whitehelmets.org Open in urlscan Pro
18.67.111.110 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://whitehelmets.org/
Effective URL:
https://whitehelmets.org/en/
Submission: On November 19 via api (November 19th 2023, 9:53:40 am UTC) from AU — Scanned from AU

Summary HTTP 102 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 27 IPs in 3 countries across 18 domains to perform 102 HTTP transactions. The main IP is 18.67.111.110, located in United States and belongs to AMAZON-02, US. The main domain is whitehelmets.org.
TLS certificate: Issued by Amazon RSA 2048 M02 on July 13th 2023. Valid for: a year.

This is the only time whitehelmets.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	18.67.111.110 18.67.111.110	16509 (AMAZON-02) (AMAZON-02)
18	172.67.192.56 172.67.192.56	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.65.26 151.101.65.26	54113 (FASTLY) (FASTLY)
1	104.21.19.185 104.21.19.185	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	172.217.167.100 172.217.167.100	15169 (GOOGLE) (GOOGLE)
1	162.159.128.61 162.159.128.61	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	157.240.8.23 157.240.8.23	32934 (FACEBOOK) (FACEBOOK)
11	142.250.66.195 142.250.66.195	15169 (GOOGLE) (GOOGLE)
4	151.101.30.109 151.101.30.109	54113 (FASTLY) (FASTLY)
3	151.101.64.217 151.101.64.217	54113 (FASTLY) (FASTLY)
7	34.120.202.204 34.120.202.204	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	149.135.80.248 149.135.80.248	1221 (ASN-TELST...) (ASN-TELSTRA Telstra Corporation Ltd)
1	162.159.138.60 162.159.138.60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	157.240.8.35 157.240.8.35	32934 (FACEBOOK) (FACEBOOK)
3	142.251.221.67 142.251.221.67	15169 (GOOGLE) (GOOGLE)
3	18.67.93.15 18.67.93.15	16509 (AMAZON-02) (AMAZON-02)
1	172.217.167.74 172.217.167.74	15169 (GOOGLE) (GOOGLE)
1 9	192.229.232.89 192.229.232.89	15133 (EDGECAST) (EDGECAST)
3	142.250.67.14 142.250.67.14	15169 (GOOGLE) (GOOGLE)
2	76.223.13.31 76.223.13.31	16509 (AMAZON-02) (AMAZON-02)
10	3.24.113.253 3.24.113.253	16509 (AMAZON-02) (AMAZON-02)
5	151.101.65.21 151.101.65.21	54113 (FASTLY) (FASTLY)
1	142.250.66.200 142.250.66.200	15169 (GOOGLE) (GOOGLE)
1	35.81.31.24 35.81.31.24	16509 (AMAZON-02) (AMAZON-02)
1 2	64.4.245.7 64.4.245.7	17012 (PAYPAL) (PAYPAL)
1	151.101.193.35 151.101.193.35	() ()
102	27

2 18.67.111.110 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-67-111-110.syd62.r.cloudfront.net

whitehelmets.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 172.67.192.56 (United States)

ASN13335 (CLOUDFLARENET, US)

www.whitehelmets.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
act.whitehelmets.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.26 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.19.185 (None, )

ASN13335 (CLOUDFLARENET, US)

json.geoiplookup.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.167.100 (United States)

ASN15169 (GOOGLE, US)
PTR: syd09s17-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.128.61 (None, )

ASN13335 (CLOUDFLARENET, US)

player.vimeo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.8.23 (Sydney, Australia)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-syd2.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.66.195 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: syd09s23-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.30.109 (Sydney, Australia)

ASN54113 (FASTLY, US)

f.vimeocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.64.217 (United States)

ASN54113 (FASTLY, US)

i.vimeocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.120.202.204 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 204.202.120.34.bc.googleusercontent.com

fresnel.vimeocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
player-telemetry.vimeo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 149.135.80.248 (Australia)

ASN1221 (ASN-TELSTRA Telstra Corporation Ltd, AU)

11vod-adaptive.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.138.60 (None, )

ASN13335 (CLOUDFLARENET, US)

vimeo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.8.35 (Sydney, Australia)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-syd2.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.221.67 (United States)

ASN15169 (GOOGLE, US)
PTR: syd09s31-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.67.93.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-93-15.syd62.r.cloudfront.net

d3rta84bycnbpe.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.167.74 (United States)

ASN15169 (GOOGLE, US)
PTR: syd15s06-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 192.229.232.89 (Marlborough, United States) 1 redirects

ASN15133 (EDGECAST, US)

js.braintreegateway.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.braintreegateway.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.67.14 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: syd15s16-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.13.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: ae1d37305401c759d.awsglobalaccelerator.com

payments.braintree-api.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 3.24.113.253 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

client-analytics.braintreegateway.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.65.21 (United States)

ASN54113 (FASTLY, US)

c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.66.200 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: syd09s23-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.81.31.24 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-81-31-24.us-west-2.compute.amazonaws.com

ssl.kaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.4.245.7 (United States) 1 redirects

ASN17012 (PAYPAL, US)

b.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hnd.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.35 (None, )

ASN- ()

c6.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	whitehelmets.org 1 redirects whitehelmets.org www.whitehelmets.org act.whitehelmets.org	486 KB
19	braintreegateway.com 1 redirects js.braintreegateway.com — Cisco Umbrella Rank: 9477 client-analytics.braintreegateway.com — Cisco Umbrella Rank: 8897 assets.braintreegateway.com — Cisco Umbrella Rank: 17170	164 KB
14	gstatic.com www.gstatic.com fonts.gstatic.com	685 KB
12	vimeocdn.com f.vimeocdn.com — Cisco Umbrella Rank: 3510 i.vimeocdn.com — Cisco Umbrella Rank: 3345 fresnel.vimeocdn.com — Cisco Umbrella Rank: 3471	301 KB
8	paypal.com 1 redirects c.paypal.com — Cisco Umbrella Rank: 7837 b.stats.paypal.com — Cisco Umbrella Rank: 6268 hnd.stats.paypal.com — Cisco Umbrella Rank: 118484 c6.paypal.com	47 KB
6	google.com www.google.com — Cisco Umbrella Rank: 2	91 KB
5	akamaized.net 11vod-adaptive.akamaized.net — Cisco Umbrella Rank: 117695	3 MB
4	vimeo.com player.vimeo.com — Cisco Umbrella Rank: 1959 player-telemetry.vimeo.com — Cisco Umbrella Rank: 7178 vimeo.com — Cisco Umbrella Rank: 1878	11 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
3	cloudfront.net d3rta84bycnbpe.cloudfront.net	8 KB
2	braintree-api.com payments.braintree-api.com — Cisco Umbrella Rank: 9569	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	89 KB
1	kaptcha.com ssl.kaptcha.com — Cisco Umbrella Rank: 8876	366 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	81 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 364	33 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 110	186 B
1	geoiplookup.io json.geoiplookup.io — Cisco Umbrella Rank: 55050	873 B
1	polyfill.io polyfill.io — Cisco Umbrella Rank: 1329	610 B
102	18

	Domain	Requested by
11	www.gstatic.com	www.google.com f.vimeocdn.com www.gstatic.com
11	www.whitehelmets.org	whitehelmets.org www.whitehelmets.org d3rta84bycnbpe.cloudfront.net
10	client-analytics.braintreegateway.com	js.braintreegateway.com assets.braintreegateway.com
7	act.whitehelmets.org	www.whitehelmets.org act.whitehelmets.org
6	www.google.com	whitehelmets.org www.gstatic.com www.google.com
5	c.paypal.com	js.braintreegateway.com c.paypal.com
5	js.braintreegateway.com	act.whitehelmets.org
5	11vod-adaptive.akamaized.net	f.vimeocdn.com
5	fresnel.vimeocdn.com	f.vimeocdn.com
4	assets.braintreegateway.com	1 redirects js.braintreegateway.com
4	f.vimeocdn.com	player.vimeo.com
3	www.google-analytics.com	act.whitehelmets.org www.google-analytics.com www.googletagmanager.com
3	d3rta84bycnbpe.cloudfront.net	act.whitehelmets.org
3	fonts.gstatic.com	whitehelmets.org
3	i.vimeocdn.com	whitehelmets.org
2	payments.braintree-api.com	js.braintreegateway.com
2	player-telemetry.vimeo.com	f.vimeocdn.com
2	connect.facebook.net	whitehelmets.org connect.facebook.net
2	whitehelmets.org	1 redirects
1	c6.paypal.com
1	hnd.stats.paypal.com
1	b.stats.paypal.com	1 redirects
1	ssl.kaptcha.com	js.braintreegateway.com
1	www.googletagmanager.com	www.google-analytics.com
1	ajax.googleapis.com	act.whitehelmets.org
1	www.facebook.com	whitehelmets.org
1	vimeo.com	f.vimeocdn.com
1	player.vimeo.com	www.whitehelmets.org
1	json.geoiplookup.io	whitehelmets.org
1	polyfill.io	whitehelmets.org
102	30

This site contains links to these domains. Also see Links.

Domain
www.whitehelmets.org
www.facebook.com
www.twitter.com
www.netflix.com
itunes.apple.com
www.cbsnews.com
time.com
thesyriacampaign.org
www.thesyriacampaign.org

Subject Issuer	Validity	Valid
whitehelmets.org Amazon RSA 2048 M02	`2023-07-13` - `2024-08-10`	a year	crt.sh
polyfill.io Certainly Intermediate R1	`2023-11-12` - `2023-12-12`	a month	crt.sh
geoiplookup.io GTS CA 1P5	`2023-10-30` - `2024-01-28`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-03-01` - `2024-02-29`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-08-28` - `2023-11-26`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.vimeocdn.com GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-02-18` - `2024-03-21`	a year	crt.sh
*.vimeo.com GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-10-19` - `2024-11-19`	a year	crt.sh
fresnel.vimeocdn.com GTS CA 1D4	`2023-11-03` - `2024-02-01`	3 months	crt.sh
a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1	`2023-05-16` - `2024-05-15`	a year	crt.sh
vimeo.com Cloudflare Inc ECC CA-3	`2023-08-23` - `2024-08-21`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2023-10-12` - `2024-10-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
payments.braintree-api.com DigiCert SHA2 Extended Validation Server CA	`2023-08-23` - `2024-09-22`	a year	crt.sh
client-analytics.braintreegateway.com DigiCert SHA2 High Assurance Server CA	`2023-02-24` - `2024-03-26`	a year	crt.sh
ssl.kaptcha.com Sectigo RSA Organization Validation Secure Server CA	`2023-08-16` - `2024-08-15`	a year	crt.sh

This page contains 11 frames:

Primary Page: https://whitehelmets.org/en/
Frame ID: 32B39BAF1A9E9A4FD9EBC22D7AEB7036
Requests: 20 HTTP requests in this frame

Frame: https://act.whitehelmets.org/act/peoples-million
Frame ID: F8452AFB0D10CEA93976D34344779EBB
Requests: 28 HTTP requests in this frame

Frame: https://player.vimeo.com/video/307091049?autoplay=1&loop=1&muted=1&title=0&byline=0&controls=0
Frame ID: 788236A911E45419575D3A2CC7A730EB
Requests: 25 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA&co=aHR0cHM6Ly93aGl0ZWhlbG1ldHMub3JnOjQ0Mw..&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=invisible&cb=z617ltkm5b2n
Frame ID: C1BFC8DCE915C1DDC658D12A2368C980
Requests: 4 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA
Frame ID: 2E18CA5C07C1130246A36313F701F1FD
Requests: 11 HTTP requests in this frame

Frame: https://assets.braintreegateway.com/web/3.69.0/html/hosted-fields-frame.min.html
Frame ID: 49598913B83BF215F5E1F98354CBF482
Requests: 2 HTTP requests in this frame

Frame: https://assets.braintreegateway.com/web/3.69.0/html/hosted-fields-frame.min.html
Frame ID: 4C3BD36BC60EBA4C2050EA356CF47B39
Requests: 1 HTTP requests in this frame

Frame: https://assets.braintreegateway.com/web/3.69.0/html/hosted-fields-frame.min.html
Frame ID: A46A546229242816540CFA348053CC46
Requests: 1 HTTP requests in this frame

Frame: https://ssl.kaptcha.com/logo.htm?m=null&s=c9fcffa4a4a44e339b3dbc20635af9d1
Frame ID: 3DECEFBEE5B3199E710D1337B2BEDB0D
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
Frame ID: 80650BD93A6407B035105E6C857ACB1E
Requests: 5 HTTP requests in this frame

Frame: https://hnd.stats.paypal.com/counter2.cgi?i=127.0.0.1&p=fae3c7678ba1ccad3188a5d1399de3b7&t=1700387617.167&a=14
Frame ID: 63AA131CB129E0D892B76CAADE78A4B8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Support the White Helmets

Page URL History Show full URLs

https://whitehelmets.org/ HTTP 302
https://whitehelmets.org/en/ Page URL

Detected technologies

Braintree (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.braintreegateway\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

102
Requests

98 %
HTTPS

0 %
IPv6

18
Domains

30
Subdomains

27
IPs

3
Countries

4617 kB
Transfer

7822 kB
Size

9
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.whitehelmets.org/en/
Title: The White Helmets

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.whitehelmets.org%2Fen%2F

Search URL Search Domain Scan URL

URL: https://www.twitter.com/intent/tweet?text=Earthquake%20disaster%20in%20Syria%3A%20Give%20what%20you%20can%20to%20help%20the%20White%20Helmets%20save%20lives&url=https%3A%2F%2Fwww.whitehelmets.org%2Fen%2F

Search URL Search Domain Scan URL

URL: https://www.whitehelmets.org/ar/

Search URL Search Domain Scan URL

URL: https://www.whitehelmets.org/de/

Search URL Search Domain Scan URL

URL: https://www.whitehelmets.org/fr/

Search URL Search Domain Scan URL

URL: https://www.whitehelmets.org/ru/

Search URL Search Domain Scan URL

URL: https://www.whitehelmets.org/es/

Search URL Search Domain Scan URL

URL: https://www.whitehelmets.org/tr/

Search URL Search Domain Scan URL

URL: https://www.whitehelmets.org/en/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://www.netflix.com/gb/title/80101827
Title: <img class="" src="../assets/more/whitehelmets-ka-uk.png"> The White Helmets: an Oscar-winning Netflix documentary

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/movie/last-men-in-aleppo/id1229302767
Title: <img class="" src="../assets/more/last-men-in-aleppo-us-poster-for-web3.png"> Last Men in Aleppo A feature documentary following the efforts of the White Helmets of Aleppo. Winner of the Grand Jury Documentary prize at the Sundance Film Festival

Search URL Search Domain Scan URL

URL: https://www.cbsnews.com/news/60-minutes-volunteers-in-syria-white-helmets-scott-pelley/
Title: <img class="" src="../assets/more/c0ihmotuaaasqya.png"> Fighting for life in Syria’s vicious civil war: 60 Minutes - CBS

Search URL Search Domain Scan URL

URL: https://time.com/magazine/us/4520901/october-17th-2016-vol-188-no-15-u-s/
Title: <img class="" src="../assets/more/syria-cover.png"> White Helmets of Syria: TIME magazine

Search URL Search Domain Scan URL

URL: https://thesyriacampaign.org/privacy-policy/#cookies
Title: Find out more

Search URL Search Domain Scan URL

URL: https://www.thesyriacampaign.org/
Title: www.thesyriacampaign.org

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://whitehelmets.org/ HTTP 302
https://whitehelmets.org/en/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 87

https://assets.braintreegateway.com/data/logo.htm?m=null&s=c9fcffa4a4a44e339b3dbc20635af9d1 HTTP 301
https://ssl.kaptcha.com/logo.htm?m=null&s=c9fcffa4a4a44e339b3dbc20635af9d1

Request Chain 93

https://b.stats.paypal.com/counter.cgi?i=127.0.0.1&p=fae3c7678ba1ccad3188a5d1399de3b7&t=1700387617.167&a=14 HTTP 302
https://hnd.stats.paypal.com/counter2.cgi?i=127.0.0.1&p=fae3c7678ba1ccad3188a5d1399de3b7&t=1700387617.167&a=14

102 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
whitehelmets.org/en/
Redirect Chain

https://whitehelmets.org/
https://whitehelmets.org/en/

55 KB
14 KB

541ms
540ms

Document
text/html

18.67.111.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.111.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-111-110.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bad4d2a6261590de4274cb2449a5134b2fecffd001630a577f7dc6846bc9a4c8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

cache-control: max-age=60
content-encoding: gzip
content-type: text/html
date: Sun, 19 Nov 2023 09:53:34 GMT
etag: W/"40108246356de6f752e1f65698c8bdf2"
last-modified: Mon, 20 Feb 2023 11:45:41 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 3fb6aad2d0d4eb57ef667ceeeeca901a.cloudfront.net (CloudFront)
x-amz-cf-id: HnpibEx52jULlE-UwGpwxdBMFnNHHI8QtVatyRSEcELQpf6uGha0Rw==
x-amz-cf-pop: SYD62-P2
x-cache: RefreshHit from cloudfront

Redirect headers

age: 19010
content-length: 0
date: Sun, 19 Nov 2023 04:36:42 GMT
location: /en/
server: CloudFront
via: 1.1 3fb6aad2d0d4eb57ef667ceeeeca901a.cloudfront.net (CloudFront)
x-amz-cf-id: YO6a64z1PjUgQNouX1M9dcrlGCNXw3KIB3k29_tUK3XCu4BpGq1f-A==
x-amz-cf-pop: SYD62-P2
x-cache: Hit from cloudfront

GET
H2 200 Lekton-Regular.woff2
www.whitehelmets.org/assets/fonts/ 32 KB
32 KB 403ms
69ms Font
application/font-woff2 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/assets/fonts/Lekton-Regular.woff2
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02b6d842cb508a3de65f692c3e2a5e450e272749e914dc12d2f4eafe736d4f35

Request headers

Referer: https://whitehelmets.org/
Origin: https://whitehelmets.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
via: 1.1 c7cd0041811f30bfd9c4a00e82b6a3c8.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 32644
last-modified: Thu, 09 Nov 2017 11:19:41 GMT
server: cloudflare
etag: "2d8d9366bd9d0b3a59158b0446cc5c0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2BqGh5JVOmYAUPbXKO10WbG7WpuMB4K94lsvA6kbfQU16BmHCmTpky%2FOz3sYaFxsRH4RkToXOqnHNvZ2BwBsF9bLY%2B7VvCJPmhwNwZtSLAKHdWGPpJEFDPCf146xSpvZSAiZF9vAMg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82879119aea0aae3-SYD
x-amz-cf-id: kILg7oOkFvfa73aRQpytV9NmfvMdm3H6LfIkk-WFhlIkdgA8rG5apQ==

GET
H2 200 Lekton-Bold.woff2
www.whitehelmets.org/assets/fonts/ 32 KB
33 KB 448ms
115ms Font
application/font-woff2 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/assets/fonts/Lekton-Bold.woff2
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 326d4b529ca275d4d330a93f8dd4788f7669ced27d3f5098fb8d244511b43a95

Request headers

Referer: https://whitehelmets.org/
Origin: https://whitehelmets.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
via: 1.1 f3405208f368b682f8c8a96590ab1596.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 33072
last-modified: Thu, 09 Nov 2017 11:19:38 GMT
server: cloudflare
etag: "effc9114df9d6c6f24b411ea57f6a527"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y%2FIVGgBM8X4PqCzeai1B5mVXQMlOjd4Gu2YU%2F0b%2BPfpexH0gFe5Fe%2FMMtJeB%2FPxDn4Yn9OomGlXi3CJIYdjiYTLL6GjzDOjEL%2F93rcYz3NM7Iv5P3b3li1uBjH7zePPmBzbOFjn74w%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82879119aea3aae3-SYD
x-amz-cf-id: ilIa37CDrm_2n3OOhk0FysNq8q3kBbqy-JcHTd8BaQ8Up6xEu6GZaw==

GET
H2 200 DINPro-Bold.woff2
www.whitehelmets.org/assets/fonts/ 33 KB
34 KB 397ms
64ms Font
application/font-woff2 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/assets/fonts/DINPro-Bold.woff2
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbe15f3c5a6e997e123bdf13967cbac05a4b7aca624198dfa7bef35b57074e45

Request headers

Referer: https://whitehelmets.org/
Origin: https://whitehelmets.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
via: 1.1 dc7f2062b70b5b710c1b09d21b43f900.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 34100
last-modified: Thu, 09 Nov 2017 11:19:36 GMT
server: cloudflare
etag: "38f8f1fa5cec4a5a50b760f68e6fcae4"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UYaH%2Baufy3eK56IsQ73j1Q0aCoEK5469gXvP380CoHvXxup6oBUcNyvHn3C6u6965BEeniBVmyvNoXqaxCKyv1ZJ2qrVB9TEBur3nK1JVCiUB%2FzbXdkssONFWh0zSFWZKtKaXYBX2g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82879119aea4aae3-SYD
x-amz-cf-id: kiPkXybSvRNRxEz7aLL9VYxvgGaykbHWYi7LljelXsBf7WZGmmiHxg==

GET
H2 200 main.css
www.whitehelmets.org/ 24 KB
6 KB 346ms
13ms Stylesheet
text/css 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/main.css?v=1676893536176
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e78015366cac5532bd0fea95b947e0572d216b8f4f520aefe3bb8da938b4baf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
via: 1.1 1061288c3b70629c909a1e67ad3bde84.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
age: 35295
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 07 Feb 2023 11:47:44 GMT
server: cloudflare
etag: W/"7d70030bfdb88bb9c1fd4198e504cedf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RtB8CrwAj7JaZvmpD6oW05fEJZ%2B7ZQnFU6hbI%2FclMHJq7ZUZW7ZXl8eakZ1QbtGEZ7rbWyWSBBQSpv0FNMDcOa%2FHxkuE%2FAORWl99zW4QWYUwB89aiU8y0l97836HSH9dXgYJnhwC%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 82879119aceeaaf0-SYD
x-amz-cf-id: 3zJUj5P7LhXekvbLS4Whdxbr3P3Uz1Woom5ZX0buUWIU9dHz8BxMhA==

GET
H2 200 polyfill.min.js Show response
polyfill.io/v2/ 100 B
610 B 766ms
152ms Script
text/javascript 151.101.65.26
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v2/polyfill.min.js?features=IntersectionObserver

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.26 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 19 Nov 2023 09:53:34 GMT
age: 1624417
detected-user-agent: Chrome Mobile/119.0.0
server-timing: HIT, fastly;desc="Edge time";dur=0
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 113
referrer-policy: origin-when-cross-origin
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
normalized-user-agent: chrome/119.0.0
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 main.js Show response
www.whitehelmets.org/ 20 KB
8 KB 347ms
15ms Script
application/javascript 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/main.js?v=1676893536176
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98a70a97ed84aba85cbe65b58debb3346659eecd46441e3ffe4bba58cc0ac9ab

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
via: 1.1 72d783f19e38dd5db23a648a65feb4f2.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
age: 35295
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 07 Feb 2023 11:47:44 GMT
server: cloudflare
etag: W/"9cb79515a319f4c03cdcf3ed645a5b28"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FtKmeO7UQZPJi1rFtCBHeDYZqbQ0gDwwBo3%2FvmMVqfaHAiE6gU4T%2FCvVD8w1MxmLtvHvJAr33Qmuszbq88u%2Bkdf2HKiOHVipWmhDsD%2BfF8ghwHJtLv39NPJASd5dlFMgx1M0KkocUA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 82879119acefaaf0-SYD
x-amz-cf-id: 9BSkMgY-5LDXfODXhCoL2rF5qgTwcy34WDxj2HaH7HCsq15jfHRkmw==

GET
H2 200 / Show response
json.geoiplookup.io/ 554 B
873 B 1024ms
694ms Script
application/javascript 104.21.19.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://json.geoiplookup.io/?callback=geoIPResult

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.19.185 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Octolus

Resource Hash

9805f9e800471d8a9c0038e842ab36d3ad17e28ac46516632ef8fe4f1902e49b

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:34 GMT
content-encoding: br
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Octolus
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
server: cloudflare
vary: Accept-Encoding
x-ratelimit-remaining: 10000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fKRdvRSvRrPtBzmeomDFRZBxpfLzFFrVNOEso0COSrfxR0OK6a6HSVkmzE5yFL0FV9xSVlq5p4Ik6GqSegyHJpnMBNJrU7yZ2r4JaTpweRAo1%2BWqAJgot3LHQL8XC1fJu%2FDepXYD"}],"group":"cf-nel","max_age":604800}
x-ratelimit-limit: 10000
cf-ray: 82879119a9225c07-SYD

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 500ms
100ms Script
text/javascript 172.217.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f4.1e100.net

Software

GSE /

Resource Hash

68d6f5e6353b7af3f62a7458c547270de36d2f2a8af194f0337252513e518270

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 19 Nov 2023 09:53:33 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc05721f30773566af928190d44861a371001ff49aa9c0d5fbb8e89a29afa4cc

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 341 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0fa282024b452052041051426753ca5738cd9669023be8c9290209a01c1119e

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 header.jpg
www.whitehelmets.org/assets/ 47 KB
47 KB 16ms
15ms Image
image/jpeg 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.whitehelmets.org/assets/header.jpg
Requested by: Host: www.whitehelmets.org
URL: https://www.whitehelmets.org/main.css?v=1676893536176
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afc002a9fe8227f9c76d1dc06ff40356f147410ff85d4760ba45dab4f44a51d9

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.whitehelmets.org/main.css?v=1676893536176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
via: 1.1 df166554184adf2da43f53000107ac74.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
age: 35295
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 47682
last-modified: Thu, 16 Nov 2017 16:53:02 GMT
server: cloudflare
etag: "a3b5911c619a854e25ce511a15fb83bf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5mPFqMGjnVIwZdZpFmdCsWY7hQzdAlPQiStaBKDBG3uCgMHS6rSoQA6hb8j%2Bl0dJNnAyMP34IPF05VEcyIj45I7O%2Fbv5c4XdRA2TZK3eq2Xn7WbZawy3yoFgxWY9MT44WJEvz1Ng9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 82879119dd0eaaf0-SYD
x-amz-cf-id: NRTZw0C9sSTFUB2vfqU7HFK_Jq6e9ybRq3ZRUW2G3IOyOZptYCy5hA==

GET
DATA 200
OK truncated
/ 223 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7480346d1e765abd82613c50c6929108bd72558ada4ba9eef20372b9fc088fd7

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 play.svg
www.whitehelmets.org/assets/ 350 B
688 B 12ms
11ms Image
image/svg+xml 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.whitehelmets.org/assets/play.svg
Requested by: Host: www.whitehelmets.org
URL: https://www.whitehelmets.org/main.css?v=1676893536176
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4bf51408a1b665c4422ade935304665b3eda02962103681e5545f84201aeadf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.whitehelmets.org/main.css?v=1676893536176
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:33 GMT
via: 1.1 74ae22067fef6f6228fb9f864f22f58a.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
age: 35295
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 13 Nov 2017 16:15:40 GMT
server: cloudflare
etag: W/"65b49d2f00a5284be5525f5b5fa4f5c9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=91kxfaZnwYsqdC8RBYHSqkwLVWDpi08oZXvOiaef31YdtL%2FALnNMbIfHPAs4EtUBVucYuhWd20gLDgo0SV86I2a2EhygtmaYhnWcnQ5W9cUO6eIZtF0kQSpXAC%2FqVCK6VHkXtgzAfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=31536000
cf-ray: 82879119dd11aaf0-SYD
x-amz-cf-id: EoJEgQEYOFx2jKM0HGfqATgh_wQ4Gza89JCr-sivvYT7MjswQ_Ja5w==

GET
H2 200 peoples-million Show response
act.whitehelmets.org/act/ Frame F845 92 KB
20 KB 2044ms
2032ms Document
text/html 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://act.whitehelmets.org/act/peoples-million
Requested by: Host: www.whitehelmets.org
URL: https://www.whitehelmets.org/main.js?v=1676893536176
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ffee33dcfafe08550f9005ef75fb7b48b1684a9d091466ed6a83e1c2d4be848

Request headers

Referer: https://whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8287911c8844aaf0-SYD
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 19 Nov 2023 09:53:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9KE46mJ8%2FSMdHvH7QNFgXhoDpvgx%2BrqKoLuUVVrrfbhmSoDKJ%2FJ4qisr2nOs1yVJAlNR5OhSZMHbevQN0JgNp5LUsHOR3b2NCiVbil2YOZl7rSeld8vtq5ZmKOiA9rPEFsd9clrzyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding Cookie, Origin

GET
H2 200 / Show response
act.whitehelmets.org/progress/ 170 B
460 B 996ms
996ms Script
text/javascript 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://act.whitehelmets.org/progress/?page=peoples-million&callback=setDonorCount
Requested by: Host: www.whitehelmets.org
URL: https://www.whitehelmets.org/main.js?v=1676893536176
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 614bc5def8ae43847e1d4f76cfebe0fce20b5a559f948a416a86b552f4c1d3bf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Cookie, Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kaxBJyLHmTNGwKwCNNGSt4FgT58NrKlEwprzNmJNSRecvpMXwiS1HPYcgQPFiX%2FdQSVoFQMHHUlSdSUmrj39qwYEZy9b3DLvTyOmH0zOyPcAjGR6TAyTrJS3nk7wqOZ9rLOCHoXdqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-ray: 8287911cb876aaf0-SYD
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK 307091049 Show response
player.vimeo.com/video/ Frame 7882 19 KB
9 KB 462ms
451ms Document
text/html 162.159.128.61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://player.vimeo.com/video/307091049?autoplay=1&loop=1&muted=1&title=0&byline=0&controls=0

Requested by

Host: www.whitehelmets.org
URL: https://www.whitehelmets.org/main.js?v=1676893536176

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.159.128.61 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f212fa3d91e2228ae0d2016fd87516e197d5c09262461f07aea80033d5e7a89

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' https://.vimeocdn.com 'unsafe-eval' blob: resource: https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://cdn.kollective.app/ https://wirewax.s3.eu-west-1.amazonaws.com https://edge-assets.wirewax.com https://embedder-sdk.wirewax.com https://embedder-sdk.wirewax.tv; style-src 'self' 'unsafe-inline' https://.vimeocdn.com https://fonts.googleapis.com https://edge-assets.wirewax.com https://edge-player5.wirewax.com; connect-src 'self' ws: wss: https://vimeo.com https://api.vimeo.com https://csi.gstatic.com https://player-telemetry.vimeo.com https://.akamaized.net https://.akamaized-staging.net https://.vimeocdn.com https://drm-gke.vhx.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://.dna-delivery.com https://.kollective.app https://.kollective.app:31015 https://.kollectivecd.com https://.hivestreaming.com https://mimir.cloud.vimeo.com https://.wirewax.com https://.wirewax.tv https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com https://sqs.eu-west-1.amazonaws.com https://s3-eu-west-1.amazonaws.com https://cognito-identity.us-east-1.amazonaws.com https://cognito-identity.eu-west-1.amazonaws.com; font-src data: https://edge-assets.wirewax.com https://branding.cdn.magisto.com https://fonts.gstatic.com https://player.vimeo.com; img-src 'self' data: https://player.vimeo.com https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://i.vimeocdn.com https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://edge-assets.wirewax.com https://maps.googleapis.com android-webview-video-poster:; object-src 'self' https://.vimeocdn.com https://.akamaized.net https://.akamaized-staging.net; media-src 'self' blob: https://.vimeocdn.com https://.akamaized.net https://.akamaized-staging.net https://.gvt1.com https://live-api.cloud.vimeo.com; frame-src 'self' https://
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Age: 0
CF-Cache-Status: DYNAMIC
CF-RAY: 8287911cdf405737-SYD
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sun, 19 Nov 2023 09:53:34 GMT
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
Via: 1.1 varnish
X-Cache: MISS
X-Cache-Hits: 0
X-Served-By: cache-syd10147-SYD
X-Timer: S1700387614.226698,VS0,VE432
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' https://*.vimeocdn.com 'unsafe-eval' blob: resource: https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://cdn.kollective.app/ https://wirewax.s3.eu-west-1.amazonaws.com https://edge-assets.wirewax.com https://embedder-sdk.wirewax.com https://embedder-sdk.wirewax.tv; style-src 'self' 'unsafe-inline' https://*.vimeocdn.com https://fonts.googleapis.com https://edge-assets.wirewax.com https://edge-player5.wirewax.com; connect-src 'self' ws: wss: https://vimeo.com https://api.vimeo.com https://csi.gstatic.com https://player-telemetry.vimeo.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://drm-gke.vhx.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://*.dna-delivery.com https://*.kollective.app https://*.kollective.app:31015 https://*.kollectivecd.com https://*.hivestreaming.com https://mimir.cloud.vimeo.com https://*.wirewax.com https://*.wirewax.tv https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com https://sqs.eu-west-1.amazonaws.com https://s3-eu-west-1.amazonaws.com https://cognito-identity.us-east-1.amazonaws.com https://cognito-identity.eu-west-1.amazonaws.com; font-src data: https://edge-assets.wirewax.com https://branding.cdn.magisto.com https://fonts.gstatic.com https://player.vimeo.com; img-src 'self' data: https://player.vimeo.com https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://*.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://i.vimeocdn.com https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://edge-assets.wirewax.com https://maps.googleapis.com android-webview-video-poster:; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com; frame-src 'self' https://*
expires: Fri, 15 Dec 1985 19:30:00 GMT
link: <https://fresnel.vimeocdn.com>; rel=preconnect; crossorigin <https://i.vimeocdn.com>; rel=preconnect; crossorigin <https://f.vimeocdn.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-backend-server: player-backend-edge-entry
x-bapp-server: player-backend-757986bcdb-p5qwg
x-content-type-options: nosniff
x-host: player-backend-757986bcdb-p5qwg
x-player-backend: g
x-xss-protection: 1; mode=block

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 267ms
4ms Script
application/x-javascript 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-syd2.fbcdn.net

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 19 Nov 2023 09:53:34 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: 6u8ipTLeCdiKlqvh2TQTQEb9934NeKOs2GQjDDQx3oafcdK9k5MJbZSnMDXeaauhGlLgnehirCDUatyyWIYcxw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ 465 KB
187 KB 407ms
3ms Script
text/javascript 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://whitehelmets.org/
Origin: https://whitehelmets.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 05:36:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15423
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190682
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 18 Nov 2024 05:36:31 GMT

GET
H2 200 earthquake-large.jpg
www.whitehelmets.org/assets/sections/ 128 KB
129 KB 17ms
17ms Image
image/jpeg 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.whitehelmets.org/assets/sections/earthquake-large.jpg
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05287a5383171779372727d2555093118013512b7dc0ea98c0565032c779af7e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:34 GMT
via: 1.1 f993a09ee51fef62e3d92f6802c130d4.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
age: 35296
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 131216
last-modified: Tue, 07 Feb 2023 12:21:36 GMT
server: cloudflare
etag: "1323b159e375dfabc3e06a5c89c91f83"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p4qOHGnof9TNONlSI17MFzsikrIMNxZyLXFR3sf3KTJiZaVix4TbN7ARMhHaEZ20n79Eds9jDS%2BQ0H%2Be7eIQRlVbqwZUYD3q2e0k3mSM9dPZThPqv8daeINLI7q4Byxr%2BNHcxJrJJw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8287911cc883aaf0-SYD
x-amz-cf-id: moITvB1NmlUHqg8ic6ixsdCjiz4Pa8QZzCIFoHWDgvjVeFCCxvBj8A==

GET
H2 200 802688627157563 Show response
connect.facebook.net/signals/config/ 133 KB
35 KB 261ms
260ms Script
application/x-javascript 157.240.8.23
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/802688627157563?v=2.9.138&r=stable&domain=whitehelmets.org

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.23 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-syd2.fbcdn.net

Software

Resource Hash

c09fd44df7c736d0517bc2d49d377647727fefdcb33a06a262fcbaaf66f1bec2

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 19 Nov 2023 09:53:34 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: r9SplDche4/sEcf1gDOoPgsMK30Rh6iZFOGSMTt5jUa/BPOb+dspVJTJY80etb4rTSbSjAfBNDnjSQ2g34dZZw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 player.module.js Show response
f.vimeocdn.com/p/4.26.4/js/ Frame 7882 541 KB
131 KB 20ms
7ms Script
application/javascript 151.101.30.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://f.vimeocdn.com/p/4.26.4/js/player.module.js
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/307091049?autoplay=1&loop=1&muted=1&title=0&byline=0&controls=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.30.109 Sydney, Australia, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e2e44f76517d4d93f25ab4a0ccc32a60919daaa1755819e20c7e8426c5a6b19d

Request headers

Referer: https://player.vimeo.com/
Origin: https://player.vimeo.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-served-by: cache-iad-kcgs7200087-IAD, cache-syd10120-SYD
date: Sun, 19 Nov 2023 09:53:34 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
age: 227857
x-timer: S1700387615.683123,VS0,VE0
vary: Accept-Encoding,x-http-method-override
x-cache: HIT, HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 133896
x-cache-hits: 60, 51448

GET
H2 200 vendor.module.js Show response
f.vimeocdn.com/p/4.26.4/js/ Frame 7882 410 KB
99 KB 15ms
2ms Script
application/javascript 151.101.30.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/307091049?autoplay=1&loop=1&muted=1&title=0&byline=0&controls=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.30.109 Sydney, Australia, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d0124eb088ecd82db8d6be8b44df1eee2971c2b3787678694d97936efdcd58e5

Request headers

Referer: https://player.vimeo.com/
Origin: https://player.vimeo.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-served-by: cache-iad-kcgs7200030-IAD, cache-syd10120-SYD
date: Sun, 19 Nov 2023 09:53:34 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
age: 227857
x-timer: S1700387615.682722,VS0,VE0
vary: Accept-Encoding,x-http-method-override
x-cache: HIT, HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 101117
x-cache-hits: 63, 51209

GET
H2 200 player.css
f.vimeocdn.com/p/4.26.4/css/ Frame 7882 206 KB
21 KB 15ms
2ms Stylesheet
text/css 151.101.30.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://f.vimeocdn.com/p/4.26.4/css/player.css
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/307091049?autoplay=1&loop=1&muted=1&title=0&byline=0&controls=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.30.109 Sydney, Australia, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5530648342580582a72e5ef8a040bd532c230fb5ce88c4528285e9d24ba2d4f9

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-served-by: cache-iad-kjyo7100167-IAD, cache-syd10140-SYD
date: Sun, 19 Nov 2023 09:53:34 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
age: 227858
x-timer: S1700387615.682427,VS0,VE0
vary: Accept-Encoding,x-http-method-override
x-cache: HIT, HIT
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 21736
x-cache-hits: 66, 52312

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame C1BF 60 KB
35 KB 117ms
117ms Document
text/html 172.217.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA&co=aHR0cHM6Ly93aGl0ZWhlbG1ldHMub3JnOjQ0Mw..&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=invisible&cb=z617ltkm5b2n

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f4.1e100.net

Software

GSE /

Resource Hash

4c99c23af5f0dbd91a488c3d279c89a74cc54169c4231ccf6e99a7b31b015948

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2k5cKn-WT9RpuJgZup5nWA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-2k5cKn-WT9RpuJgZup5nWA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 19 Nov 2023 09:53:34 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 vuid.min.js Show response
f.vimeocdn.com/js_opt/modules/utils/ Frame 7882 2 KB
1 KB 2ms
2ms Script
application/javascript 151.101.30.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://f.vimeocdn.com/js_opt/modules/utils/vuid.min.js
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/307091049?autoplay=1&loop=1&muted=1&title=0&byline=0&controls=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.30.109 Sydney, Australia, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c051b8b5eb2a0aef699780f15a449491868faa6f8b39b684b5ae8f64f345b94a

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-served-by: cache-iad-kiad7000106-IAD, cache-syd10140-SYD
date: Sun, 19 Nov 2023 09:53:34 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 2351227
x-timer: S1700387615.772369,VS0,VE0
vary: Accept-Encoding,x-http-method-override
x-cache: HIT, HIT
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
content-length: 985
x-cache-hits: 3, 416443

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 7882 4 KB
2 KB 534ms
131ms Script
text/javascript 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1

Requested by

Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 19 Nov 2023 09:53:35 GMT

GET
H2 200 746965914-02e8f2f4b6c6d948591fe4b84de704085de66121c88d0f20379f51115760eee7-d
i.vimeocdn.com/video/ Frame 7882 45 KB
45 KB 557ms
241ms Image
image/avif 151.101.64.217
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.vimeocdn.com/video/746965914-02e8f2f4b6c6d948591fe4b84de704085de66121c88d0f20379f51115760eee7-d?mw=1600&mh=900
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.64.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 24d5316709657938c4080ec196a0ee9c433eea49adb82267306690d64dbc154e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
via: vvarnish, 1.1 varnish, 1.1 varnish
age: 831086
x-viewmaster-lossless-format: automatic
x-cache: miss, HIT, MISS
x-backend-server: varnish
content-length: 45682
viewmaster-server: viewmaster-glb-prod
x-served-by: cache-dfw-kdfw8210115-DFW, cache-bfi-krnt7300043-BFI
x-timer: S1700387615.184697,VS0,VE89
etag: a62811bd2c98d869602a72e6ca7c6def
access-control-max-age: 86400
vary: Accept
content-type: image/avif
access-control-allow-origin: *
access-control-expose-headers: X-Viewmaster-Status
cache-control: public, max-age=2592000
accept-ranges: bytes
x-cache-hits: 10, 0

POST
H2 200 player-stats
fresnel.vimeocdn.com/add/ Frame 7882 0
41 B 274ms
265ms Ping
text/plain 34.120.202.204
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fresnel.vimeocdn.com/add/player-stats?beacon=1&session-id=67186fb15e98e618cddbae3008ac84443df48e411700387614
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.202.204 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 204.202.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://player.vimeo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://player.vimeo.com
date: Sun, 19 Nov 2023 09:53:34 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 player-stats
fresnel.vimeocdn.com/add/ Frame 7882 0
41 B 245ms
245ms Ping
text/plain 34.120.202.204
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fresnel.vimeocdn.com/add/player-stats?beacon=1&session-id=67186fb15e98e618cddbae3008ac84443df48e411700387614
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.202.204 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 204.202.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://player.vimeo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://player.vimeo.com
date: Sun, 19 Nov 2023 09:53:34 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 play
player-telemetry.vimeo.com/player-events/log/ Frame 7882 0
163 B 242ms
240ms Ping
text/html 34.120.202.204
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://player-telemetry.vimeo.com/player-events/log/play
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.202.204 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 204.202.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://player.vimeo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://player.vimeo.com
date: Sun, 19 Nov 2023 09:53:34 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK master.json Show response
11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434... Frame 7882 7 KB
2 KB 538ms
145ms XHR
application/json 149.135.80.248
ASN-TELSTRA Telst...

General

Check archive.org

Show headers Download Go to

Full URL: https://11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434902/sep/video/7f8b888b,a7b9bcf4,fefe1669/master.json?base64_init=1
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 149.135.80.248 , Australia, ASN1221 (ASN-TELSTRA Telstra Corporation Ltd, AU),
Reverse DNS
Software: /
Resource Hash: 0de1a3718b20c88628309662b19b373a826b17ed49b53436ab86476fc986fb9b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sun, 19 Nov 2023 09:53:35 GMT
Content-Encoding: gzip
X-VIM-CACHEBC: EP:H11,E:m,PE:h
origin-retrieved-hour: 1666800000
Connection: keep-alive
Akamai-Mon-Iucid-Del: 877678
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 1677
AK-REFERENCE-ID: 0.f4508795.1700387615.51092c7
ETag: W/"523048e7f5ca9550505f2d8ea6d587e7"
Access-Control-Max-Age: 86400
Vary: Accept-Encoding
Aka-c-hit: cache-hit
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Akamai-Edge-IP, X-VIM-CACHEBC, X-Akamai-Request-ID, AK-REFERENCE-ID
Cache-Control: max-age=31500635
Akamai-Edge-IP: 149.135.80.248
timing-allow-origin: *
Access-Control-Allow-Headers: Content-Type, Accept-Encoding, Range, X-OTT-Agent,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session

GET
H2 200 defaults-blue_60x60
i.vimeocdn.com/portrait/ Frame 7882 792 B
1 KB 408ms
154ms Image
image/avif 151.101.64.217
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.vimeocdn.com/portrait/defaults-blue_60x60
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.64.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3b3d7294affaebdf8ff68b34cec2e955f5bb2cb2a171ef12008822460d366c84

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
via: vvarnish, 1.1 varnish, 1.1 varnish
age: 928544
x-viewmaster-lossless-format: automatic
x-cache: miss, HIT, HIT
x-backend-server: varnish
content-length: 792
viewmaster-server: viewmaster-glb-prod
x-served-by: cache-dfw-kdfw8210123-DFW, cache-bfi-krnt7300043-BFI
x-timer: S1700387615.185731,VS0,VE0
etag: a0c85b3b0815320e4994fdce0a72f3c9
access-control-max-age: 86400
vary: Accept
content-type: image/avif
access-control-allow-origin: *
access-control-expose-headers: X-Viewmaster-Status
cache-control: public, max-age=2592000
accept-ranges: bytes
x-cache-hits: 18, 4617

GET
H2 200 746965914-02e8f2f4b6c6d948591fe4b84de704085de66121c88d0f20379f51115760eee7-d
i.vimeocdn.com/video/ Frame 7882 2 KB
2 KB 410ms
156ms Image
image/avif 151.101.64.217
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.vimeocdn.com/video/746965914-02e8f2f4b6c6d948591fe4b84de704085de66121c88d0f20379f51115760eee7-d?mw=80&q=85
Requested by: Host: whitehelmets.org
URL: https://whitehelmets.org/en/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.64.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c4e9d79a8df1baad78889d586cc2995a8483a27a0259b8f14d16e837f53004b7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
via: vvarnish, 1.1 varnish, 1.1 varnish
age: 356773
x-viewmaster-lossless-format: automatic
x-cache: miss, HIT, HIT
x-backend-server: varnish
content-length: 1671
viewmaster-server: viewmaster-us-central1-497x
x-served-by: cache-dfw-kdal2120082-DFW, cache-bfi-krnt7300043-BFI
x-timer: S1700387615.185710,VS0,VE1
etag: 0bd6b1d7541c989874333d461b702479
access-control-max-age: 86400
vary: Accept
content-type: image/avif
access-control-allow-origin: *
access-control-expose-headers: X-Viewmaster-Status
cache-control: public, max-age=2592000
accept-ranges: bytes
x-cache-hits: 97, 1

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame C1BF 55 KB
25 KB 331ms
2ms Stylesheet
text/css 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA&co=aHR0cHM6Ly93aGl0ZWhlbG1ldHMub3JnOjQ0Mw..&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=invisible&cb=z617ltkm5b2n

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 05:36:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15425
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 18 Nov 2024 05:36:30 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame C1BF 465 KB
186 KB 334ms
6ms Script
text/javascript 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 05:36:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15424
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190682
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 18 Nov 2024 05:36:31 GMT

POST
H/1.1 204
No Content vuid
vimeo.com/ablincoln/ Frame 7882 0
919 B 378ms
369ms Ping
text/plain 162.159.138.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://vimeo.com/ablincoln/vuid?pid=67186fb15e98e618cddbae3008ac84443df48e411700387614

Requested by

Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/js_opt/modules/utils/vuid.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.159.138.60 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Sat, 18 Nov 2023 21:53:35 GMT
Date: Sun, 19 Nov 2023 09:53:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Via: 1.1 varnish, 1.1 varnish
content-security-policy-report-only: default-src https: data: blob: wss: 'unsafe-inline' 'unsafe-eval'; report-uri /_csp
X-Cache: MISS, MISS
Connection: keep-alive
x-xss-protection: 1; mode=block
X-Served-By: cache-iad-kcgs7200123-IAD, cache-syd10179-SYD
x-ua-compatible: IE=edge
x-vimeo-device: d
Server: cloudflare
X-Timer: S1700387615.907793,VS0,VE351
x-backend-proxy: webproxy18
x-frame-options: sameorigin
Vary: User-Agent,x-http-method-override
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-bapp-server: pweb-5b4f5c6b46-k5wfr
Accept-Ranges: bytes
CF-RAY: 82879121189baac3-SYD
X-Cache-Hits: 0, 0

GET
H2 200 /
www.facebook.com/tr/ 0
186 B 328ms
3ms Image
text/plain 157.240.8.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=802688627157563&ev=PageView&dl=https%3A%2F%2Fwhitehelmets.org%2Fen%2F&rl=&if=false&ts=1700387614889&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1700387614888.2043317897&ler=empty&it=1700387614545&coo=false&rqm=GET

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.8.35 Sydney, Australia, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-syd2.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 19 Nov 2023 09:53:35 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 webworker.js
www.google.com/recaptcha/api2/ Frame C1BF 102 B
211 B 102ms
102ms Other
text/javascript 172.217.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f4.1e100.net

Software

GSE /

Resource Hash

b62f36160407c81030404ab242125afd42fa0da6626ef11e5f406dda12acf144

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA&co=aHR0cHM6Ly93aGl0ZWhlbG1ldHMub3JnOjQ0Mw..&hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&size=invisible&cb=z617ltkm5b2n
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 19 Nov 2023 09:53:35 GMT

GET
H2 200 cast_framework.js Show response
www.gstatic.com/cast/sdk/libs/sender/1.0/ Frame 7882 35 KB
12 KB 264ms
264ms Script
text/javascript 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cast/sdk/libs/sender/1.0/cast_framework.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

a2bdd8cb01353d4ed2a9ab4c7d7c263225f6908aa875614d015a2f39956d9d73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12197
x-xss-protection: 0
last-modified: Mon, 14 Nov 2022 23:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="chrome-dongle"
vary: Accept-Encoding
report-to: {"group":"chrome-dongle","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chrome-dongle"}]}
content-type: text/javascript
cache-control: private, max-age=0
accept-ranges: bytes
expires: Sun, 19 Nov 2023 09:53:35 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/119/ Frame 7882 50 KB
15 KB 3ms
2ms Script
text/javascript 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/119/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

f4d5deb4709cebcb8d869180a1db81fab7c54f99dc2e72dab8b3db15eb76e660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 23:57:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35751
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 02 Oct 2023 15:08:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Sun, 19 Nov 2023 23:57:44 GMT

POST
H2 200 player-stats
fresnel.vimeocdn.com/add/ Frame 7882 0
41 B 232ms
230ms Ping
text/plain 34.120.202.204
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fresnel.vimeocdn.com/add/player-stats?beacon=1&session-id=67186fb15e98e618cddbae3008ac84443df48e411700387614
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.202.204 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 204.202.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://player.vimeo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://player.vimeo.com
date: Sun, 19 Nov 2023 09:53:35 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK segment-1.m4s Show response
11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434... Frame 7882 102 KB
102 KB 8ms
8ms XHR
video/mp4 149.135.80.248
ASN-TELSTRA Telst...

General

Check archive.org

Show headers Download Go to

Full URL: https://11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434902/sep/audio/7f8b888b/chop/segment-1.m4s?r=dXM%3D
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 149.135.80.248 , Australia, ASN1221 (ASN-TELSTRA Telstra Corporation Ltd, AU),
Reverse DNS
Software: /
Resource Hash: 65cfe195f066427deb40f4b37fec1474e3df7b39197e323f80ad0b7142c5fd30

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sun, 19 Nov 2023 09:53:35 GMT
X-VIM-CACHEBC: EP:H11,E:m,PE:h
using-starlord: true
origin-retrieved-hour: 1674316800
Connection: keep-alive
Akamai-Mon-Iucid-Del: 877678
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 103951
AK-REFERENCE-ID: 0.f4508795.1700387615.51092e7
accept-range: bytes
ETag: "7a50ac442eef53ed0aa75c08177610fa"
Access-Control-Max-Age: 86400
Aka-c-hit: cache-hit
Content-Type: video/mp4
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Akamai-Edge-IP, X-VIM-CACHEBC, X-Akamai-Request-ID, AK-REFERENCE-ID
Cache-Control: max-age=31236116
Akamai-Edge-IP: 149.135.80.248
timing-allow-origin: *
Access-Control-Allow-Headers: Content-Type, Accept-Encoding, Range, X-OTT-Agent,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session

GET
H/1.1 200
OK segment-1.m4s Show response
11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434... Frame 7882 402 KB
402 KB 9ms
9ms XHR
video/mp4 149.135.80.248
ASN-TELSTRA Telst...

General

Check archive.org

Show headers Download Go to

Full URL: https://11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434902/sep/video/a7b9bcf4/chop/segment-1.m4s?r=dXM%3D
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 149.135.80.248 , Australia, ASN1221 (ASN-TELSTRA Telstra Corporation Ltd, AU),
Reverse DNS
Software: /
Resource Hash: 3f474a1dcfc40843d33b62b335d7d6108edb2898e76c45d65509a173da7a7f56

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sun, 19 Nov 2023 09:53:35 GMT
X-VIM-CACHEBC: EP:H11,E:m,PE:h
using-starlord: true
origin-retrieved-hour: 1657666800
Connection: keep-alive
Akamai-Mon-Iucid-Del: 877678
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 411144
AK-REFERENCE-ID: 0.f4508795.1700387615.51092f0
Access-Control-Max-Age: 86400
Aka-c-hit: cache-hit
Content-Type: video/mp4
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Akamai-Edge-IP, X-VIM-CACHEBC, X-Akamai-Request-ID, AK-REFERENCE-ID
Cache-Control: max-age=30089539
Akamai-Edge-IP: 149.135.80.248
timing-allow-origin: *
Access-Control-Allow-Headers: Content-Type, Accept-Encoding, Range, X-OTT-Agent,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session

GET
H/1.1 200
OK segment-1.m4s Show response
11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434... Frame 7882 2 MB
2 MB 1340ms
1340ms XHR
video/mp4 149.135.80.248
ASN-TELSTRA Telst...

General

Check archive.org

Show headers Download Go to

Full URL: https://11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434902/sep/video/7f8b888b/chop/segment-1.m4s?r=dXM%3D
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 149.135.80.248 , Australia, ASN1221 (ASN-TELSTRA Telstra Corporation Ltd, AU),
Reverse DNS
Software: /
Resource Hash: 03a5ffdf940b3ec5272015f9970e72d94fa6f9ba46d300dcdf98570ad5814a44

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sun, 19 Nov 2023 09:53:36 GMT
X-VIM-CACHEBC: EP:H11,E:m,TD0:m,CW:h
using-starlord: true
origin-retrieved-hour: 1657666800
Connection: keep-alive
Akamai-Mon-Iucid-Del: 877678
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 2032729
AK-REFERENCE-ID: 0.f4508795.1700387616.51092f4
Access-Control-Max-Age: 86400
Aka-c-hit: cache-hit
Content-Type: video/mp4
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Akamai-Edge-IP, X-VIM-CACHEBC, X-Akamai-Request-ID, AK-REFERENCE-ID
Cache-Control: max-age=29741909
Akamai-Edge-IP: 149.135.80.248
timing-allow-origin: *
Access-Control-Allow-Headers: Content-Type, Accept-Encoding, Range, X-OTT-Agent,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session

GET
H2 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 2E18 7 KB
1 KB 107ms
107ms Document
text/html 172.217.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f4.1e100.net

Software

GSE /

Resource Hash

4225e213f96d4a95b4909d870bdac71dda982d995b01c7bc6773947da04d0abd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--i4XlX_wnrc70So3e-LGEw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce--i4XlX_wnrc70So3e-LGEw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 19 Nov 2023 09:53:35 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 2E18 55 KB
24 KB 3ms
2ms Stylesheet
text/css 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 05:36:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15425
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 18 Nov 2024 05:36:30 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ Frame 2E18 465 KB
186 KB 4ms
3ms Script
text/javascript 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 05:36:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15424
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190682
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 18 Nov 2024 05:36:31 GMT

POST
H2 200 reload Show response
www.google.com/recaptcha/api2/ Frame 2E18 42 KB
25 KB 156ms
156ms XHR
application/json 172.217.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f4.1e100.net

Software

GSE /

Resource Hash

52553960de44fbcf000fb518d11e7370e713c5792f4b196d2c49b0c055b3be60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 19 Nov 2023 09:53:35 GMT

GET
H2 200 refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 2E18 600 B
739 B 5ms
3ms Image
image/png 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/refresh_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 133396
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Fri, 24 Nov 2023 20:50:19 GMT

GET
H2 200 audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 2E18 530 B
621 B 6ms
5ms Image
image/png 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/audio_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 06:30:10 GMT
x-content-type-options: nosniff
age: 12205
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 530
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Sun, 26 Nov 2023 06:30:10 GMT

GET
H2 200 info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 2E18 665 B
756 B 5ms
4ms Image
image/png 142.250.66.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/info_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f3.1e100.net

Software

sffe /

Resource Hash

55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 22:59:51 GMT
x-content-type-options: nosniff
age: 39224
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 665
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Sat, 25 Nov 2023 22:59:51 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2E18 15 KB
15 KB 410ms
4ms Font
font/woff2 142.251.221.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:11:39 GMT
x-content-type-options: nosniff
age: 132117
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 21:11:39 GMT

GET
H2 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2E18 15 KB
15 KB 410ms
5ms Font
font/woff2 142.251.221.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f3.1e100.net

Software

sffe /

Resource Hash

c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 23:38:58 GMT
x-content-type-options: nosniff
age: 468878
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15340
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Nov 2024 23:38:58 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2E18 15 KB
16 KB 408ms
3ms Font
font/woff2 142.251.221.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f3.1e100.net

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:16:56 GMT
x-content-type-options: nosniff
age: 211000
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Nov 2024 23:16:56 GMT

GET
H2 200 payload
www.google.com/recaptcha/api2/ Frame 2E18 28 KB
28 KB 105ms
104ms Image
image/jpeg 172.217.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6bZ19eswc9eVzmII-XADOo2T_RzM5fvfudgIvLJ7NyyhVyXYvOAmVZMcRww_emrrttPuddkGxoVImSRimnG6pOgBfR6frVyxFaY_29EcPsZvD0Ulr5wJgyJpZh4ZFv5uKw7KRSyxwFvvWSXvfTKgoYIq7LmcydruSzj9wRW26Jc7eDBlQXwxBv1S5QFnyrxMhCrVNl8o0I2ondrzvz00auVNwz0w&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA

Requested by

Host: whitehelmets.org
URL: https://whitehelmets.org/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f4.1e100.net

Software

GSE /

Resource Hash

d65290bf09d8374d9ba3088d35229c9e46774fefc6df2a12f3ab9c34be2c30a3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-QbJqHfGOUB8nuVRLvzFLVed&k=6LetQiEUAAAAAC5mkK_YsHGJjLE7vxjMTIaNn3MA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:35 GMT
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: private, max-age=30
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 19 Nov 2023 09:53:35 GMT

GET
H2 200 actionkit.css
act.whitehelmets.org/media/modern/ Frame F845 73 KB
16 KB 18ms
15ms Stylesheet
text/css 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://act.whitehelmets.org/media/modern/actionkit.css?1=22
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90b5d41015da1f3eb25868d6a4610020415c0c9145d5412d174719d3ab5515d1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/act/peoples-million
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 22:35:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 35295
etag: W/"655547c2-1251a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IUwsx%2B1OhAQcddxFORGpYuKQ0uY3HbaxQs%2BZfIZQfEbqMGpGGKh4v8S1H4qeyy8je6nlrNjx3nCeT1sRyEZnRYmuBNGt8R%2FV2%2BPrm1R6wfSoRQXUsXlu9MOwutKfc15%2Fuw2bI%2Fipsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 82879129592eaaf0-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 20 Nov 2023 00:05:21 GMT

GET
H2 200 style.css
d3rta84bycnbpe.cloudfront.net/actionkit-embed/css/ Frame F845 0
351 B 330ms
12ms Stylesheet
text/css 18.67.93.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3rta84bycnbpe.cloudfront.net/actionkit-embed/css/style.css?cache=1619079484188
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-93-15.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-meta-cache-control: max-age=604800
date: Sun, 19 Nov 2023 00:05:22 GMT
via: 1.1 a6b70b5c031397eba9646ba0eedbdb86.cloudfront.net (CloudFront)
last-modified: Thu, 24 Jan 2019 11:31:41 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P1
age: 35295
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 0
x-amz-cf-id: thP9SA9VJlpIZrg6ecE76F29j94v8fgyieeKmaHWxOBDuEP_6TZ41g==

GET
H2 200 whitehelmets.css
d3rta84bycnbpe.cloudfront.net/actionkit-embed/css/ Frame F845 8 KB
2 KB 324ms
6ms Stylesheet
text/css 18.67.93.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3rta84bycnbpe.cloudfront.net/actionkit-embed/css/whitehelmets.css?cache=1619079484188
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-93-15.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d207cfe4c46f2ef0a7a3918729441be01056b904a854038f468251cd62183eb4

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-meta-cache-control: max-age=604800
content-encoding: gzip
via: 1.1 a6b70b5c031397eba9646ba0eedbdb86.cloudfront.net (CloudFront)
date: Sun, 19 Nov 2023 00:05:22 GMT
last-modified: Fri, 10 Apr 2020 09:12:49 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P1
age: 35294
etag: W/"cfdd655a22f87772c2e91a856dbe4dea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: ZqwowPF7yhR9u_xD8gT_-T4RSlyIjPv3QUpB6VYuIcJ-dfTVxUoOLw==

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ Frame F845 91 KB
33 KB 358ms
3ms Script
text/javascript 172.217.167.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Requested by

Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s06-in-f10.1e100.net

Software

sffe /

Resource Hash

61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 21:34:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 389946
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33593
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Nov 2024 21:34:30 GMT

GET
H2 200 actionkit.js Show response
act.whitehelmets.org/resources/ Frame F845 98 KB
31 KB 19ms
17ms Script
application/javascript 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://act.whitehelmets.org/resources/actionkit.js
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 531c8e98e6cf7f42627d226e3644a39dddda7ae836544d5a4079c578237fccb1

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/act/peoples-million
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 22:35:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 35295
etag: W/"655547c2-1898c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wWCnqPQVAjzOMYE%2BsvQbW%2FLh%2Fb4kLkJTC%2BNeeWYAZr6DtXGM8KFmzhAbRgs7uoXUnusOcpkQUEjfsVGJTDawGgBh8kz1DJnffq%2BrCwccwuirC%2FfAjGmG9htd5GaPlr5MvlczWmVg4w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 82879129592faaf0-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 20 Nov 2023 00:05:21 GMT

GET
H2 200 client.min.js Show response
js.braintreegateway.com/web/3.69.0/js/ Frame F845 41 KB
13 KB 12ms
3ms Script
application/javascript 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://js.braintreegateway.com/web/3.69.0/js/client.min.js

Requested by

Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E794) /

Resource Hash

0c7426dab3210a5bf3c4b4924bc678c0001f4765137ba482ac8fc07fb4f32001

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-encoding: gzip
date: Sun, 19 Nov 2023 09:53:36 GMT
last-modified: Wed, 15 Nov 2023 16:31:43 GMT
server: ECAcc (nwa/E794)
strict-transport-security: max-age=63072000; includeSubDomains; preload
etag: "6554f26f-a4b4+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 12581
expires: Mon, 20 Nov 2023 09:53:36 GMT

GET
H2 200 three-d-secure.min.js Show response
js.braintreegateway.com/web/3.69.0/js/ Frame F845 58 KB
15 KB 13ms
4ms Script
application/javascript 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://js.braintreegateway.com/web/3.69.0/js/three-d-secure.min.js

Requested by

Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E79A) /

Resource Hash

a68f878b0525f6d9ab5cad197a55bf60f8610e4bd0f9867dca3daaf25e99bdfb

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-encoding: gzip
date: Sun, 19 Nov 2023 09:53:36 GMT
last-modified: Wed, 15 Nov 2023 16:31:45 GMT
server: ECAcc (nwa/E79A)
strict-transport-security: max-age=63072000; includeSubDomains; preload
etag: "6554f271-e92a+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 15539
expires: Mon, 20 Nov 2023 09:53:36 GMT

GET
H2 200 hosted-fields.min.js Show response
js.braintreegateway.com/web/3.69.0/js/ Frame F845 61 KB
17 KB 13ms
4ms Script
application/javascript 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://js.braintreegateway.com/web/3.69.0/js/hosted-fields.min.js

Requested by

Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E7AF) /

Resource Hash

38e7c1f2b12b0503566f214cfcde7353ab180deab7a4ec39d539c0b4623bb761

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-encoding: gzip
date: Sun, 19 Nov 2023 09:53:36 GMT
last-modified: Wed, 15 Nov 2023 16:31:43 GMT
server: ECAcc (nwa/E7AF)
strict-transport-security: max-age=63072000; includeSubDomains; preload
etag: "6554f26f-f591+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 17329
expires: Mon, 20 Nov 2023 09:53:36 GMT

GET
H2 200 data-collector.min.js Show response
js.braintreegateway.com/web/3.69.0/js/ Frame F845 31 KB
10 KB 15ms
6ms Script
application/javascript 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://js.braintreegateway.com/web/3.69.0/js/data-collector.min.js

Requested by

Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E7B0) /

Resource Hash

2f3793dd173f59b85a16571e416ccf588b2034dded889a21b1a1251a1ada52b8

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-encoding: gzip
date: Sun, 19 Nov 2023 09:53:36 GMT
last-modified: Wed, 15 Nov 2023 16:31:43 GMT
server: ECAcc (nwa/E7B0)
strict-transport-security: max-age=63072000; includeSubDomains; preload
etag: "6554f26f-7bae+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 10532
expires: Mon, 20 Nov 2023 09:53:36 GMT

GET
H2 200 us-bank-account.min.js Show response
js.braintreegateway.com/web/3.69.0/js/ Frame F845 24 KB
7 KB 16ms
7ms Script
application/javascript 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://js.braintreegateway.com/web/3.69.0/js/us-bank-account.min.js

Requested by

Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E7BF) /

Resource Hash

84b343633e2b0f92ed854df2f6c90c3b92c01f9e52f596e12abc4bbeec8afaac

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-encoding: gzip
date: Sun, 19 Nov 2023 09:53:36 GMT
last-modified: Wed, 15 Nov 2023 16:31:43 GMT
server: ECAcc (nwa/E7BF)
strict-transport-security: max-age=63072000; includeSubDomains; preload
etag: "6554f26f-5e10+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 7193
expires: Mon, 20 Nov 2023 09:53:36 GMT

GET
H2 200 ak_braintree_vzero.js Show response
act.whitehelmets.org/resources/ Frame F845 16 KB
4 KB 13ms
12ms Script
application/javascript 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://act.whitehelmets.org/resources/ak_braintree_vzero.js
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0e6490ff469608c304fd1b538dc48514df06c9938cb838a7839f61768aa5baf

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/act/peoples-million
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 22:35:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 35295
etag: W/"655547c2-4065"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Npr%2BQVLsPU858oTzLS9G7%2FavWEwDTAr6dPqveeyXX8%2BArR1lTEUIZgBu4P3uzoAcPI16CtXAOO65%2F5LKD3G6tpkmxTiqYpSGjDQRUJb%2FbYc%2B3q83lEhSakf06LPIp6pCkJmETT3saA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 828791295931aaf0-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 20 Nov 2023 00:05:21 GMT

GET
H2 200 paypal-logo-1.svg
act.whitehelmets.org/media/modern/ Frame F845 15 KB
5 KB 14ms
13ms Image
image/svg+xml 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://act.whitehelmets.org/media/modern/paypal-logo-1.svg
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7de5756f03a1c6def8c81d6c0efc4760f2380d25f1e87495b24d4d087394c2ae

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/act/peoples-million
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:36 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 22:35:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 35295
etag: W/"655547c2-3dc9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mzlHD51ihXVyisZUJPPTOd0tf9U53K0vg0jPvTZSdgdsD2hZushhB1bLkfyt248p6pbpopedLLlyVykrABm6Nvqm1kAKdw9wUH7PCgXhg1enhp4JYUbzwidNgl31crdtFgTsNnZ8qw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=86400
cf-ray: 828791295932aaf0-SYD
alt-svc: h3=":443"; ma=86400
expires: Mon, 20 Nov 2023 00:05:21 GMT

GET
H2 200 iframeResizer.contentWindow.min.js Show response
d3rta84bycnbpe.cloudfront.net/actionkit-embed/js/ Frame F845 14 KB
6 KB 387ms
71ms Script
application/javascript 18.67.93.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3rta84bycnbpe.cloudfront.net/actionkit-embed/js/iframeResizer.contentWindow.min.js?cache=1619079484188
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-93-15.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e291e22c061178bfae4f5c46bbdbbc01f83d8e4695d2faddbbf0ddd1ac7d024f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 00:05:22 GMT
x-amz-meta-cache-control: max-age=604800
content-encoding: gzip
last-modified: Tue, 14 Nov 2017 12:53:25 GMT
server: AmazonS3
via: 1.1 a6b70b5c031397eba9646ba0eedbdb86.cloudfront.net (CloudFront)
x-amz-cf-pop: SYD62-P1
etag: W/"132819fe0a42dc0bbcca15633408a8f6"
age: 35295
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: tkrz0aD79K105at0LZnhbfVpMeedrNGyv00K-XBg_Mb_c9bONBJSgQ==

GET
H2 200 peoples-million Show response
act.whitehelmets.org/context/ Frame F845 13 KB
6 KB 540ms
540ms Script
text/javascript 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://act.whitehelmets.org/context/peoples-million?callback=actionkit.forms.onContextLoaded&form_name=act&required=email&required=country&required=first_name&required=last_name&required=privacy&required=state&required=zip&required=card_num&required=exp_date_month&required=exp_date_year&required=card_code&want_progress=1&r=0.8325003494150036&url=https%3A%2F%2Fact.whitehelmets.org%2Fact%2Fpeoples-million
Requested by: Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/resources/actionkit.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45569e57b5b6ec653f407d68661c819904b1e98f9bf34bbbfbe12d16b08492f2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/act/peoples-million
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:37 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding, Cookie, Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oauikYNsM9dg9wmqalmb3ngqd5mUyIpsJBs18vfRv75fupsmMb35apecgm3RSpUJjNalbFcDOaKVRKGwAyY4TZSYABpD7rz5pU3glwB7dKmdwIcNB5XUIT3SMH64UjJSjES46bGcRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-ray: 8287912bcc57aaf0-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 Lekton-Bold.woff2
www.whitehelmets.org/assets/fonts/ Frame F845 32 KB
33 KB 25ms
24ms Font
application/font-woff2 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/assets/fonts/Lekton-Bold.woff2
Requested by: Host: d3rta84bycnbpe.cloudfront.net
URL: https://d3rta84bycnbpe.cloudfront.net/actionkit-embed/css/whitehelmets.css?cache=1619079484188
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 326d4b529ca275d4d330a93f8dd4788f7669ced27d3f5098fb8d244511b43a95

Request headers

Referer: https://d3rta84bycnbpe.cloudfront.net/
Origin: https://act.whitehelmets.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:36 GMT
via: 1.1 f3405208f368b682f8c8a96590ab1596.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 33072
last-modified: Thu, 09 Nov 2017 11:19:38 GMT
server: cloudflare
etag: "effc9114df9d6c6f24b411ea57f6a527"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OtcpxdwrL4BJims%2BOhtgl9T0l6Dvu2z%2BnpCrL4zEao0MqEid%2FfrmYkMvXBw7esMP8FX3j2lUv2iDyRFwVgihn4W%2B%2FrCAG1DiQXovrdGLF7VHipy40WOPSI6BisimOXQuHub6lHWH7w%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 8287912bdcc7aae3-SYD
x-amz-cf-id: lPRUT_Eed-qaG7FtNAN0foXcugAkEV80YnMaizfbINXIRlsLJW6BvA==

GET
H2 200 Lekton-Regular.woff2
www.whitehelmets.org/assets/fonts/ Frame F845 32 KB
32 KB 28ms
28ms Font
application/font-woff2 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/assets/fonts/Lekton-Regular.woff2
Requested by: Host: d3rta84bycnbpe.cloudfront.net
URL: https://d3rta84bycnbpe.cloudfront.net/actionkit-embed/css/whitehelmets.css?cache=1619079484188
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02b6d842cb508a3de65f692c3e2a5e450e272749e914dc12d2f4eafe736d4f35

Request headers

Referer: https://d3rta84bycnbpe.cloudfront.net/
Origin: https://act.whitehelmets.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:36 GMT
via: 1.1 c7cd0041811f30bfd9c4a00e82b6a3c8.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 32644
last-modified: Thu, 09 Nov 2017 11:19:41 GMT
server: cloudflare
etag: "2d8d9366bd9d0b3a59158b0446cc5c0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ZBkcjaNv4evsg265kdvI3wNezAsuBbZWey94GaQ1U41wFnwefMUM%2FRvgw9TgBfNRS3YV4ZKdQOiwltSa2F9rzZ%2BWJNDGELmrVtQnGgVi2lTwL0u%2FKFyK4qQW0u%2Fr4ZDoARbnAm%2FuA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 8287912bdcccaae3-SYD
x-amz-cf-id: q-0QxH5cciM4BSL1r02jISCS7NHZRDRASv_Q5sO3qESzW-EYRNd5_w==

GET
H2 200 DINPro-Bold.woff2
www.whitehelmets.org/assets/fonts/ Frame F845 33 KB
34 KB 17ms
16ms Font
application/font-woff2 172.67.192.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.whitehelmets.org/assets/fonts/DINPro-Bold.woff2
Requested by: Host: d3rta84bycnbpe.cloudfront.net
URL: https://d3rta84bycnbpe.cloudfront.net/actionkit-embed/css/whitehelmets.css?cache=1619079484188
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.192.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbe15f3c5a6e997e123bdf13967cbac05a4b7aca624198dfa7bef35b57074e45

Request headers

Referer: https://d3rta84bycnbpe.cloudfront.net/
Origin: https://act.whitehelmets.org
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:36 GMT
via: 1.1 dc7f2062b70b5b710c1b09d21b43f900.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SYD62-P2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 34100
last-modified: Thu, 09 Nov 2017 11:19:36 GMT
server: cloudflare
etag: "38f8f1fa5cec4a5a50b760f68e6fcae4"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/font-woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FX8jWPVyXxi5gf7vrVo%2FeWXbAFUl%2BRXI3zVA3bwTNG0RGX9M8cA2nc%2Ba7kO7%2FQMhpC3v%2FpV7SEyyJJE0jJb%2FJESu%2FxIgP2BCtfLtXubwsOBFR%2Fq7jQUDBcPNWR6c7NivD3NjP6EsUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 8287912bdcceaae3-SYD
x-amz-cf-id: Yy9j-tZXrMgi9IlupfXxXk9WSQOCk5jEal1opAepfgar6JAV4UnXyg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame F845 52 KB
21 KB 403ms
3ms Script
text/javascript 142.250.67.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: act.whitehelmets.org
URL: https://act.whitehelmets.org/act/peoples-million

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.14 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s16-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 19 Nov 2023 09:52:35 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 62
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 19 Nov 2023 11:52:35 GMT

OPTIONS
H2 200 graphql
payments.braintree-api.com/ Frame 0
0 26ms
8ms Preflight 76.223.13.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://payments.braintree-api.com/graphql

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.223.13.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ae1d37305401c759d.awsglobalaccelerator.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,braintree-version,content-type
Access-Control-Request-Method: POST
Origin: https://act.whitehelmets.org
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: authorization,braintree-version,content-type
access-control-allow-methods: GET,DELETE,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://act.whitehelmets.org
access-control-max-age: 1800
date: Sun, 19 Nov 2023 09:53:36 GMT
paypal-debug-id: 90587cfbfd8e4
server: nginx
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
x-frame-options: DENY

POST
H2 200 graphql Show response
payments.braintree-api.com/ Frame F845 1 KB
1 KB 472ms
472ms XHR
application/json 76.223.13.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://payments.braintree-api.com/graphql

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/client.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.223.13.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ae1d37305401c759d.awsglobalaccelerator.com

Software

nginx /

Resource Hash

4395157ea84023654ddc352310d08d54e0659871f6fa75be633d67afd7e81063

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://act.whitehelmets.org/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6IjIwMTgwNDI2MTYtcHJvZHVjdGlvbiIsImlzcyI6Imh0dHBzOi8vYXBpLmJyYWludHJlZWdhdGV3YXkuY29tIn0.eyJleHAiOjE3MDA0NzQwMTUsImp0aSI6ImQ1ZWE4M2M0LTU1NzAtNDUxNi1hZDQyLTBiODJmM2FmNmEyYSIsInN1YiI6InNjNDNidDRkdzd4N3o0anMiLCJpc3MiOiJodHRwczovL2FwaS5icmFpbnRyZWVnYXRld2F5LmNvbSIsIm1lcmNoYW50Ijp7InB1YmxpY19pZCI6InNjNDNidDRkdzd4N3o0anMiLCJ2ZXJpZnlfY2FyZF9ieV9kZWZhdWx0IjpmYWxzZX0sInJpZ2h0cyI6WyJtYW5hZ2VfdmF1bHQiXSwic2NvcGUiOlsiQnJhaW50cmVlOlZhdWx0Il0sIm9wdGlvbnMiOnsibWVyY2hhbnRfYWNjb3VudF9pZCI6IlZvaWNlc1Byb2plY3RVU0FfaW5zdGFudCJ9fQ.18kinEkmCB1pvDY_fbyq8mawY2Zac45Q672QRb8QwdoHLEydWOniravs64B7kgLM-LHBWa74BLsc00GUzvoNSw
Braintree-Version: 2018-05-10
Content-Type: application/json

Response headers

pragma: no-cache
date: Sun, 19 Nov 2023 09:53:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubdomains; preload
server: nginx
vary: Braintree-Version, Accept-Encoding
braintree-version: 2016-10-07
content-type: application/json
access-control-allow-origin: https://act.whitehelmets.org
paypal-debug-id: 51fff0eed99e4
cache-control: no-cache, no-store
x-frame-options: DENY
content-length: 973

POST
H2 200 collect Show response
www.google-analytics.com/j/ Frame F845 15 B
225 B 98ms
97ms XHR
text/plain 142.250.67.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1176493678&t=pageview&_s=1&dl=https%3A%2F%2Fact.whitehelmets.org%2Fact%2Fpeoples-million&dr=https%3A%2F%2Fwhitehelmets.org%2F&ul=en-us&de=UTF-8&dt=Syria%27s%20Heroes%20%7C%20The%20Syria%20Campaign&sd=24-bit&sr=1600x1200&vp=580x150&je=0&_u=IEBAAEABAAAAACAAI~&jid=1540224812&gjid=813170011&cid=1990744961.1700387617&tid=UA-59071525-1&_gid=128127940.1700387617&_r=1&_slc=1&z=1290446332

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.67.14 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s16-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

a834fb91a24313169e52eb2cd45785c9fc4e04776e642be7639457bd1ab818dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://act.whitehelmets.org/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 19 Nov 2023 09:53:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://act.whitehelmets.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H/1.1 200
OK sc43bt4dw7x7z4js
client-analytics.braintreegateway.com/ Frame 0
0 75ms
3ms Preflight 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://act.whitehelmets.org
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Sun, 19 Nov 2023 09:53:37 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

OPTIONS
H/1.1 200
OK sc43bt4dw7x7z4js
client-analytics.braintreegateway.com/ Frame 0
0 76ms
4ms Preflight 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://act.whitehelmets.org
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Sun, 19 Nov 2023 09:53:37 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

POST
H/1.1 200
OK sc43bt4dw7x7z4js Show response
client-analytics.braintreegateway.com/ Frame F845 0
355 B 5ms
5ms XHR
text/plain 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/client.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://act.whitehelmets.org/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

Date: Sun, 19 Nov 2023 09:53:37 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: nginx
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Connection: keep-alive
Access-Control-Allow-Headers
Content-Length: 0

POST
H/1.1 200
OK sc43bt4dw7x7z4js Show response
client-analytics.braintreegateway.com/ Frame F845 0
355 B 4ms
4ms XHR
text/plain 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/client.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://act.whitehelmets.org/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

Date: Sun, 19 Nov 2023 09:53:37 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: nginx
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Connection: keep-alive
Access-Control-Allow-Headers
Content-Length: 0

OPTIONS
H/1.1 200
OK sc43bt4dw7x7z4js
client-analytics.braintreegateway.com/ Frame 0
0 61ms
4ms Preflight 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://act.whitehelmets.org
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Sun, 19 Nov 2023 09:53:37 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

POST
H/1.1 200
OK sc43bt4dw7x7z4js Show response
client-analytics.braintreegateway.com/ Frame F845 0
355 B 5ms
5ms XHR
text/plain 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/client.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://act.whitehelmets.org/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

Date: Sun, 19 Nov 2023 09:53:37 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: nginx
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Connection: keep-alive
Access-Control-Allow-Headers
Content-Length: 0

GET
H2 200 fb.js Show response
c.paypal.com/da/r/ Frame F845 62 KB
22 KB 429ms
141ms Script
application/javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/da/r/fb.js

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/data-collector.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ECAcc (laa/7B76) /

Resource Hash

6984ea6c3c74dcbc9ffd623a70d5e9fc08366f1548529f4ee315b72ec1942955

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits: 121957
date: Sun, 19 Nov 2023 09:53:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 varnish
age: 884231
x-cache: HIT
paypal-debug-id: 89bf0212e2ac8
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 21686
x-served-by: cache-bfi-kbfi7400073-BFI
last-modified: Thu, 09 Nov 2023 03:53:28 GMT
server: ECAcc (laa/7B76)
traceparent: 00-000000000000000000089bf0212e2ac8-5694af2a38b4144a-01
x-timer: S1700387618.526666,VS0,VE1
etag: W/"654c57b8-f992"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate,max-age=86400
access-control-allow-credentials: false
access-control-max-age: 86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 20 Nov 2023 09:53:37 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame F845 227 KB
81 KB 525ms
125ms Script
application/javascript 142.250.66.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-HT0Y4GCX2Z&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s23-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

fe34785b55421d25a34098401fa0dd6aa8c062a4c7ddcb266b1eed0290f08436

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82802
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 19 Nov 2023 09:53:37 GMT

GET
H2 200 hosted-fields-frame.min.html Show response
assets.braintreegateway.com/web/3.69.0/html/ Frame 4959 123 KB
33 KB 16ms
3ms Document
text/html 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.braintreegateway.com/web/3.69.0/html/hosted-fields-frame.min.html

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/hosted-fields.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E79A) /

Resource Hash

3599fbdd9e28340d8db2d380e4b37ec509828b0dde2a37a5785d2da96dd2f426

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://act.whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=86400
content-encoding: gzip
content-length: 33836
content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-type: text/html
date: Sun, 19 Nov 2023 09:53:37 GMT
etag: "6554f26f-1ec25+gzip"
expires: Mon, 20 Nov 2023 09:53:37 GMT
last-modified: Wed, 15 Nov 2023 16:31:43 GMT
server: ECAcc (nwa/E79A)
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-cache: HIT

GET
H2 200 hosted-fields-frame.min.html Show response
assets.braintreegateway.com/web/3.69.0/html/ Frame 4C3B 123 KB
33 KB 19ms
7ms Document
text/html 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.braintreegateway.com/web/3.69.0/html/hosted-fields-frame.min.html

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/hosted-fields.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E79A) /

Resource Hash

3599fbdd9e28340d8db2d380e4b37ec509828b0dde2a37a5785d2da96dd2f426

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://act.whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=86400
content-encoding: gzip
content-length: 33836
content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-type: text/html
date: Sun, 19 Nov 2023 09:53:37 GMT
etag: "6554f26f-1ec25+gzip"
expires: Mon, 20 Nov 2023 09:53:37 GMT
last-modified: Wed, 15 Nov 2023 16:31:43 GMT
server: ECAcc (nwa/E79A)
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-cache: HIT

GET
H2 200 hosted-fields-frame.min.html Show response
assets.braintreegateway.com/web/3.69.0/html/ Frame A46A 123 KB
33 KB 17ms
6ms Document
text/html 192.229.232.89
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.braintreegateway.com/web/3.69.0/html/hosted-fields-frame.min.html

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/hosted-fields.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.232.89 Marlborough, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (nwa/E79A) /

Resource Hash

3599fbdd9e28340d8db2d380e4b37ec509828b0dde2a37a5785d2da96dd2f426

Security Headers

Name	Value
Content-Security-Policy	style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' .braintreegateway.com .braintree-api.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://act.whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=86400
content-encoding: gzip
content-length: 33836
content-security-policy: style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.braintreegateway.com *.braintree-api.com;
content-type: text/html
date: Sun, 19 Nov 2023 09:53:37 GMT
etag: "6554f26f-1ec25+gzip"
expires: Mon, 20 Nov 2023 09:53:37 GMT
last-modified: Wed, 15 Nov 2023 16:31:43 GMT
server: ECAcc (nwa/E79A)
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
x-cache: HIT

GET
H/1.1

200
OK

logo.htm Show response
ssl.kaptcha.com/ Frame 3DEC
Redirect Chain

https://assets.braintreegateway.com/data/logo.htm?m=null&s=c9fcffa4a4a44e339b3dbc20635af9d1
https://ssl.kaptcha.com/logo.htm?m=null&s=c9fcffa4a4a44e339b3dbc20635af9d1

41 B
366 B

468ms
151ms

Document
text/html

35.81.31.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.kaptcha.com/logo.htm?m=null&s=c9fcffa4a4a44e339b3dbc20635af9d1
Requested by: Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/data-collector.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.81.31.24 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-81-31-24.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: a09179dd962df38a01440ce2e4748c37bd832fe1ac2f65ad974490a89d63d129

Request headers

Referer: https://act.whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache no-store must-revalidate private
Content-Length: 41
Content-Type: text/html
Date: Sun, 19 Nov 2023 09:53:37 GMT
Expires: 0
Pragma: no-cache
X-Correlation-Id: 135f80de-1a65-452f-803a-189c64ba90cc

Redirect headers

content-encoding: gzip
content-length: 20
date: Sun, 19 Nov 2023 09:53:37 GMT
location: https://ssl.kaptcha.com/logo.htm?m=null&s=c9fcffa4a4a44e339b3dbc20635af9d1
server: ECAcc (nwa/E7B3)
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding

POST
H/1.1 200
OK sc43bt4dw7x7z4js Show response
client-analytics.braintreegateway.com/ Frame F845 0
355 B 5ms
5ms XHR
text/plain 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Requested by

Host: js.braintreegateway.com
URL: https://js.braintreegateway.com/web/3.69.0/js/client.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://act.whitehelmets.org/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

Date: Sun, 19 Nov 2023 09:53:37 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: nginx
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Connection: keep-alive
Access-Control-Allow-Headers
Content-Length: 0

OPTIONS
H/1.1 200
OK sc43bt4dw7x7z4js
client-analytics.braintreegateway.com/ Frame 0
0 5ms
4ms Preflight 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://act.whitehelmets.org
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://act.whitehelmets.org
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Sun, 19 Nov 2023 09:53:37 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

POST
H/1.1 200
OK sc43bt4dw7x7z4js Show response
client-analytics.braintreegateway.com/ Frame 4959 0
362 B 5ms
5ms XHR
text/plain 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Requested by

Host: assets.braintreegateway.com
URL: https://assets.braintreegateway.com/web/3.69.0/html/hosted-fields-frame.min.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://assets.braintreegateway.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

Date: Sun, 19 Nov 2023 09:53:37 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: nginx
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://assets.braintreegateway.com
Connection: keep-alive
Access-Control-Allow-Headers
Content-Length: 0

OPTIONS
H/1.1 200
OK sc43bt4dw7x7z4js
client-analytics.braintreegateway.com/ Frame 0
0 5ms
5ms Preflight 3.24.113.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://client-analytics.braintreegateway.com/sc43bt4dw7x7z4js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.24.113.253 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-24-113-253.ap-southeast-2.compute.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://assets.braintreegateway.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://assets.braintreegateway.com
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Sun, 19 Nov 2023 09:53:37 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 200 i Show response
c.paypal.com/v1/r/d/ Frame 8065 160 B
1 KB 221ms
220ms Document
text/html 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://act.whitehelmets.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ch: sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-platform, sec-ch-ua-platform-version, sec-ch-ua-arch, sec-ch-ua-wow64, sec-ch-ua-bitness, sec-ch-ua-model, sec-ch-ua-full
accept-ranges: none
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.paypalinc.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
correlation-id: fc12f7e17efc6
date: Sun, 19 Nov 2023 09:53:37 GMT
origin-trial: A0A/uBW0ogQIica1KkPCeSOoHfvTATXdyRg8F/Ka8gjK4pCprEDwF3d3wTxNzSPn1ASb5ncpd46h7RQiSqGYpA8AAACMeyJvcmlnaW4iOiJodHRwczovL2MucGF5cGFsLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY5NTUxMzU5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
paypal-debug-id: fc12f7e17efc6
server-timing: "traceparent;desc="00-0000000000000000000fc12f7e17efc6-a5032919dd3e9b6a-01"";content-encoding;desc="br",x-cdn;desc="fastly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: *
traceparent: 00-0000000000000000000fc12f7e17efc6-76a05191c0b80f77-01
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-content-type-options: nosniff
x-served-by: cache-bur-kbur8200168-BUR, cache-bfi-kbfi7400073-BFI
x-timer: S1700387618.723543,VS0,VE80
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

counter2.cgi
hnd.stats.paypal.com/ Frame 63AA
Redirect Chain

https://b.stats.paypal.com/counter.cgi?i=127.0.0.1&p=fae3c7678ba1ccad3188a5d1399de3b7&t=1700387617.167&a=14
https://hnd.stats.paypal.com/counter2.cgi?i=127.0.0.1&p=fae3c7678ba1ccad3188a5d1399de3b7&t=1700387617.167&a=14

42 B
299 B

345ms
122ms

Image
image/jpeg

64.4.245.7
PAYPAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hnd.stats.paypal.com/counter2.cgi?i=127.0.0.1&p=fae3c7678ba1ccad3188a5d1399de3b7&t=1700387617.167&a=14
Protocol: HTTP/1.1
Server: 64.4.245.7 , United States, ASN17012 (PAYPAL, US),
Reverse DNS
Software: PayPal-B.Stats/1.0 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sun, 19 Nov 2023 09:53:38 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 42
Content-Type: image/jpeg

Redirect headers

Location: https://hnd.stats.paypal.com/counter2.cgi?i=127.0.0.1&p=fae3c7678ba1ccad3188a5d1399de3b7&t=1700387617.167&a=14
Date: Sun, 19 Nov 2023 09:53:37 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 0
Content-Type: application/octet-stream

POST
H2 204 collect
www.google-analytics.com/g/ Frame F845 0
57 B 98ms
98ms Ping
text/plain 142.250.67.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-HT0Y4GCX2Z&gtm=45je3b81v9123194035&_p=1700387617168&gcd=11l1l1l1l2&dma=0&ul=en-us&sr=1600x1200&cid=1990744961.1700387617&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fact.whitehelmets.org%2Fact%2Fpeoples-million&dr=https%3A%2F%2Fwhitehelmets.org%2F&dt=Syria%27s%20Heroes%20%7C%20The%20Syria%20Campaign&sid=1700387617&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=3710
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HT0Y4GCX2Z&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.67.14 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd15s16-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://act.whitehelmets.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Nov 2023 09:53:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://act.whitehelmets.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fb.js Show response
c.paypal.com/da/r/ Frame 8065 62 KB
22 KB 141ms
140ms Script
application/javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/da/r/fb.js

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

ECAcc (laa/7B76) /

Resource Hash

6984ea6c3c74dcbc9ffd623a70d5e9fc08366f1548529f4ee315b72ec1942955

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits: 121958
date: Sun, 19 Nov 2023 09:53:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
via: 1.1 varnish
age: 884232
x-cache: HIT
paypal-debug-id: 89bf0212e2ac8
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 21686
x-served-by: cache-bfi-kbfi7400073-BFI
last-modified: Thu, 09 Nov 2023 03:53:28 GMT
server: ECAcc (laa/7B76)
traceparent: 00-000000000000000000089bf0212e2ac8-5694af2a38b4144a-01
x-timer: S1700387618.946987,VS0,VE1
etag: W/"654c57b8-f992"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate,max-age=86400
access-control-allow-credentials: false
access-control-max-age: 86400
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 20 Nov 2023 09:53:37 GMT

POST
H2 200 p1 Show response
c.paypal.com/v1/r/d/b/ Frame 8065 212 B
574 B 249ms
249ms XHR
application/json 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/b/p1

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ac70a483713432473404d555f01524a05bd44f54edaf708a754057e821040cd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 19 Nov 2023 09:53:38 GMT
via: 1.1 varnish, 1.1 varnish
disable-set-cookie: true
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
p3p: policyref="/w3c/p3p.xml", CP="NON DSP COR ADM OUR IND COM"
paypal-debug-id: 89fc8c8bd4ea0
server-timing: "traceparent;desc="00-000000000000000000089fc8c8bd4ea0-e58359ec14257980-01"";content-encoding;desc="",x-cdn;desc="fastly"
content-length: 212
x-served-by: cache-bur-kbur8200138-BUR, cache-bfi-kbfi7400073-BFI
correlation-id: 89fc8c8bd4ea0
traceparent: 00-000000000000000000089fc8c8bd4ea0-7c5a1172840b3392-01
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.paypal.com
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 0

POST
H2 204 e Show response
c.paypal.com/v1/r/d/b/ Frame 8065 0
429 B 231ms
231ms XHR
text/plain 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/b/e

Requested by

Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://c.paypal.com/v1/r/d/i?js_src=https://c.paypal.com/da/r/fb.js
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 19 Nov 2023 09:53:38 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
paypal-debug-id: b58e860a79f4a
server-timing: "traceparent;desc="00-0000000000000000000b58e860a79f4a-e697617c537edc3d-01"";content-encoding;desc="",x-cdn;desc="fastly"
x-served-by: cache-bur-kbur8200088-BUR, cache-bfi-kbfi7400073-BFI
correlation-id: b58e860a79f4a
traceparent: 00-0000000000000000000b58e860a79f4a-4de45d713c43b1b3-01
vary: Accept-Encoding
access-control-allow-origin: https://www.paypal.com
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 0

GET
H2 200 p3
c6.paypal.com/v1/r/d/b/ Frame 8065 0
516 B 813ms
222ms Image
text/plain 151.101.193.35

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c6.paypal.com/v1/r/d/b/p3?f=fae3c7678ba1ccad3188a5d1399de3b7&s=BRAINTREE_SIGNIN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.35 -, , ASN (),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://c.paypal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 19 Nov 2023 09:53:38 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
paypal-debug-id: 2275018d3bd88
server-timing: "traceparent;desc="00-00000000000000000002275018d3bd88-5275335681d7dea2-01"";content-encoding;desc="",x-cdn;desc="fastly"
content-length: 0
x-served-by: cache-bur-kbur8200117-BUR, cache-bfi-kbfi7400039-BFI
correlation-id: 2275018d3bd88
traceparent: 00-00000000000000000002275018d3bd88-a3662e3776257006-01
x-timer: S1700387619.728660,VS0,VE83
vary: Accept-Encoding
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 0

GET
H/1.1 200
OK segment-2.m4s Show response
11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434... Frame 7882 104 KB
105 KB 7ms
7ms XHR
video/mp4 149.135.80.248
ASN-TELSTRA Telst...

General

Check archive.org

Show headers Download Go to

Full URL: https://11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434902/sep/audio/7f8b888b/chop/segment-2.m4s?r=dXM%3D
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 149.135.80.248 , Australia, ASN1221 (ASN-TELSTRA Telstra Corporation Ltd, AU),
Reverse DNS
Software: /
Resource Hash: 51a06aeac698451f8e6f25160b269c32e3fd67cfe0a2086efad4e8c02a50e54f

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sun, 19 Nov 2023 09:53:39 GMT
X-VIM-CACHEBC: EP:H11,E:m,PE:h
using-starlord: true
origin-retrieved-hour: 1674316800
Connection: keep-alive
Akamai-Mon-Iucid-Del: 877678
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 106906
AK-REFERENCE-ID: 0.f4508795.1700387619.51096f1
accept-range: bytes
ETag: "7a50ac442eef53ed0aa75c08177610fa"
Access-Control-Max-Age: 86400
Aka-c-hit: cache-hit
Content-Type: video/mp4
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Akamai-Edge-IP, X-VIM-CACHEBC, X-Akamai-Request-ID, AK-REFERENCE-ID
Cache-Control: max-age=31236223
Akamai-Edge-IP: 149.135.80.248
timing-allow-origin: *
Access-Control-Allow-Headers: Content-Type, Accept-Encoding, Range, X-OTT-Agent,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session

POST
H3 200 player-stats
fresnel.vimeocdn.com/add/ Frame 7882 0
11 B 207ms
207ms Ping
text/plain 34.120.202.204
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fresnel.vimeocdn.com/add/player-stats?beacon=1&session-id=67186fb15e98e618cddbae3008ac84443df48e411700387614
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.202.204 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 204.202.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://player.vimeo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://player.vimeo.com
date: Sun, 19 Nov 2023 09:53:39 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 200 partial
player-telemetry.vimeo.com/player-events/log/ Frame 7882 0
12 B 200ms
200ms Ping
text/html 34.120.202.204
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://player-telemetry.vimeo.com/player-events/log/partial
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.202.204 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 204.202.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://player.vimeo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://player.vimeo.com
date: Sun, 19 Nov 2023 09:53:39 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8

POST
H3 200 player-stats
fresnel.vimeocdn.com/add/ Frame 7882 0
11 B 200ms
200ms Ping
text/plain 34.120.202.204
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://fresnel.vimeocdn.com/add/player-stats?beacon=1&session-id=67186fb15e98e618cddbae3008ac84443df48e411700387614
Requested by: Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/4.26.4/js/vendor.module.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.202.204 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 204.202.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://player.vimeo.com/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://player.vimeo.com
date: Sun, 19 Nov 2023 09:53:39 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET segment-3.m4s
11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434... Frame 7882 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 11vod-adaptive.akamaized.net
URL: https://11vod-adaptive.akamaized.net/exp=1700391214~acl=%2F8427d53f-2c8f-4b36-b7e8-9cc539434902%2F%2A~hmac=44f4191290a466616f017146b7770738e2de0e2c2828937dc296ad764013ded6/8427d53f-2c8f-4b36-b7e8-9cc539434902/sep/audio/7f8b888b/chop/segment-3.m4s?r=dXM%3D

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 20:38:59	Name: _GRECAPTCHA Value: 09AB6UR-l7hk_m78badVpTTwx-hiYoj3ZWbBUlcQTr9Kn-uJussIu8R1uDIhhy9NCgREbO_YaGE-n1f67fB8pX4fI
.vimeo.com/	1970-01-20 16:19:49	Name: __cf_bm Value: lTBb7sn1lfyb290qH1nTr4QH8kyNvJTqg.JZTGS.c2Y-1700387614-0-AXrDiU7scDyJobqT1kd4hlvTK3raZB8RfL/PedIouwoblc2G7H8hhH2fjIidd2oZ+oL6SW/lIa9VJNfg4vXyUGo=
.vimeo.com/	1970-01-21 01:06:50	Name: player Value: ""
.vimeo.com/	1970-01-21 01:55:47	Name: vuid Value: pl164374927.1889730724
.whitehelmets.org/	1970-01-20 18:29:23	Name: _fbp Value: fb.1.1700387614888.2043317897
.whitehelmets.org/	1970-01-21 01:55:47	Name: _ga Value: GA1.2.1990744961.1700387617
.whitehelmets.org/	1970-01-20 16:21:14	Name: _gid Value: GA1.2.128127940.1700387617
.whitehelmets.org/	1970-01-20 16:19:47	Name: _gat Value: 1
.whitehelmets.org/	1970-01-21 01:55:47	Name: _ga_HT0Y4GCX2Z Value: GS1.2.1700387617.1.0.1700387617.0.0.0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.whitehelmets.org/main.js?v=1676893536176 Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://act.whitehelmets.org') does not match the recipient window's origin ('https://whitehelmets.org').
javascript	warning	URL: https://js.braintreegateway.com/web/3.69.0/js/data-collector.min.js Message: The devicemotion events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

11vod-adaptive.akamaized.net
act.whitehelmets.org
ajax.googleapis.com
assets.braintreegateway.com
b.stats.paypal.com
c.paypal.com
c6.paypal.com
client-analytics.braintreegateway.com
connect.facebook.net
d3rta84bycnbpe.cloudfront.net
f.vimeocdn.com
fonts.gstatic.com
fresnel.vimeocdn.com
hnd.stats.paypal.com
i.vimeocdn.com
js.braintreegateway.com
json.geoiplookup.io
payments.braintree-api.com
player-telemetry.vimeo.com
player.vimeo.com
polyfill.io
ssl.kaptcha.com
vimeo.com
whitehelmets.org
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.whitehelmets.org
11vod-adaptive.akamaized.net
104.21.19.185
142.250.66.195
142.250.66.200
142.250.67.14
142.251.221.67
149.135.80.248
151.101.193.35
151.101.30.109
151.101.64.217
151.101.65.21
151.101.65.26
157.240.8.23
157.240.8.35
162.159.128.61
162.159.138.60
172.217.167.100
172.217.167.74
172.67.192.56
18.67.111.110
18.67.93.15
192.229.232.89
3.24.113.253
34.120.202.204
35.81.31.24
64.4.245.7
76.223.13.31
02b6d842cb508a3de65f692c3e2a5e450e272749e914dc12d2f4eafe736d4f35
03a5ffdf940b3ec5272015f9970e72d94fa6f9ba46d300dcdf98570ad5814a44
05287a5383171779372727d2555093118013512b7dc0ea98c0565032c779af7e
0c7426dab3210a5bf3c4b4924bc678c0001f4765137ba482ac8fc07fb4f32001
0de1a3718b20c88628309662b19b373a826b17ed49b53436ab86476fc986fb9b
24d5316709657938c4080ec196a0ee9c433eea49adb82267306690d64dbc154e
2f3793dd173f59b85a16571e416ccf588b2034dded889a21b1a1251a1ada52b8
326d4b529ca275d4d330a93f8dd4788f7669ced27d3f5098fb8d244511b43a95
34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf
3599fbdd9e28340d8db2d380e4b37ec509828b0dde2a37a5785d2da96dd2f426
38e7c1f2b12b0503566f214cfcde7353ab180deab7a4ec39d539c0b4623bb761
3b3d7294affaebdf8ff68b34cec2e955f5bb2cb2a171ef12008822460d366c84
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f474a1dcfc40843d33b62b335d7d6108edb2898e76c45d65509a173da7a7f56
4225e213f96d4a95b4909d870bdac71dda982d995b01c7bc6773947da04d0abd
4395157ea84023654ddc352310d08d54e0659871f6fa75be633d67afd7e81063
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
45569e57b5b6ec653f407d68661c819904b1e98f9bf34bbbfbe12d16b08492f2
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7
4c99c23af5f0dbd91a488c3d279c89a74cc54169c4231ccf6e99a7b31b015948
51a06aeac698451f8e6f25160b269c32e3fd67cfe0a2086efad4e8c02a50e54f
52553960de44fbcf000fb518d11e7370e713c5792f4b196d2c49b0c055b3be60
531c8e98e6cf7f42627d226e3644a39dddda7ae836544d5a4079c578237fccb1
5530648342580582a72e5ef8a040bd532c230fb5ce88c4528285e9d24ba2d4f9
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5f212fa3d91e2228ae0d2016fd87516e197d5c09262461f07aea80033d5e7a89
614bc5def8ae43847e1d4f76cfebe0fce20b5a559f948a416a86b552f4c1d3bf
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
65cfe195f066427deb40f4b37fec1474e3df7b39197e323f80ad0b7142c5fd30
68d6f5e6353b7af3f62a7458c547270de36d2f2a8af194f0337252513e518270
6984ea6c3c74dcbc9ffd623a70d5e9fc08366f1548529f4ee315b72ec1942955
6ffee33dcfafe08550f9005ef75fb7b48b1684a9d091466ed6a83e1c2d4be848
7480346d1e765abd82613c50c6929108bd72558ada4ba9eef20372b9fc088fd7
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7de5756f03a1c6def8c81d6c0efc4760f2380d25f1e87495b24d4d087394c2ae
84b343633e2b0f92ed854df2f6c90c3b92c01f9e52f596e12abc4bbeec8afaac
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
90b5d41015da1f3eb25868d6a4610020415c0c9145d5412d174719d3ab5515d1
9321bc63a75b3ac6d384b411665b6e77a8b326a4b176ca2049872d3b5d4974f5
9805f9e800471d8a9c0038e842ab36d3ad17e28ac46516632ef8fe4f1902e49b
98a70a97ed84aba85cbe65b58debb3346659eecd46441e3ffe4bba58cc0ac9ab
9e78015366cac5532bd0fea95b947e0572d216b8f4f520aefe3bb8da938b4baf
a09179dd962df38a01440ce2e4748c37bd832fe1ac2f65ad974490a89d63d129
a2bdd8cb01353d4ed2a9ab4c7d7c263225f6908aa875614d015a2f39956d9d73
a68f878b0525f6d9ab5cad197a55bf60f8610e4bd0f9867dca3daaf25e99bdfb
a834fb91a24313169e52eb2cd45785c9fc4e04776e642be7639457bd1ab818dc
ac70a483713432473404d555f01524a05bd44f54edaf708a754057e821040cd5
afc002a9fe8227f9c76d1dc06ff40356f147410ff85d4760ba45dab4f44a51d9
b0e6490ff469608c304fd1b538dc48514df06c9938cb838a7839f61768aa5baf
b62f36160407c81030404ab242125afd42fa0da6626ef11e5f406dda12acf144
bad4d2a6261590de4274cb2449a5134b2fecffd001630a577f7dc6846bc9a4c8
c051b8b5eb2a0aef699780f15a449491868faa6f8b39b684b5ae8f64f345b94a
c09fd44df7c736d0517bc2d49d377647727fefdcb33a06a262fcbaaf66f1bec2
c0fa282024b452052041051426753ca5738cd9669023be8c9290209a01c1119e
c4e9d79a8df1baad78889d586cc2995a8483a27a0259b8f14d16e837f53004b7
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
d0124eb088ecd82db8d6be8b44df1eee2971c2b3787678694d97936efdcd58e5
d207cfe4c46f2ef0a7a3918729441be01056b904a854038f468251cd62183eb4
d65290bf09d8374d9ba3088d35229c9e46774fefc6df2a12f3ab9c34be2c30a3
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e291e22c061178bfae4f5c46bbdbbc01f83d8e4695d2faddbbf0ddd1ac7d024f
e2e44f76517d4d93f25ab4a0ccc32a60919daaa1755819e20c7e8426c5a6b19d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4bf51408a1b665c4422ade935304665b3eda02962103681e5545f84201aeadf
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
f4d5deb4709cebcb8d869180a1db81fab7c54f99dc2e72dab8b3db15eb76e660
fbe15f3c5a6e997e123bdf13967cbac05a4b7aca624198dfa7bef35b57074e45
fc05721f30773566af928190d44861a371001ff49aa9c0d5fbb8e89a29afa4cc
fe34785b55421d25a34098401fa0dd6aa8c062a4c7ddcb266b1eed0290f08436

whitehelmets.org Open in urlscan Pro 18.67.111.110 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

102 Requests

98 %HTTPS

0 %IPv6

18 Domains

30 Subdomains

27 IPs

3 Countries

4617 kBTransfer

7822 kBSize

9 Cookies

16 Outgoing links

Page URL History

Redirected requests

102 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

whitehelmets.org Open in urlscan Pro
18.67.111.110 Public Scan

Screenshot
Live screenshot

Full Image

102
Requests

98 %
HTTPS

0 %
IPv6

18
Domains

30
Subdomains

27
IPs

3
Countries

4617 kB
Transfer

7822 kB
Size

9
Cookies

102 HTTP transactions
3 data transactions