpr=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1871878973395767241
43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1871878973395767241
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 01 Oct 2021 13:03:37 GMT

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1871878973395767241
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
crum
dsum-sec.casalemedia.com/ Frame 8A48
Redirect Chain
  • https://d.adroll.com/cm/index/ssp?gdpr=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
43 B
974 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 01 Oct 2021 13:03:37 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
date
Fri, 01 Oct 2021 13:03:37 GMT
server
nginx/1.20.0
content-length
76
crum
dsum-sec.casalemedia.com/ Frame 8A48
Redirect Chain
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-ca85598a-7341-4a48-af8e-b1de364b441b
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-ca85598a-7341-4a48-af8e-b1de364b441b
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-218-208-246.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 01 Oct 2021 13:03:37 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Fri, 01 Oct 2021 13:03:37 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-ca85598a-7341-4a48-af8e-b1de364b441b
date
Fri, 01 Oct 2021 13:03:37 GMT
server
Apache-Coyote/1.1
content-length
0
ix-usync
router.infolinks.com/dyn/ Frame 8A48 		35 B
196 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/ix-usync?uid=YVcHKaY6CKnhAkelz3Mn5QAA%261101
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
6975e463294e4001-CDG
content-length
35
expires
Thu, 01 Oct 2020 13:03:37 GMT
dcl.htm
rt3003.infolinks.com/action/ 		0
38 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rt3003.infolinks.com/action/dcl.htm?rid=dbded574-3bc0-43aa-9433-e101dd5b87eb&jsv=1757.010-3.025&capara=%7B%22failedAlgos%22%3A%22palgo%22%7D
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html;charset=UTF-8
cache-control
no-cache,no-store
cf-ray
6975e465beec4001-CDG
content-length
0
x-application-context
application:prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
dcl.htm
rt3003.infolinks.com/action/ 		0
103 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rt3003.infolinks.com/action/dcl.htm?rid=dbded574-3bc0-43aa-9433-e101dd5b87eb&jsv=1757.010-3.025&capara=%7B%22mode%22%3A%22default%22%2C%22markers%22%3A1%7D
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html;charset=UTF-8
cache-control
no-cache,no-store
cf-ray
6975e465cef54001-CDG
content-length
0
x-application-context
application:prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
getads.htm
rt3003.infolinks.com/action/ 		271 B
249 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rt3003.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22IL_IN_CONTENT0%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22c%22%2C%22miw%22%3A14%2C%22maw%22%3A1614%2C%22mih%22%3A12%2C%22mah%22%3A2400%2C%22sdata%22%3A%22return%22%2C%22scs%22%3A%22e5x5BnCFqB%22%7D%2C%7B%22lid%22%3A%22IL_IN_ARTICLE0%22%2C%22bdc%22%3A2%2C%22prod_t%22%3A%22a%22%2C%22miw%22%3A2%2C%22maw%22%3A473%2C%22mih%22%3A12%2C%22mah%22%3A2400%2C%22sdata%22%3A%22card%22%2C%22scs%22%3A%225qbHMhi9ey%22%7D%2C%7B%22lid%22%3A%22IL_IN_ARTICLE1%22%2C%22bdc%22%3A3%2C%22prod_t%22%3A%22a%22%2C%22miw%22%3A2%2C%22maw%22%3A473%2C%22mih%22%3A12%2C%22mah%22%3A2400%2C%22sdata%22%3A%22computer%20network%22%2C%22scs%22%3A%22v00jrg3rXd%22%7D%5D&rid=dbded574-3bc0-43aa-9433-e101dd5b87eb&jsv=1757.010-3.025&sr=1600X1200&rts=1633093417880&cfv=-1&cb=singleGetAdsResponse&os=Windows&ov=10&br=Chrome&bv=93.0.4577.63&dv=p&ce=t&purl=https%3A%2F%2Fcredit.duvetsrc.com%2F&tzo=-0000&c=c&strg=true&rsd=Ke-Nx261Rfi2M1Vr5YhdNodn-7U97AO_hNxfC3Ksvue9IMFPZoYEx_d_cwYllk1nEzsI3xRFBH_ELDkY9KpfU-OGHg2IsIxGagO2W_vIXUjuDj1HX4z0_2yWN6TlBoMCfQBizBsKOwQ8A_nNYD4ymYQ_0I4Q4M2c&rsk=87&rcs=Q9EvykA41glPhGua2L1rmw&hbnr=true
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
371d1b9b250edfa08a10b92137c24166f032738d9b89d1691dd3bda8740ca41f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
p3p
CP="NON DSP NID OUR COR"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-language
de-DE
content-type
text/html;charset=UTF-8
cache-control
no-cache,no-store
cf-ray
6975e465df204001-CDG
x-application-context
application:prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
dcl.htm
rt3003.infolinks.com/action/ 		0
38 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rt3003.infolinks.com/action/dcl.htm?rid=dbded574-3bc0-43aa-9433-e101dd5b87eb&jsv=1757.010-3.025&capara=%7B%22mode%22%3A%22default%22%2C%22markers%22%3A2%7D
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1757.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:38 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html;charset=UTF-8
cache-control
no-cache,no-store
cf-ray
6975e465df224001-CDG
content-length
0
x-application-context
application:prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
loader.gif
resources.infolinks.com/static/skins/ 		962 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://resources.infolinks.com/static/skins/loader.gif
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b8ee13d35110d7006bc5c5147ee0a0c6c3e1f26b2f246b8d5e57edf4f6b97b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
HIT
age
13218
cf-polished
origSize=1631, status=webp_bigger
content-length
962
last-modified
Mon, 14 Nov 2016 12:31:03 GMT
server
cloudflare
etag
"65f-54142035d0066"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
expires
Sun, 31 Oct 2021 09:23:19 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6975e465df244001-CDG
cf-bgj
imgq:85,h2pri
loader-bg.png
resources.infolinks.com/static/skins/ 		902 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://resources.infolinks.com/static/skins/loader-bg.png
Requested by
Host: credit.duvetsrc.com
URL: https://credit.duvetsrc.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5ddb995fe37710a4be439e4e3f45016cd7b7ecfa3423a29e4f4f4dcce63efff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:37 GMT
via
1.1 google
cf-cache-status
HIT
age
7522
cf-polished
origFmt=png, origSize=1488
content-disposition
inline; filename="loader-bg.webp"
content-length
902
last-modified
Mon, 14 Nov 2016 12:31:03 GMT
server
cloudflare
etag
"5d0-541420359b4a6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
expires
Sun, 31 Oct 2021 10:58:15 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6975e465df264001-CDG
cf-bgj
imgq:85,h2pri
sodar
pagead2.googlesyndication.com/getconfig/ 		11 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210928&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3812a421f8b722203d8de7ac4f13e4f346fb69497e17e3f189c1a9c989feacbf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 01 Oct 2021 13:03:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8579
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2975953302835633&plah=credit.duvetsrc.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 13:03:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Fri, 01 Oct 2021 13:03:38 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 8ECE 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/224/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://credit.duvetsrc.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5029
date
Fri, 01 Oct 2021 11:59:57 GMT
expires
Sat, 01 Oct 2022 11:59:57 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3821
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame A558 		783 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
ea02af63a5393c5011c15db1a8ca6a26bc4beb11dd2782e9dbaf19a88f771dc6
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-sbvhXpaEuNE/A+0BUCDQWA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://credit.duvetsrc.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy-report-only
require-corp; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Fri, 01 Oct 2021 13:03:38 GMT
date
Fri, 01 Oct 2021 13:03:38 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-sbvhXpaEuNE/A+0BUCDQWA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
512
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
admin-ajax.php
credit.duvetsrc.com/wp-admin/ 		36 B
373 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://credit.duvetsrc.com/wp-admin/admin-ajax.php
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/wp/wp-slimstat/tags/4.8.8.1/wp-slimstat.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.225.161.113 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
storm2.duvetsrc.com
Software
Apache /
Resource Hash
e1f4c8af6c84337753e16d48b856f15f93bdfc78076c83fd0d4572bc72a54bc2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-fetch-mode
cors
origin
https://credit.duvetsrc.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
empty
x-requested-with
XMLHttpRequest
cookie
logglytrackingsession=723df0d8-6edb-4f2e-8774-808a76a092cb; __gads=ID=ef85356fb3d1a711-22c4e90c66c9009d:T=1633093417:RT=1633093417:S=ALNI_Ma0mm0cuAUIyVGbWNIK9N2hy816iQ
content-length
244
:path
/wp-admin/admin-ajax.php
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type
application/x-www-form-urlencoded
accept
*/*
cache-control
no-cache
:authority
credit.duvetsrc.com
referer
https://credit.duvetsrc.com/
:scheme
https
sec-fetch-site
same-origin
:method
POST
Referer
https://credit.duvetsrc.com/
X-Requested-With
XMLHttpRequest
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 01 Oct 2021 13:03:39 GMT
referrer-policy
strict-origin-when-cross-origin
server
Apache
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://credit.duvetsrc.com
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
set-cookie
slimstat_tracking_code=537.db6f7b9a68330bebd33cc5316711d989; expires=Fri, 01-Oct-2021 13:33:39 GMT; Max-Age=1800; path=/
x-robots-tag
noindex
x-content-type-options
nosniff
expires
Wed, 11 Jan 1984 05:00:00 GMT
y_GpSJCDeJUhy2edwqiqULXjheMgRVI09JfpD4O8H0g.js
pagead2.googlesyndication.com/bg/ Frame 8ECE 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/y_GpSJCDeJUhy2edwqiqULXjheMgRVI09JfpD4O8H0g.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cbf1a9489083789521cb679dc2a8aa50b5e385e320455234f497e90f83bc1f48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 28 Sep 2021 22:36:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
224809
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13365
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 10:18:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Wed, 28 Sep 2022 22:36:49 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame A558 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20210928&jk=1915440762118009&rc=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210928&jk=1915440762118009&bg=!T0ylTAjNAAZE-GIIRPg7ACkAdvg8WrF9IetiWgovta2fHxsZU72EA9upYaGKIuoGXGsFJHDEjB-q8wIAAAByUgAAAA9oAQeZAtCuMkfqXHipsnu_DTN9AH6xyXT0Znyh11RlGoAcFC8bNwfnncVBQQSgACkbpCQ8N09-jcHsUh772tF_67LOYuWfSqyWOsTtxENJOpz04SLtjQVSBhrhi9C46mEKeSm8UU0ZhoouQc88FHaD8njYo0oUa13tpGbzjpZNdIda8QyMBw9nSuFBYyDjFBhVLQwoyCuwvqj52cjkSK8EfPs2v00JKDKrx-n9YknX93znxowWg-Gp4Fab-vg1fSBloISd_M0A2zAzYQVWRIkrpBEs-W7ZE1__xpsMQs4uKrlaiEZydK62iN5rMsU92kRf25P08dtEMDOPtrEuAFIXrYqdO3VN0HX6uImcBR6da_Im8uXRUU1pf8FMT_-Z_NeazFZYY8gRPNQ8MqV9yC8_r0tQOkyETVuH_wAj0mNNMkA1YD-cea7MT_ip9S-g5QKTPeeyoJlDuAhTSTEJDU_3pzbLzIkW4EgeAgy_jSzCGjey98fJNj5LqCbSKfMgNcW5ksGljB-SSezqlNlO9TAlMNsmKJ-QXZxYaAOs3LKIYgLLFRlVoNGrsn-OrXSD4VDBkeURSdfpnQNKfgTXgFVu4drkCZS1gl4JfgHCQtSSb2_ZKy1BKUg9WXtgBaKHM5ZePxt5VJvQ7LgL_3EpFINGGeJuE8Wo49ce9zLb4OhC21FRK89QKpILUJAdfGwqS4SuDFs4zaY7WaAZ4wePBKhs--aksqpRIBuYWNWZMgg9LpoHMlbGggt5YjEpfYNLY3-o96WQp2p-0EZin6qje8-rb7S9lpi_spqYZaWbvhXYdPI_bHxxpw9EtmgQUerLCJ5BwVCf-MSusNg9xJnwIDHR8iHiA953ycBaG5Ob4LTHWRGPWNovvqURMHZKDXmUZVAxMdEeFAWMLOjJCk69WFfytzUReoX2nK2GPa0ohG89OWcl-8Qz216CStiFqUmjgIOKLcFV-oA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers
gen_204
pagead2.googlesyndication.com/pagead/ 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&wpc=ca-pub-2975953302835633&su=credit.duvetsrc.com&eid=42530892&doc=complete&pg_h=4015&pg_w=1610&pg_hs=4015&c=0&aa_c=0&d=0&all_d=0&ard=0&all_ard=0&dt=d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://credit.duvetsrc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 01 Oct 2021 13:03:39 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

79 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| onbeforexrselect boolean| originAgentCluster object| _wpemojiSettings undefined| $ function| jQuery object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state object| adsbygoogle boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots object| google_persistent_state_async function| google_spfd number| google_unique_id object| google_sv_map string| google_user_agent_client_hint number| infolinks_pid string| infolinks_plugin_version string| infolinks_resources object| $iceboot object| INFOLINKS function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| googleToken object| googleIMState boolean| _gfp_p_ object| google_image_requests function| processGoogleToken object| google_prev_clients object| gaGlobal object| google_jobrunner object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired function| _typeof object| $ice object| $infolinks object| bootstrap function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb function| hb_iceChunk object| hb_ice object| _pbjsGlobals object| $ICE_HB number| $iceId object| SlimStatParams object| SlimStat function| Fingerprint2 object| wp object| twemoji string| slimstat_data boolean| use_beacon object| all_clickable object| GoogleGcLKhOms object| values number| x object| screenres object| slim_performance object| xhr object| opt_out_cookies boolean| show_optout number| parsed_id

44 Cookies

Domain/Path Name / Value
credit.duvetsrc.com/ Name: logglytrackingsession
Value: 723df0d8-6edb-4f2e-8774-808a76a092cb
.duvetsrc.com/ Name: __gads
Value: ID=ef85356fb3d1a711-22c4e90c66c9009d:T=1633093417:RT=1633093417:S=ALNI_Ma0mm0cuAUIyVGbWNIK9N2hy816iQ
.infolinks.com/ Name: cuid
Value: 8ff02c91-2bf1-4ff2-b9a0-b2ee616231f5
.advertising.com/ Name: APID
Value: UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
.adnxs.com/ Name: uuid2
Value: 9097066428773806962
.casalemedia.com/ Name: CMID
Value: YVcHKaY6CKnhAkelz3Mn5QAA
.casalemedia.com/ Name: CMPS
Value: 5221
.yahoo.com/ Name: A3
Value: d=AQABBCkHV2ECEFBZt594NqBmTocRGb7snicFEgEBAQFYWGFgYQAAAAAA_eMAAA&S=AQAAAmjFGXQe5AGdPmJ3ojEsaUM
.openx.net/ Name: i
Value: 740f032e-2f86-438f-bdda-c541c3a2450f|1633093417
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.casalemedia.com/ Name: CMPRO
Value: 1101
.casalemedia.com/ Name: CMST
Value: YVcHKWFXBykA
.pubmatic.com/ Name: SyncRTB3
Value: 1634256000%3A220
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
.analytics.yahoo.com/ Name: IDSYNC
Value: 18xp~20pp
.yahoo.com/ Name: APID
Value: UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
.yahoo.com/ Name: APIDTS
Value: 1633093417
.doubleclick.net/ Name: IDE
Value: AHWqTUnP_5OvmliDbV5jybIjN1HlUn9DMzz66eYYCsF_enrwpBQhFQ45BwtlJRiRQJ8
.adsrvr.org/ Name: TDID
Value: 848b0a32-d5cb-4f4a-bd21-1968d22628dd
.cpx.to/ Name: cpSess
Value: 5e9761115472b675
.cpx.to/ Name: dsp_app_nexus
Value: 9097066428773806962#1633093417550
.infolinks.com/ Name: OUTHUSERCOOKIE
Value: y-0SV0YYZE2uF4kD34izWeInlyr1BIFK0Y~A~UPfdcbe381-22b7-11ec-b5b8-06584a1aed54
.lijit.com/ Name: ljt_reader
Value: ab1d157d4e17fcd109b644ca
.infolinks.com/ Name: OXUSERCOOKIE
Value: 8c341ee6-95d5-4bf4-a6c3-3a5b5f22d367
.infolinks.com/ Name: IXUSERCOOKIE
Value: YVcHKaY6CKnhAkelz3Mn5QAA&1101
.infolinks.com/ Name: VRUSERCOOKIE
Value: y-52xQSWhE2uEb5dCW5Kv.C1AFhUVWOfFMKD0zAxk-~A
.adsrvr.org/ Name: TDCPM
Value: CAEYBSABKAIyCwiU7-fS07mCOhAFOAE.
.infolinks.com/ Name: ANUSERCOOKIE
Value: 9097066428773806962
.pubmatic.com/ Name: PUBMDCID
Value: 3
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003%22%7D
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 3
.tynt.com/ Name: uid
Value: heF6cWFXBylfxtdqIJe5vQ==
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003%22%7D
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNrQwNzAxNzS1tDC2NDcwtzAwMxPiM9QNMfLyD67yrCjJTw-X4jU0MzY2sDQ2MTQ3NzYBAEXepbI0AAAA
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAFslzmtoZmxsYGlsYmhubmwCANh1cZ8QAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNrQwNzAxNzS1tDC2NDcwtzAwMxPiM9QNMfLyD67yrCjJTw8HAFrQvTIlAAAA
.infolinks.com/ Name: KADUSERCOOKIE
Value: 0D011A41-AC1C-4027-BEBC-2227CCDFE2D1~1633093504128
.infolinks.com/ Name: SOVRNUSERCOOKIE
Value: ab1d157d4e17fcd109b644ca
.casalemedia.com/ Name: CMRUM3
Value: 2d615707292760CAESED9t59FwFJvNCJV1JFMPKNE&f16157072905a0&396157072905a0&27615707290b40&696157072905a00&056157072905a0&c3615707292760av-ca85598a-7341-4a48-af8e-b1de364b441b&e6615707292760
.infolinks.com/ Name: ZTUSERCOOKIE
Value: 1870471598397078066
.infolinks.com/ Name: ZMNUSERCOOKIE
Value: ""
.infolinks.com/ Name: PUBMUSERCOOKIE
Value: 0D011A41-AC1C-4027-BEBC-2227CCDFE2D1
.infolinks.com/ Name: R1USERCOOKIE
Value: RX-1da9d601-43c5-4cb3-a388-f039d10f6c97-003
credit.duvetsrc.com/ Name: slimstat_tracking_code
Value: 537.db6f7b9a68330bebd33cc5316711d989

1 Console Messages

Source Level URL
Text
network error URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2975953302835633&output=html&adk=1812271804&adf=3025194257&lmt=1633093417&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&tp=site_kit&format=0x0&url=https%3A%2F%2Fcredit.duvetsrc.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633093417013&bpp=17&bdt=979&idt=127&shv=r20210928&mjsv=m202109240101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1696917412699&frm=20&pv=2&ga_vid=835524595.1633093417&ga_sid=1633093417&ga_hid=932755639&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062579%2C42530892%2C182982100%2C182982300%2C44748552&oid=3&pvsid=1915440762118009&pem=577&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=1&uci=a!1&fsb=1&dtd=144
Message:
Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad4m.at
adservice.google.com
adservice.google.de
ap.lijit.com
b1sync.zemanta.com
cdn.jsdelivr.net
cm.g.doubleclick.net
credit.duvetsrc.com
d.adroll.com
de.tynt.com
dsp.adkernel.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
image4.pubmatic.com
image8.pubmatic.com
match.adsrvr.org
match.bnmla.com
nep.advangelists.com
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.advertising.com
resources.infolinks.com
router.infolinks.com
rt3003.infolinks.com
s.amazon-adsystem.com
s.cpx.to
ssc-cms.33across.com
ssum-sec.casalemedia.com
sync.1rx.io
sync.go.sonobi.com
sync.targeting.unrulymedia.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
www.credit.duvetsrc.com
www.google.com
www.googletagservices.com
13.248.242.197
142.250.185.194
172.66.41.9
174.137.133.49
178.162.133.149
18.156.0.31
18.159.118.206
18.214.253.211
185.64.189.110
185.64.189.114
185.64.189.216
193.0.160.129
208.100.17.175
209.54.176.128
213.19.147.44
216.52.2.19
216.58.212.162
23.218.208.246
2606:4700:20::681a:bd1
2a00:1450:4001:800::2002
2a00:1450:4001:802::2004
2a00:1450:4001:809::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:812::2003
2a00:1450:4001:813::200a
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:831::2002
2a04:4e42::485
34.243.225.216
35.244.159.8
37.252.173.22
38.27.122.126
51.38.120.206
52.19.99.3
64.202.112.191
67.202.105.31
67.225.161.113
00212879f20605920244d4f6db3433eeceb5a8290d4503c776a28c04c0982fdd
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
02decb76d37d026d332be0228facdbdf013a429f404a9283bf37fcc3cda99cbd
030f19957296dc542ce439d8fe48c3308852bcc7219cbc151c4276b454990c25
032699f5abc60e8e1b3c28bfa7a9a046addb1777420acb4c599871b5d64f0888
0b70862730ee79a79a9fdef3ed2947b9677bfbb363822a53874d3c6fb6a1e580
126efd547bdd0ee931514152089da92b546103f4f21a33e5bddb55f004931511
147ddfdfdc5ff3b7f5291adc141fa9ea6aef59deec5f970a3190901a4eecafce
14af47320898bd93f367026f7833c9956f14e24856976e4f9e10be31155cdcf2
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
27ac4ae0b8cfa0b79ad181287f05c6df6e6f8c519bb62de083acfd685c727a1f
3663c660ba4a97493c560be909411c02135cbdde88906d2af88e70d825703d97
371d1b9b250edfa08a10b92137c24166f032738d9b89d1691dd3bda8740ca41f
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3812a421f8b722203d8de7ac4f13e4f346fb69497e17e3f189c1a9c989feacbf
3be0a5a4f4980d0f231ca381f2ff37a91b9adcb061efe6d814cdb1c5a4f7f724
4080b83d8afc4487b8229308be2f196372bd2123613b46388048f14159f07181
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3
4d2883443b24e424527f6a0a7aa2897b3df71f239db40373c4ff760e48147801
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5de682611970bff82cae30195c595d1e4c4351c930522135a479667e7f251ff1
7209e11a45cef119e8d3539afb2689835d17b16a0a22f8334d867cf77a220d2a
8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6
8921fc1d5c033cc206990cb0fbf63e2c3b813929ee04e841fe13d0b80417f1a3
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ebedb88998d4ef19bb0bbc1bc57c3492b405e9800ced755a90460baa8016e06
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
953bf37ba1ece541eade29ea097cacc1e7e733d5835d681c9e41fc09ee068be3
95efc6a1b0e18636b608c1280049e1e31e5dac2f28c111ae489cea912f8b927b
98fbdd524b447115aadfe74af66f5a7d75faa1cefd318f3854acdff3d4f2e25b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a8c411b5b92d763e3cc49d348b2321ba9b6c8134e6f29fe0eac89e18fe680b53
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6365b22ea21dfe8d55af0887a1191b3829307d72653e24e48fd1354bd08be80
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
c5ddb995fe37710a4be439e4e3f45016cd7b7ecfa3423a29e4f4f4dcce63efff
c72976d3b4c427a85952b5cea1ad2efafcc4b2dc6fdd9ef5a505e5e582e62928
cbf1a9489083789521cb679dc2a8aa50b5e385e320455234f497e90f83bc1f48
cc8562872dc541ccfe9ab57d0d85581b33b22924c126651f11d1dc3456ad7961
cd109685aad091ac9e233f99deedc4ff3aa2302a7d7d8a7064d6a14d1f87db77
d287da709652059aee8af366398fb5597fa3bf2e9cbe53b7c8ffe3da44f19ff8
d9a556c830024a4105d859c0a1824c5ecfcb2741e3602ed04fa2789f15576a33
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df4f90fbc3978c00215ac3ffd1d9f5b89488d12eb75a8a636e60d718ec897f17
e170d20dbbd5a22f50118e25fa2eefb1e85d2ad780e5477ed3a9643186090442
e1f4c8af6c84337753e16d48b856f15f93bdfc78076c83fd0d4572bc72a54bc2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b8ee13d35110d7006bc5c5147ee0a0c6c3e1f26b2f246b8d5e57edf4f6b97b
ea02af63a5393c5011c15db1a8ca6a26bc4beb11dd2782e9dbaf19a88f771dc6
ebb00fd762c4d5f08474ca1028e88651dce5c6a7a0aa7ed5a8d54500afe6e32b
ebf968e400976b579ea9dcff5f0bc247a2b2371f9ce49c3b5829da4b7179f4f9
edba456dcd0b465ed088a43286de54023b36de71e3659a9ce7435b50ba1cb054
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fa3f1ae4ed26ed6ccb2f100292b9534770c28cebb5d69af748e6d316e4a26908
fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7
fbc199bf7f97061c41664b040e84616a0cb54441a2efc5801d5d401d3a049f3c