www.startribune.com Open in urlscan Pro
104.17.51.114 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Submission: On May 05 via api (May 5th 2022, 9:09:53 pm UTC) from CH — Scanned from DE

Summary HTTP 229 Redirects Links 37 Behaviour Indicators

Summary

This website contacted 84 IPs in 9 countries across 61 domains to perform 229 HTTP transactions. The main IP is 104.17.51.114, located in and belongs to CLOUDFLARENET, US. The main domain is www.startribune.com. The Cisco Umbrella rank of the primary domain is 50095.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 3rd 2022. Valid for: a year.

This is the only time www.startribune.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 77	104.17.51.114 104.17.51.114	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.99.77 13.32.99.77	16509 (AMAZON-02) (AMAZON-02)
4	108.138.16.177 108.138.16.177	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
2	23.205.242.213 23.205.242.213	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700::68... 2606:4700::6810:7daf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1734	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:223... 2600:9000:223c:1a00:18:1fcd:34f:cdc1	16509 (AMAZON-02) (AMAZON-02)
2	2620:116:800d... 2620:116:800d:21:51e4:db4b:4436:b305	16509 (AMAZON-02) (AMAZON-02)
1	18.66.107.155 18.66.107.155	16509 (AMAZON-02) (AMAZON-02)
2	69.192.160.245 69.192.160.245	16625 (AKAMAI-AS) (AKAMAI-AS)
3	69.192.160.199 69.192.160.199	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.32.99.100 13.32.99.100	16509 (AMAZON-02) (AMAZON-02)
4	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6810:d653	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:20:... 2606:4700:20::ac43:497c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
2	2600:9000:225... 2600:9000:2250:6e00:b:c006:c80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:440e::6812:2fe6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:1901:0:7... 2600:1901:0:7a0b::	15169 (GOOGLE) (GOOGLE)
1	151.101.193.194 151.101.193.194	54113 (FASTLY) (FASTLY)
5	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:170... 2a02:26f0:1700:1b2::19f0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:9000:223... 2600:9000:223c:a200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 3	18.66.139.6 18.66.139.6	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:224... 2600:9000:2240:de00:1b:9dc4:7dc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 3	13.36.218.177 13.36.218.177	16509 (AMAZON-02) (AMAZON-02)
1	104.18.9.110 104.18.9.110	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:200... 2a04:4e42:200::714	54113 (FASTLY) (FASTLY)
1	69.192.161.63 69.192.161.63	16625 (AKAMAI-AS) (AKAMAI-AS)
4	69.192.161.85 69.192.161.85	16625 (AKAMAI-AS) (AKAMAI-AS)
8	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
4	23.35.236.209 23.35.236.209	16625 (AKAMAI-AS) (AKAMAI-AS)
5	151.101.66.133 151.101.66.133	54113 (FASTLY) (FASTLY)
3	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	192.82.242.209 192.82.242.209	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	52.216.81.176 52.216.81.176	16509 (AMAZON-02) (AMAZON-02)
1	23.35.229.181 23.35.229.181	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.200.205.243 52.200.205.243	14618 (AMAZON-AES) (AMAZON-AES)
1	3.213.149.116 3.213.149.116	14618 (AMAZON-AES) (AMAZON-AES)
2	185.33.220.240 185.33.220.240	29990 (ASN-APPNEX) (ASN-APPNEX)
1	184.31.84.150 184.31.84.150	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2602:803:c004... 2602:803:c004:200::143	26667 (RUBICONPR...) (RUBICONPROJECT)
1	52.29.205.29 52.29.205.29	16509 (AMAZON-02) (AMAZON-02)
1	52.222.236.10 52.222.236.10	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE)
2	2600:9000:225... 2600:9000:225e:c200:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:1f18:e8a... 2600:1f18:e8a:cd04:9b88:a313:d24d:af44	14618 (AMAZON-AES) (AMAZON-AES)
4	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	151.101.130.133 151.101.130.133	54113 (FASTLY) (FASTLY)
1	52.222.206.199 52.222.206.199	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:1f18:730... 2600:1f18:730:b130:4c96:5596:18cd:cf5	14618 (AMAZON-AES) (AMAZON-AES)
1	34.202.82.185 34.202.82.185	14618 (AMAZON-AES) (AMAZON-AES)
2	50.17.6.135 50.17.6.135	14618 (AMAZON-AES) (AMAZON-AES)
2	64.202.112.95 64.202.112.95	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	151.101.14.132 151.101.14.132	54113 (FASTLY) (FASTLY)
1 2	37.157.4.29 37.157.4.29	198622 (ADFORM) (ADFORM)
1	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
2 3	52.215.3.215 52.215.3.215	16509 (AMAZON-02) (AMAZON-02)
7 10	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
3 3	216.200.232.253 216.200.232.253	30419 (MEDIAMATH...) (MEDIAMATH-INC)
4	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
3	198.47.127.20 198.47.127.20	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	159.122.14.34 159.122.14.34	36351 (SOFTLAYER) (SOFTLAYER)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
1 2	2a05:d018:d29... 2a05:d018:d29:3602:4db1:160f:679a:106f	16509 (AMAZON-02) (AMAZON-02)
2 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
2 6	23.23.81.221 23.23.81.221	14618 (AMAZON-AES) (AMAZON-AES)
1	2a02:26f0:170... 2a02:26f0:1700:5::5f65:1b51	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
4 5	3.120.28.2 3.120.28.2	16509 (AMAZON-02) (AMAZON-02)
1 1	54.145.48.80 54.145.48.80	14618 (AMAZON-AES) (AMAZON-AES)
2 2	34.253.74.200 34.253.74.200	16509 (AMAZON-02) (AMAZON-02)
1 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a04:4e42::300 2a04:4e42::300	54113 (FASTLY) (FASTLY)
2 2	70.42.32.127 70.42.32.127	13789 (INTERNAP-...) (INTERNAP-BLK3)
1	2600:1f18:444... 2600:1f18:444a:4680:27f9:539b:c9b0:d2ce	14618 (AMAZON-AES) (AMAZON-AES)
3 6	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
1	52.211.24.23 52.211.24.23	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	52.46.130.91 52.46.130.91	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
229	84

77 104.17.51.114 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.startribune.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
users.startribune.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.startribune.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
apps.startribune.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-77.fra60.r.cloudfront.net

startribune.zeustechnology.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 108.138.16.177 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-16-177.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.242.213 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-242-213.deploy.static.akamaitechnologies.com

cdn-pci.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7daf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223c:1a00:18:1fcd:34f:cdc1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:51e4:db4b:4436:b305 (United States)

ASN16509 (AMAZON-02, US)

edge.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.107.155 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-107-155.fra56.r.cloudfront.net

dc8xl0ndzn2cb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.192.160.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-245.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 69.192.160.199 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-199.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-100.fra60.r.cloudfront.net

ib.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:d653 (United States)

ASN13335 (CLOUDFLARENET, US)

chorus.stimg.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:497c (United States)

ASN13335 (CLOUDFLARENET, US)

www.queryly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2250:6e00:b:c006:c80:93a1 (United States)

ASN16509 (AMAZON-02, US)

dk98ddgl0znzm.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:440e::6812:2fe6 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:7a0b:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

sessions.bugsnag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.194 (United States)

ASN54113 (FASTLY, US)

clarium.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:1700:1b2::19f0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

tapi.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:a200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.66.139.6 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-66-139-6.fra60.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2240:de00:1b:9dc4:7dc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

comments.startribune.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.36.218.177 (Paris, France) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

smetrics.startribune.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.9.110 (None, )

ASN13335 (CLOUDFLARENET, US)

ds.reson8.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::714 (United States)

ASN54113 (FASTLY, US)

mab.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.192.161.63 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-161-63.deploy.static.akamaitechnologies.com

s.ntv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.192.161.85 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-161-85.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widget-pixels.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.35.236.209 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-209.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.66.133 (United States)

ASN54113 (FASTLY, US)

cdn.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.82.242.209 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.81.176 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

emma-content-aggregates-prd.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.229.181 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-229-181.deploy.static.akamaitechnologies.com

tcheck.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.200.205.243 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-205-243.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.213.149.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-149-116.compute-1.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.220.240 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.31.84.150 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-84-150.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:803:c004:200::143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.29.205.29 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-205-29.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-10.fra56.r.cloudfront.net

ob.cheqzone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:225e:c200:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:e8a:cd04:9b88:a313:d24d:af44 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

obs.cheqzone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.133 (United States)

ASN54113 (FASTLY, US)

consumer.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.206.199 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-206-199.fra56.r.cloudfront.net

d1epsz32winqbo.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b130:4c96:5596:18cd:cf5 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.202.82.185 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-82-185.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.17.6.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-17-6-135.compute-1.amazonaws.com

logx.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.95 (Leesburg, United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

log.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mcdp-nydc1.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.132 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

odb.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.4.29 (Denmark) 1 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.49 (United States)

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.215.3.215 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-3-215.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.185.98 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.200.232.253 (Frederick, United States) 3 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 198.47.127.20 (United States)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.122.14.34 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 22.0e.7a9f.ip4.static.sl-reverse.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d018:d29:3602:4db1:160f:679a:106f (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.23.81.221 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-23-81-221.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:1700:5::5f65:1b51 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

sli.startribune.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

778dc798f143c5f37de79678f2b6368f.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.120.28.2 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-28-2.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.145.48.80 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-145-48-80.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.253.74.200 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-74-200.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::300 (United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.127 (United States) 2 redirects

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:444a:4680:27f9:539b:c9b0:d2ce (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

i6.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 76.223.111.18 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.211.24.23 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-24-23.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.130.91 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
82	startribune.com 2 redirects www.startribune.com — Cisco Umbrella Rank: 50095 users.startribune.com — Cisco Umbrella Rank: 155936 static.startribune.com — Cisco Umbrella Rank: 110350 apps.startribune.com — Cisco Umbrella Rank: 106395 comments.startribune.com — Cisco Umbrella Rank: 177937 smetrics.startribune.com — Cisco Umbrella Rank: 116161 sli.startribune.com — Cisco Umbrella Rank: 129277	1 MB
15	doubleclick.net 7 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 245 stats.g.doubleclick.net — Cisco Umbrella Rank: 175 cm.g.doubleclick.net — Cisco Umbrella Rank: 289	157 KB
11	liadm.com 3 redirects b-code.liadm.com — Cisco Umbrella Rank: 4526 rp.liadm.com — Cisco Umbrella Rank: 3481 rp4.liadm.com — Cisco Umbrella Rank: 9139 i.liadm.com — Cisco Umbrella Rank: 809 i6.liadm.com — Cisco Umbrella Rank: 2046	22 KB
11	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 655 image6.pubmatic.com — Cisco Umbrella Rank: 857 hbopenbid.pubmatic.com Failed simage2.pubmatic.com — Cisco Umbrella Rank: 912 image4.pubmatic.com — Cisco Umbrella Rank: 1417 image2.pubmatic.com — Cisco Umbrella Rank: 1403 simage4.pubmatic.com — Cisco Umbrella Rank: 1543	29 KB
8	googlesyndication.com 778dc798f143c5f37de79678f2b6368f.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 119 tpc.googlesyndication.com — Cisco Umbrella Rank: 171	39 KB
8	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 101	21 KB
8	3lift.com 3 redirects ib.3lift.com — Cisco Umbrella Rank: 1714 tlx.3lift.com — Cisco Umbrella Rank: 879 eb2.3lift.com — Cisco Umbrella Rank: 590	4 KB
7	krxd.net cdn.krxd.net — Cisco Umbrella Rank: 2013 consumer.krxd.net — Cisco Umbrella Rank: 2623 beacon.krxd.net — Cisco Umbrella Rank: 662	172 KB
6	outbrain.com widgets.outbrain.com — Cisco Umbrella Rank: 1701 widget-pixels.outbrain.com — Cisco Umbrella Rank: 3413 odb.outbrain.com — Cisco Umbrella Rank: 1756 mcdp-nydc1.outbrain.com — Cisco Umbrella Rank: 6320	89 KB
6	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 375 s.amazon-adsystem.com — Cisco Umbrella Rank: 382	41 KB
5	bidswitch.net 4 redirects x.bidswitch.net — Cisco Umbrella Rank: 405	2 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 142	257 KB
5	optimizely.com cdn-pci.optimizely.com — Cisco Umbrella Rank: 9342 tapi.optimizely.com — Cisco Umbrella Rank: 12965 logx.optimizely.com — Cisco Umbrella Rank: 1599	137 KB
4	yahoo.com 3 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 738 ups.analytics.yahoo.com — Cisco Umbrella Rank: 420	3 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	531 B
4	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1114	18 KB
4	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 447	1 KB
4	cloudfront.net dc8xl0ndzn2cb.cloudfront.net dk98ddgl0znzm.cloudfront.net d1epsz32winqbo.cloudfront.net	7 KB
3	mathtag.com 3 redirects sync.mathtag.com — Cisco Umbrella Rank: 680	2 KB
3	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 783	2 KB
3	cheqzone.com ob.cheqzone.com — Cisco Umbrella Rank: 8786 obs.cheqzone.com — Cisco Umbrella Rank: 5657	20 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 195	201 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 213	2 KB
3	stimg.co chorus.stimg.co — Cisco Umbrella Rank: 101869	108 KB
3	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 1525 mab.chartbeat.com — Cisco Umbrella Rank: 3122	33 KB
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 862	592 B
2	addthis.com 1 redirects x.dlx.addthis.com — Cisco Umbrella Rank: 1834	1 KB
2	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 283	2 KB
2	google.com adservice.google.com — Cisco Umbrella Rank: 128 www.google.com — Cisco Umbrella Rank: 20	2 KB
2	adform.net 1 redirects c1.adform.net — Cisco Umbrella Rank: 950	951 B
2	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 326	749 B
2	outbrainimg.com tcheck.outbrainimg.com — Cisco Umbrella Rank: 4301 log.outbrainimg.com — Cisco Umbrella Rank: 2441	787 B
2	casalemedia.com as-sec.casalemedia.com — Cisco Umbrella Rank: 1908 htlb.casalemedia.com — Cisco Umbrella Rank: 695	790 B
2	bugsnag.com sessions.bugsnag.com — Cisco Umbrella Rank: 895	97 B
2	queryly.com www.queryly.com — Cisco Umbrella Rank: 24772	11 KB
2	quantserve.com edge.quantserve.com — Cisco Umbrella Rank: 16339 pixel.quantserve.com — Cisco Umbrella Rank: 653	10 KB
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 899	707 B
1	taboola.com trc.taboola.com — Cisco Umbrella Rank: 882	240 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 1187	588 B
1	google.de adservice.google.de — Cisco Umbrella Rank: 5351	792 B
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 1257	518 B
1	simpli.fi um.simpli.fi — Cisco Umbrella Rank: 1313	610 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 491	98 B
1	everesttech.net sync-tm.everesttech.net — Cisco Umbrella Rank: 955	177 B
1	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 663	2 KB
1	postrelease.com jadserve.postrelease.com — Cisco Umbrella Rank: 1708	539 B
1	chartbeat.net ping.chartbeat.net — Cisco Umbrella Rank: 1354	201 B
1	amazonaws.com emma-content-aggregates-prd.s3.amazonaws.com — Cisco Umbrella Rank: 106228	527 B
1	ntv.io s.ntv.io — Cisco Umbrella Rank: 4617	115 KB
1	reson8.com ds.reson8.com — Cisco Umbrella Rank: 4040	169 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1160	429 B
1	fastly.net clarium.global.ssl.fastly.net — Cisco Umbrella Rank: 9665	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1595	5 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 2150	43 KB
1	indexww.com js-sec.indexww.com — Cisco Umbrella Rank: 1014	13 KB
1	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 3319
1	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1095	11 KB
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 1250	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 111	869 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 936	63 KB
1	zeustechnology.com startribune.zeustechnology.com — Cisco Umbrella Rank: 115179	49 KB
229	61

	Domain	Requested by
59	www.startribune.com	1 redirects www.startribune.com static.cloudflareinsights.com
14	apps.startribune.com	www.startribune.com
10	cm.g.doubleclick.net	7 redirects eb2.3lift.com
8	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.startribune.com
6	eb2.3lift.com	3 redirects ib.3lift.com eb2.3lift.com
6	i.liadm.com	2 redirects b-code.liadm.com i.liadm.com
5	x.bidswitch.net	4 redirects eb2.3lift.com
5	cdn.krxd.net	www.startribune.com cdn.krxd.net
5	www.googletagmanager.com	www.startribune.com www.googletagmanager.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	www.facebook.com	www.startribune.com
4	tags.tiqcdn.com	www.startribune.com tags.tiqcdn.com
4	match.adsrvr.org	js-sec.indexww.com ads.pubmatic.com i.liadm.com eb2.3lift.com
4	securepubads.g.doubleclick.net	startribune.zeustechnology.com securepubads.g.doubleclick.net
4	c.amazon-adsystem.com	www.startribune.com c.amazon-adsystem.com
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	sync.mathtag.com	3 redirects
3	match.prod.bidr.io	2 redirects ads.pubmatic.com
3	connect.facebook.net	www.startribune.com connect.facebook.net
3	widgets.outbrain.com	www.startribune.com
3	smetrics.startribune.com	1 redirects www.startribune.com
3	sb.scorecardresearch.com	1 redirects www.startribune.com
3	chorus.stimg.co	www.startribune.com
3	ads.pubmatic.com	startribune.zeustechnology.com ads.pubmatic.com
3	users.startribune.com	www.startribune.com
2	s.amazon-adsystem.com	1 redirects eb2.3lift.com
2	b1sync.zemanta.com	2 redirects
2	x.dlx.addthis.com	1 redirects i.liadm.com
2	dpm.demdex.net	2 redirects
2	ups.analytics.yahoo.com	2 redirects
2	pr-bh.ybp.yahoo.com	1 redirects ads.pubmatic.com
2	image2.pubmatic.com	ads.pubmatic.com
2	image4.pubmatic.com	ads.pubmatic.com
2	simage2.pubmatic.com	ads.pubmatic.com
2	c1.adform.net	1 redirects ads.pubmatic.com
2	logx.optimizely.com	cdn-pci.optimizely.com
2	obs.cheqzone.com	ob.cheqzone.com www.startribune.com
2	b-code.liadm.com	tags.tiqcdn.com b-code.liadm.com
2	ib.adnxs.com	startribune.zeustechnology.com eb2.3lift.com
2	sessions.bugsnag.com	www.startribune.com
2	dk98ddgl0znzm.cloudfront.net	www.startribune.com dk98ddgl0znzm.cloudfront.net
2	www.queryly.com	www.startribune.com
2	static.chartbeat.com	www.startribune.com
2	cdn-pci.optimizely.com	www.startribune.com cdn-pci.optimizely.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	www.google.com	tpc.googlesyndication.com
1	px.ads.linkedin.com	eb2.3lift.com
1	beacon.krxd.net	cdn.krxd.net
1	i6.liadm.com	i.liadm.com
1	trc.taboola.com	i.liadm.com
1	sync.srv.stackadapt.com	1 redirects
1	778dc798f143c5f37de79678f2b6368f.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	sli.startribune.com	www.startribune.com
1	mcdp-nydc1.outbrain.com	www.startribune.com
1	ad.turn.com	1 redirects
1	um.simpli.fi	ads.pubmatic.com
1	idsync.rlcdn.com	ads.pubmatic.com
1	sync-tm.everesttech.net	ads.pubmatic.com
1	odb.outbrain.com	widgets.outbrain.com
1	log.outbrainimg.com	widgets.outbrain.com
1	rp4.liadm.com	www.startribune.com
1	rp.liadm.com	1 redirects
1	d1epsz32winqbo.cloudfront.net	www.startribune.com
1	consumer.krxd.net	cdn.krxd.net
1	stats.g.doubleclick.net	www.google-analytics.com
1	ob.cheqzone.com	widgets.outbrain.com
1	tlx.3lift.com	startribune.zeustechnology.com
1	fastlane.rubiconproject.com	startribune.zeustechnology.com
1	htlb.casalemedia.com	startribune.zeustechnology.com
1	jadserve.postrelease.com	s.ntv.io
1	ping.chartbeat.net	www.startribune.com
1	widget-pixels.outbrain.com	www.startribune.com
1	tcheck.outbrainimg.com	widgets.outbrain.com
1	emma-content-aggregates-prd.s3.amazonaws.com	dk98ddgl0znzm.cloudfront.net
1	image6.pubmatic.com	ads.pubmatic.com
1	as-sec.casalemedia.com	js-sec.indexww.com
1	s.ntv.io	www.startribune.com
1	pixel.quantserve.com	www.startribune.com
1	mab.chartbeat.com	static.chartbeat.com
1	ds.reson8.com	www.startribune.com
1	comments.startribune.com	www.startribune.com
1	rules.quantcount.com	edge.quantserve.com
1	tapi.optimizely.com	cdn-pci.optimizely.com
1	clarium.global.ssl.fastly.net	www.startribune.com
1	static.cloudflareinsights.com	www.startribune.com
1	www.googleoptimize.com	www.startribune.com
1	ib.3lift.com	startribune.zeustechnology.com
1	js-sec.indexww.com	startribune.zeustechnology.com
1	static.startribune.com	www.startribune.com
1	dc8xl0ndzn2cb.cloudfront.net	www.startribune.com
1	edge.quantserve.com	www.startribune.com
1	kit.fontawesome.com	www.startribune.com
1	maxcdn.bootstrapcdn.com	www.startribune.com
1	unpkg.com	www.startribune.com
1	fonts.googleapis.com	www.startribune.com
1	code.jquery.com	www.startribune.com
1	startribune.zeustechnology.com	www.startribune.com
0	hbopenbid.pubmatic.com Failed	startribune.zeustechnology.com
229	100

This site contains links to these domains. Also see Links.

Domain
users.startribune.com
startribune.newspapers.com
www.votedminnesotasbest.com
startribune.adperfect.com
classifieds.startribune.com
apps.startribune.com
jobs.startribune.com
startribunejobs-rs.madgexjb.com
www.facebook.com
twitter.com
www.linkedin.com
www.pinterest.com
reprints.ygsgroup.com
mn.gov
elderjusticemn.org
www.mncompass.org
www.outbrain.com
galleries.parentsdome.com
www.familyminded.com
www.trkcpc6.xyz
edition.popsugar.com
2e64c7.snzgdl.com
www.conflictnations.com
pinterest.com
www.instagram.com
www.queryly.com

Subject Issuer	Validity	Valid
*.startribune.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-03` - `2023-06-03`	a year	crt.sh
*.zeustechnology.com Amazon	`2022-04-15` - `2023-05-14`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
cdn-pci.optimizely.com DigiCert SHA2 Secure Server CA	`2022-02-08` - `2023-02-08`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-02` - `2022-07-01`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2021-05-20` - `2022-06-03`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-12-12` - `2022-12-13`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
*.bugsnag.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-26` - `2023-04-26`	a year	crt.sh
*.freetls.fastly.net GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-05-04` - `2023-06-05`	a year	crt.sh
*.optimizely.com DigiCert SHA2 Secure Server CA	`2021-12-24` - `2022-12-24`	a year	crt.sh
*.scorecardresearch.com Amazon	`2022-01-29` - `2023-02-27`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.ntv.io DigiCert SHA2 Secure Server CA	`2021-12-04` - `2022-12-06`	a year	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-03` - `2023-04-04`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
cdn.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-12-30` - `2022-12-29`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-02-12` - `2022-05-13`	3 months	crt.sh
*.s3.amazonaws.com Amazon	`2021-12-15` - `2022-12-03`	a year	crt.sh
*.outbrainimg.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-11` - `2023-03-15`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2021-12-01` - `2022-12-30`	a year	crt.sh
*.postrelease.com Amazon	`2021-12-28` - `2023-01-25`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.cheqzone.com Amazon	`2022-01-22` - `2023-02-20`	a year	crt.sh
smetrics.startribune.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-28` - `2023-05-29`	a year	crt.sh
*.liadm.com Amazon	`2022-01-31` - `2023-03-01`	a year	crt.sh
consumer.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-07-13` - `2022-07-12`	a year	crt.sh
logx.optimizely.com Amazon	`2021-08-23` - `2022-09-21`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
*.everesttech.net GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-02-03` - `2023-03-07`	a year	crt.sh
*.match.prod.bidr.io Amazon	`2022-01-27` - `2023-02-25`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.simpli.fi DigiCert TLS RSA SHA256 2020 CA1	`2021-10-27` - `2022-11-27`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-01-18` - `2022-07-13`	6 months	crt.sh
sli.startribune.com R3	`2022-04-20` - `2022-07-19`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-28` - `2022-12-29`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2022-03-28` - `2022-09-28`	6 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2022-04-05` - `2023-05-04`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh

This page contains 14 frames:

Primary Page: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Frame ID: 24AE0AE2FB0E1804606B0474EF6D079C
Requests: 181 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Frame ID: ABB1F03488BA26EC9D3BBD829C676271
Requests: 13 HTTP requests in this frame

Frame: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Frame ID: FAA473F48BB5CAAD3FDA65409712CD96
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 7BD4AE74368E5B75D57AC97B1DD9561C
Requests: 1 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=972F0026-35CA-4B00-B65E-0D0186B9F64A
Frame ID: 9EBB91ABEA0584B5D2B4F93EE50C3805
Requests: 1 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D
Frame ID: C03D38C7D70C38D26D6B700BEA308281
Requests: 1 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Frame ID: 7EB2922CB70BABE3FAFE00BBEDCE2F3A
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:13106274-3d1c-4800-999e-7561e5f7c89f&gdpr=0&gdpr_consent=
Frame ID: E047F92625FBAC56E67B0940AE5302AC
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 769A50F58CA693B608B629146EC6A46B
Requests: 1 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-04p2?s=&cim=&ps=true&ls=true&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Frame ID: 11E9A040FABEDF072684E2E1C6328C98
Requests: 8 HTTP requests in this frame

Frame: https://778dc798f143c5f37de79678f2b6368f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 5B8572817CBC9B9CA025FE2390393F40
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 5E2D9E1CDC7B078858BE58F525CC038A
Requests: 11 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 02943A0F8D266ACD2D5C03AFB4E22EF8
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 53D7DB670A52814400D4C10353897C68
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sweetheart scams targeting seniors wreck finances — and devastate families - StarTribune.com

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

BugSnag (Analytics) Expand

Overall confidence: 100%
Detected patterns

/bugsnag.*\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

optimizely\.com.*\.js

Outbrain (Widgets) Expand

Overall confidence: 100%
Detected patterns

widgets\.outbrain\.com/outbrain\.js

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

229
Requests

91 %
HTTPS

42 %
IPv6

61
Domains

100
Subdomains

84
IPs

9
Countries

2749 kB
Transfer

7855 kB
Size

90
Cookies

37 Outgoing links

These are links going to different origins than the main page.

URL: https://users.startribune.com/member_center/

Search URL Search Domain Scan URL

URL: http://startribune.newspapers.com/
Title: Archives: 150+ years

Search URL Search Domain Scan URL

URL: https://www.votedminnesotasbest.com/
Title: Minnesota's Best

Search URL Search Domain Scan URL

URL: http://startribune.adperfect.com/
Title: Place an Ad

Search URL Search Domain Scan URL

URL: http://classifieds.startribune.com/default/garage-sales/search/
Title: Garage Sales

Search URL Search Domain Scan URL

URL: http://classifieds.startribune.com/default/estate-sales/search/
Title: Estate Sales

Search URL Search Domain Scan URL

URL: http://classifieds.startribune.com/default/merchandise/search/
Title: Merchandise

Search URL Search Domain Scan URL

URL: http://classifieds.startribune.com/default/pets/search/
Title: Pets

Search URL Search Domain Scan URL

URL: http://classifieds.startribune.com/default/recreational-vehicles/search/
Title: Recreational Vehicles & Marina

Search URL Search Domain Scan URL

URL: https://apps.startribune.com/auctions/
Title: Auctions

Search URL Search Domain Scan URL

URL: http://classifieds.startribune.com/default/real-estate-business-ind-investment-property/search
Title: Commercial

Search URL Search Domain Scan URL

URL: http://jobs.startribune.com/jobs/
Title: Find a Job

Search URL Search Domain Scan URL

URL: http://jobs.startribune.com/logon/?PipelinedPage=%7E%2faccount%2f&PipelinedQueryString=
Title: Your Account

Search URL Search Domain Scan URL

URL: http://jobs.startribune.com/employers/
Title: Employer A-Z

Search URL Search Domain Scan URL

URL: https://startribunejobs-rs.madgexjb.com/
Title: Post a Job

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F
Title: share

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&text=Sweetheart+scams+targeting+seniors+wreck+finances+%E2%80%94+and+devastate+families
Title: tweet

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&title=Sweetheart+scams+targeting+seniors+wreck+finances+%E2%80%94+and+devastate+families&source=Star+Tribune
Title: Share on LinkedIn

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&media=https%3A%2F%2Fcdn.vox-cdn.com%2Fuploads%2Fchorus_asset%2Ffile%2F23406668%2F1014812163_02elder042422.jpg
Title: Share on Pinterest

Search URL Search Domain Scan URL

URL: http://reprints.ygsgroup.com/m/startribune/
Title: Order Reprint

Search URL Search Domain Scan URL

URL: https://mn.gov/dhs/assets/2017-2020-VAP-dashboard_tcm1053-488094.pdf
Title: more than 50,000 reports of suspected abuse, neglect or financial exploitation of vulnerable adults each year

Search URL Search Domain Scan URL

URL: https://elderjusticemn.org/
Title: Minnesota Elder Justice Center

Search URL Search Domain Scan URL

URL: https://mn.gov/dhs/people-we-serve/adults/services/adult-protection/
Title: vulnerable adults

Search URL Search Domain Scan URL

URL: https://www.mncompass.org/chart/k518/homeownership#1-12842-g
Title: Most older adults in Minnesota live in their own homes,

Search URL Search Domain Scan URL

URL: http://twitter.com/rachel_hutton
Title: rachel_hutton

Search URL Search Domain Scan URL

URL: https://www.outbrain.com/what-is/default/en
Title: Sponsored Links by

Search URL Search Domain Scan URL

URL: https://galleries.parentsdome.com/random-knowledge-quiz/?utm_source=outbrain&utm_medium=$publisher_name$-$section_name$&utm_term=$publisher_id$_$section_id$&utm_content=0095fafb9d7d1bd19bddc4e1fe8c08d7b5&utm_campaign=xpd-ob-ww2-d-randomquiz-22.02.16-6621-cnr_p15_chrome_7521&utm_cpc=$cpc$&utm_template=ajax&obOrigUrl=true
Title: We Will Guess Your Education Level in 20 Questions Parentsdome Galleries

Search URL Search Domain Scan URL

URL: https://www.familyminded.com/s/celeb-couples-with-major-age-differences-50dac89107af4ec0?utm_campaign=agedifferences-3c2c7a5070cd4b3e&utm_medium=cpc&utm_source=out&aid=000c5536f1237d00cba5affe60fc83fada&utm_term=$publisher_name$&obOrigUrl=true
Title: Celeb Couples with Major Age Differences FamilyMinded

Search URL Search Domain Scan URL

URL: https://www.trkcpc6.xyz/15GFGn?teaser_id=0075e08ae9164ba13522469f2264720db4&campaign_id=009238d990a4fee64b8e5fdf5ae0fdba98&widget_id=$publisher_id$&site=$publisher_name$&title=Das+realistischste+PC-Spiel+des+Jahres+2022&section_id=$section_id$&section_name=$section_name$&req_id=$req_id$&promoted_link_id=0075e08ae9164ba13522469f2264720db4&time_stamp=$time_stamp$&external_id=$ob_click_id$&obOrigUrl=true
Title: Das realistischste PC-Spiel des Jahres 2022 Raid: Shadow Legends

Search URL Search Domain Scan URL

URL: https://edition.popsugar.com/s/worst-movies-of-all-time-bf608ad2e37f4311?utm_campaign=worstmoviesalltime-b43c53d04c44437b&utm_medium=cpc&utm_source=out&aid=005a03d7796300828ccd69472710e5adc2&utm_term=$publisher_name$&obOrigUrl=true
Title: Rotten Tomatoes' 22 Worst Movies Ever POPSUGAR

Search URL Search Domain Scan URL

URL: https://2e64c7.snzgdl.com/?subid1=0065d7d8e8fceaa44673b04e103a6125e0&subid2=009894fd20c638e69abc9581f0610dd49d&subid3=$publisher_id$---delimjuwe---$section_id$&subid4=outbrain-$ob_click_id$&network=outbrain&site=$section_id$&adtitle=Unverkaufte+Laptops+werden+f%C3%BCr+fast+nichts+verkauft&dpco=1&outbrainclickid=$ob_click_id$&obOrigUrl=true
Title: Unverkaufte Laptops werden für fast nichts verkauft Laptops | Suchanzeigen

Search URL Search Domain Scan URL

URL: https://www.conflictnations.com/index.php?id=322&lpv=1&L=0&r=94003&r=94003&placement=$publisher_name$_$section_name$&c=00c352f39376c9a59c64b4272b54beb58b&obOrigUrl=true
Title: Could you settle global conflicts? This simulation makes you a player in… Conflict of Nations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/startribune/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/StarTribune/
Title: Twitter

Search URL Search Domain Scan URL

URL: http://pinterest.com/startribune/
Title: Pinterest

Search URL Search Domain Scan URL

URL: http://www.instagram.com/startribune/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.queryly.com/
Title: search by queryly

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 94

https://smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/s31400110209891?AQB=1&ndh=1&pf=1&t=5%2F4%2F2022%2021%3A9%3A46%204%200&fid=0BB79D7335D16558-3147C74106571568&vmt=4DB8D2C6&vmf=metrics.startribune.com&ce=ISO-8859-1&ns=startribune&pageName=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&g=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cc=USD&events=event7&pe=lnk_o&pev2=private%20browser%20detected&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/s31400110209891?AQB=1&pccr=true&vidn=313A1E8D42F751BF-60001516F4C28429&ndh=1&pf=1&t=5%2F4%2F2022%2021%3A9%3A46%204%200&fid=0BB79D7335D16558-3147C74106571568&vmt=4DB8D2C6&vmf=metrics.startribune.com&ce=ISO-8859-1&ns=startribune&pageName=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&g=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cc=USD&events=event7&pe=lnk_o&pev2=private%20browser%20detected&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Request Chain 104

https://sb.scorecardresearch.com/b?c1=2&c2=8428425&ns__t=1651784986542&ns_c=UTF-8&cv=3.5&c8=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&c7=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=8428425&ns__t=1651784986542&ns_c=UTF-8&cv=3.5&c8=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&c7=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&c9=

Request Chain 155

https://www.startribune.com/api/personalize HTTP 301
https://www.startribune.com/api/personalize/

Request Chain 164

https://rp.liadm.com/j?dtstmp=1651784987160&aid=a-04p2&se=e30&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&tna=v2.3.0&pu=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&ext_s_vi=%5BCS%5Dv1%7C313A1E8D42F751BF-60001516F4C28429%5BCE%5D&wpn=lc-bundle&c=PHRpdGxlPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXMgLSBTdGFyVHJpYnVuZS5jb208L3RpdGxlPjxsaW5rIHJlbD0iY2Fub25pY2FsIiBocmVmPSJodHRwczovL3d3dy5zdGFydHJpYnVuZS5jb20vc3dlZXRoZWFydC1zY2Ftcy10YXJnZXRpbmctc2VuaW9ycy13cmVjay1maW5hbmNlcy1hbmQtZGV2YXN0YXRlLWZhbWlsaWVzLzYwMDE2NzAzMC8iPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJJcyBNb20gb3IgRGFkJ3MgbmV3IHNxdWVlemUgYSBmcmF1ZD8gT3IgYXJlICZxdW90O2hlbGljb3B0ZXIgY2hpbGRyZW4mcXVvdDsgYnV0dGluZyBpbiB3aGVyZSB0aGV5IGRvbid0IGJlbG9uZz8gIj48aDEgY2xhc3M9ImFydGljbGUtaGVhZGxpbmUiPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXM8L2gxPg HTTP 302
https://rp4.liadm.com/j?dtstmp=1651784987160&aid=a-04p2&se=e30&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&tna=v2.3.0&pu=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&wpn=lc-bundle&c=PHRpdGxlPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXMgLSBTdGFyVHJpYnVuZS5jb208L3RpdGxlPjxsaW5rIHJlbD0iY2Fub25pY2FsIiBocmVmPSJodHRwczovL3d3dy5zdGFydHJpYnVuZS5jb20vc3dlZXRoZWFydC1zY2Ftcy10YXJnZXRpbmctc2VuaW9ycy13cmVjay1maW5hbmNlcy1hbmQtZGV2YXN0YXRlLWZhbWlsaWVzLzYwMDE2NzAzMC8iPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJJcyBNb20gb3IgRGFkJ3MgbmV3IHNxdWVlemUgYSBmcmF1ZD8gT3IgYXJlICZxdW90O2hlbGljb3B0ZXIgY2hpbGRyZW4mcXVvdDsgYnV0dGluZyBpbiB3aGVyZSB0aGV5IGRvbid0IGJlbG9uZz8gIj48aDEgY2xhc3M9ImFydGljbGUtaGVhZGxpbmUiPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXM8L2gxPg&i6=MjAwMTphYzg6MjA6MjcyOjoyZQ%3D%3D&n3pc=true

Request Chain 171

https://c1.adform.net/serving/cookie/match?party=14&cid=972F0026-35CA-4B00-B65E-0D0186B9F64A HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=972F0026-35CA-4B00-B65E-0D0186B9F64A

Request Chain 173

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFIMmwwN0U2SG9BQUR6aDVMUmQxdw&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Request Chain 174

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:13106274-3d1c-4800-999e-7561e5f7c89f&gdpr=0&gdpr_consent=

Request Chain 175

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ly8AJjXKSwC2Xg0Bhrn2Sg%3D%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ly8AJjXKSwC2Xg0Bhrn2Sg%3D%3D&google_tc= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 177

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7a4d6274-3d1c-4e00-98dd-a982585fab83

Request Chain 178

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTcyRjAwMjYtMzVDQS00QjAwLUI2NUUtMEQwMTg2QjlGNjRB&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTcyRjAwMjYtMzVDQS00QjAwLUI2NUUtMEQwMTg2QjlGNjRB&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 179

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPLOP1dGWNUM-muH25YDM0I&google_cver=1

Request Chain 181

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3553154561202639106&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 184

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=972F0026-35CA-4B00-B65E-0D0186B9F64A&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=972F0026-35CA-4B00-B65E-0D0186B9F64A&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-etaf_MVE2uW2QdP5uYrif3FzjNzyhI4-~A&gdpr=0&gdpr_consent=

Request Chain 197

https://sync.mathtag.com/sync/img?mt_exid=36&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-04p2%2F0%2F366a34773f8e49e7a97ecafb0d5fe318%3Fmpid%3D7156%26muid%3D%5BMM_UUID%5D&3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42 HTTP 302
https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=7156&muid=7a4d6274-3d1c-4e00-98dd-a982585fab83

Request Chain 199

https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D HTTP 302
https://x.bidswitch.net/ul_cb/syncd?dsp_id=256&user_group=2&user_id=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D HTTP 302
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=c7a805c1-a924-403d-8b0f-811817ab3df3 HTTP 303
https://x.bidswitch.net/sync?ssp=liveintent&user_id=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42 HTTP 302
https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=liveintent HTTP 302
https://x.bidswitch.net/sync?dsp_id=188&user_id=gmninktZRSx47NyhPiT7TJJGdWw&user_group=1&ssp=liveintent HTTP 302
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=c7a805c1-a924-403d-8b0f-811817ab3df3

Request Chain 200

https://dpm.demdex.net/ibs:dpid=127444&dpuuid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-04p2%2F0%2F366a34773f8e49e7a97ecafb0d5fe318%3Fmpid%3D82775%26muid%3D%24%7BDD_UUID%7D HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=127444&dpuuid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-04p2%2F0%2F366a34773f8e49e7a97ecafb0d5fe318%3Fmpid%3D82775%26muid%3D%24%7BDD_UUID%7D HTTP 302
https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=82775&muid=37847770442068973854162994277148793725

Request Chain 201

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42 HTTP 302
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&rd=Y

Request Chain 203

https://b1sync.zemanta.com/usersync/liveintent/?cb=%2F%2Fi.liadm.com%2Fs%2F35004%3Fbidder_id%3D98254%26bidder_uuid%3D__ZUID__ HTTP 302
https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid= HTTP 303
https://i6.liadm.com/s/35004?bidder_id=98254&bidder_uuid=

Request Chain 204

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 210

https://eb2.3lift.com/ebda?sync=1&gdpr=1&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D

Request Chain 212

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D

Request Chain 214

https://pr-bh.ybp.yahoo.com/sync/triplelift/2183859531708002256195?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2662&xuid=y-u9QMPwpE2oQiOJglSjItqtepcmLCO9w3tIuevRpXUA--~A&dongle=0883

Request Chain 216

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=2183859531708002256195 HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=2183859531708002256195&dcc=t

Request Chain 217

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

229 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/ 359 KB
41 KB 1510ms
1470ms Document
text/html 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8258eba81486390ca4f592d4978e0f133ffba77f2d763eee6f865004e66229cc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
cf-cache-status: DYNAMIC
cf-ray: 706c7574cc239b55-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 05 May 2022 21:09:45 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare

GET
H2 200 main.js Show response
startribune.zeustechnology.com/ 207 KB
49 KB 67ms
7ms Script
application/javascript 13.32.99.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://startribune.zeustechnology.com/main.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-77.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 443d3cf527dcca16fb9ddd0d0207869b01267ffaf4cc6d9f0427b6e8e7855d41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: 9YUbtDngcoh8Lx10yr8Fd31Xmhq50Uyc
content-encoding: br
last-modified: Tue, 07 Dec 2021 15:28:00 GMT
server: AmazonS3
age: 1454
etag: W/"c73e08e7ecec4a7350e1270b5888b2f2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 0a71d283a25c1e3f082b4dbc9d844dfe.cloudfront.net (CloudFront)
cache-control: max-age=600,s-maxage=3600
date: Thu, 05 May 2022 20:49:30 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: xyXpOtteIXSxeTMgDRwSzKvums6ECSGRo-Bd1s27SAEvlOzt_4Rf1Q==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 135 KB
37 KB 35ms
7ms Script
application/javascript 108.138.16.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.16.177 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-16-177.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 1909b2a83fd41494d94862c4323944d9d0aa1f1e653f252ea5a73fc5944308b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: STlSjRvyyTgJyl_raxUeHIFBn6F5DqB3
content-encoding: gzip
etag: 4abd427e43cd6822329a2c05539e321f
age: 267
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 1HKRSP8APXVS9AH2YZJS
date: Thu, 05 May 2022 21:05:22 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 df327bd0c8709a81ade8602ac9ef16e0.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA56-P7
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: ErZj4Yl42-_Sq7IQkupYFTU-BFv-GFGNjOtBWxPFybvJNlgv0ioV2g==

GET
H2 200 jquery.min.js Show response
www.startribune.com/static/vendor/jquery/dist/ 94 KB
34 KB 43ms
41ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/vendor/jquery/dist/jquery.min.js?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4742
etag: W/"62742254-176f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c757e6fb49b55-FRA
expires: Sat, 04 Jun 2022 21:09:45 GMT

GET
H2 200 jquery-ui.min.js Show response
code.jquery.com/ui/1.11.3/ 234 KB
63 KB 148ms
89ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.11.3/jquery-ui.min.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: c48feaca5f6fa70585397cfbfb1ffd5a41b98ff4959d2c36d6f8b2f1f5b06de1

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:54 GMT
server: nginx
etag: W/"611feaca-3a99b"
vary: Accept-Encoding
x-hw: 1651784985.dop122.fr8.t,1651784985.cds168.fr8.hn,1651784985.cds279.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 64209

GET
H2 200 shims.js Show response
www.startribune.com/vendor/js/ 99 KB
33 KB 201ms
199ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/vendor/js/shims.js?d=1651780660
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 194bddaf8d8931c8448c70ba7594b6c3d5b5b498e32cd498a9fb8acb41bec72c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 05 May 2022 19:17:40 GMT
server: cloudflare
etag: W/"627422d4-18b3a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c757e6fb99b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 bugsnag.js Show response
www.startribune.com/vendor/js/ 38 KB
11 KB 682ms
680ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5731ba3eb13d83dc933a992ee948c49a112dd5cd8bd943be09d63af861d7bf6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 05 May 2022 19:17:40 GMT
server: cloudflare
etag: W/"627422d4-968f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c757e6fbb9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 startribune.js Show response
www.startribune.com/vendor/js/ 424 KB
117 KB 720ms
717ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/vendor/js/startribune.js?d=1651780660
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 064512d2c7ac68701fe8a95c2ab127d1b1679f45fc90f9d4e798b204535264c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 05 May 2022 19:17:40 GMT
server: cloudflare
etag: W/"627422d4-6a1da"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c757e6fc09b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 icon
fonts.googleapis.com/ 569 B
869 B 44ms
19ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

786f8e86896c85d5941a05d0519c32b261947a8c229f5581f308595381b7448e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 05 May 2022 21:09:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 05 May 2022 21:09:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 05 May 2022 21:09:45 GMT

GET
H2 200 3104270409.js Show response
cdn-pci.optimizely.com/js/ 605 KB
135 KB 80ms
22ms Script
text/javascript 23.205.242.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-pci.optimizely.com/js/3104270409.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.205.242.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-242-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 3b046f53b8fd2ddd9d786821fa3f2e6e57237a2cd020d129edba49edc0777529

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-meta-pci_enabled: True
x-amz-version-id: ZfMRj.aUjE5wfm47wFQBZ378z3W8D3o9
content-encoding: gzip
etag: "7e4a14da46669fda57986c9681a980c0"
x-amz-request-id: 0Y0FWCYW4J8JGJYQ
x-amz-meta-revision: 26129
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 136888
x-amz-id-2: TvWwlwMZWiGtT/noq9UWhjoR8cBafcpJR1GZTkUAS2vANmf8HZ03jiOkbeMY8kIBHqUttzwccT0=
last-modified: Thu, 05 May 2022 20:37:29 GMT
server: AmazonS3
date: Thu, 05 May 2022 21:09:45 GMT
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=600
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 screen.css
www.startribune.com/static/css/ 412 KB
61 KB 47ms
44ms Stylesheet
text/css 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b0487ca4e4d055b43695b3d79d41f5326c76973a0df0852dc90b7b8016f2dea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:38 GMT
server: cloudflare
age: 4613
etag: W/"627422d2-66faa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 706c757e6fc29b55-FRA
expires: Sat, 04 Jun 2022 21:09:45 GMT

GET
H2 200 header.vendor.min.js Show response
www.startribune.com/static/min/ 72 KB
22 KB 43ms
40ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/min/header.vendor.min.js?d=1651780642
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7c85f3d7ece16fc2394c5446e2e3e1f195c00179bccb210b36c88496747480c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:22 GMT
server: cloudflare
age: 4626
etag: W/"627422c2-12074"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c757e6fc39b55-FRA
expires: Sat, 04 Jun 2022 21:09:45 GMT

GET
H2 200 tti-polyfill.js Show response
unpkg.com/tti-polyfill@0.2.2/ 5 KB
2 KB 81ms
24ms Script
application/javascript 2606:4700::6810:7daf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/tti-polyfill@0.2.2/tti-polyfill.js

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7350b2ac8571e45f6df355bf93d32283ea4510429ae9b6df5b5cc1c2bf99d1e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 748837
fly-request-id: 01F48VCGWCF6NF58N575ZP6PM0
content-encoding: br
vary: Accept-Encoding
last-modified: Tue, 20 Jun 2017 21:17:24 GMT
server: cloudflare
etag: W/"13ad-/YkATmvP8OaiDCTnCgmjyMWglYI"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 706c757ecfcb01db-ZRH

GET
H2 200 AppMeasurement.js Show response
www.startribune.com/analytics-assets/sitecatalyst/ 45 KB
16 KB 663ms
661ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/analytics-assets/sitecatalyst/AppMeasurement.js?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a23f809d57a90856a15bbc2e97a7152f866bc8d3caf4daf564b29400115da830

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
etag: W/"62742254-b282"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c757e6fc49b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/ 37 KB
11 KB 58ms
25ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 565, 617, 617
age: 1115604
cdn-cachedat: 2021-04-23 01:12:58
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 050f74ba30aa09826217c7ecf77aa73a
cf-ray: 706c757e9a21020d-ZRH
cdn-requestcountrycode: CH
cdn-requestpullsuccess: True

GET
H2 403 a076d05399.js
kit.fontawesome.com/ 0
0 93ms
36ms Script
text/plain 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/a076d05399.js

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; preload
cf-ray: 706c757ec86123c7-ZRH
content-length: 40
x-request-id: FuxRsVVwnvItYyn49PiC

GET
H2 200 mainapp.build.js Show response
users.startribune.com/embed/ 205 KB
66 KB 72ms
49ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://users.startribune.com/embed/mainapp.build.js?c=ddea53e6fc5de3aa044b7152b11070794d8ae6ec
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe2d2acf53d793fbf319ed329c357c1f5af5da48ad7dc9a7ce33c3c4511f5acd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 13 Apr 2022 14:42:16 GMT
server: cloudflare
age: 70739
etag: W/"6256e148-332bb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Fri, 06 May 2022 01:30:46 GMT
cache-control: max-age=86400, public
cf-ray: 706c757e88099b55-FRA
cf-bgj: minify

GET
H2 200 growl.css
users.startribune.com/embed/third-party/ 2 KB
607 B 60ms
37ms Stylesheet
text/css 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://users.startribune.com/embed/third-party/growl.css
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe53f75618262939f434d7360e8efb44870d222a5533d2cbdb57b83bfdcd326

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 13 Apr 2022 14:39:38 GMT
server: cloudflare
age: 20252
etag: W/"6256e0aa-7ae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=86400, public
cf-ray: 706c757e88089b55-FRA
expires: Fri, 06 May 2022 15:32:13 GMT

GET
H2 200 colorbox.css
users.startribune.com/embed/third-party/ 5 KB
2 KB 52ms
29ms Stylesheet
text/css 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://users.startribune.com/embed/third-party/colorbox.css
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fa7e2c91b482631979bb9e1613e0017ab89d2092becf42f997002fd5f638bb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 13 Apr 2022 14:39:38 GMT
server: cloudflare
age: 38926
etag: W/"6256e0aa-1372"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=86400, public
cf-ray: 706c757e88059b55-FRA
expires: Fri, 06 May 2022 10:20:59 GMT

GET
H2 200 idangerous.swiper.css
www.startribune.com/static/vendor/swiper/dist/ 3 KB
1019 B 29ms
28ms Stylesheet
text/css 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/vendor/swiper/dist/idangerous.swiper.css?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbd1ebc8ad24a533074a4a5001e04131f66affb9a341d93e53a820847bbed820

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4742
etag: W/"62742254-c41"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 706c757e6fc69b55-FRA
expires: Sat, 04 Jun 2022 21:09:45 GMT

GET
H2 200 magnific-popup.css
www.startribune.com/static/vendor/magnific-popup/dist/ 8 KB
2 KB 36ms
35ms Stylesheet
text/css 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/vendor/magnific-popup/dist/magnific-popup.css?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 648aacd32da86d341dec60d5ece0de2cfc7d578e981fad920af31a8ad8ab874c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4742
etag: W/"62742254-1e7e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 706c757e6fc79b55-FRA
expires: Sat, 04 Jun 2022 21:09:45 GMT

GET
H2 200 chartbeat_mab.js Show response
static.chartbeat.com/js/ 22 KB
9 KB 45ms
7ms Script
application/x-javascript 2600:9000:223c:1a00:18:1fcd:34f:cdc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_mab.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:1a00:18:1fcd:34f:cdc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 4be319fc7e78bf1beb5b73bb76e33e445bf3170ebcd66fd72639743115287a2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:50:52 GMT
content-encoding: gzip
last-modified: Wed, 13 Apr 2022 00:18:19 GMT
server: nginx
age: 1134
etag: W/"625616cb-595b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
cache-control: max-age=7200
cross-origin-resource-policy: cross-origin
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: yE8HYcnWJgwOysC0tSya5GXFY3TyYlDSN2OV-fWhf1K0Cle3EYMMBg==
expires: Thu, 05 May 2022 22:50:52 GMT

GET
H2 200 quant.js Show response
edge.quantserve.com/ 24 KB
10 KB 56ms
4ms Script
application/javascript 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.quantserve.com/quant.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:45 GMT
content-encoding: gzip
etag: "u2JtyZzqnTXwzBUswy2r+w=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Thu, 12 May 2022 21:09:45 GMT

GET
H/1.1 403
Forbidden keywee.min.js
dc8xl0ndzn2cb.cloudfront.net/js/startribunecom/v0/ 0
0 40ms
6ms Script
text/html 18.66.107.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dc8xl0ndzn2cb.cloudfront.net/js/startribunecom/v0/keywee.min.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.107.155 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-107-155.fra56.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H2 200 search.svg
static.startribune.com/assets/queryly_search/ 510 B
645 B 344ms
24ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.startribune.com/assets/queryly_search/search.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e72f38bf3d37c3d117ee522bc23d12b15d950acdbe76b822461108395b6b0389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
via: 1.1 c31ad517510d586c0f2aa3c5dbc40b06.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 5168
x-cache: Miss from cloudfront
content-type: image/svg+xml
content-encoding: br
last-modified: Fri, 25 Jun 2021 19:59:42 GMT
server: cloudflare
etag: W/"472a9144e3e0eb088edd0d9a21029407"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: UGbhMKiTdIuOQ1Yb_fofzZryIRywHoGo
cache-control: public, max-age=300
x-amz-cf-pop: DUS51-P1
cf-ray: 706c75863e1e9b55-FRA
x-amz-cf-id: 9dp041zbQpE9_EFoT7rjvDTIkCBCLtiMqOmj1FPzrnMZ3RaxjlZJ6Q==
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 cogwheel-filled.svg
www.startribune.com/static/img/navigation/ 2 KB
965 B 24ms
21ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/navigation/cogwheel-filled.svg?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2e2354fca132f5f3d823d32c8fd0d29605d70a0f2afb30a2c6ab7e5059a1170

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4678
etag: W/"62742254-9ae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75843a779b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 eedition-filled.svg
www.startribune.com/static/img/navigation/ 2 KB
639 B 35ms
32ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/navigation/eedition-filled.svg?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9dbc312e7775ef5c4497342d0ad73cc63aaecd608bf72dc2caf90b021387cd0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4678
etag: W/"62742254-741"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75843a789b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 user-filled.svg
www.startribune.com/static/img/navigation/ 2 KB
594 B 25ms
22ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/navigation/user-filled.svg?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c2da6a4b58d98534cce3c565778d2ea4c7d007d45cb89b1def875604d531b3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4677
etag: W/"62742254-708"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75843a7b9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 blank.gif
apps.startribune.com/circulars/images/ 42 B
231 B 64ms
42ms Image
image/gif 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://apps.startribune.com/circulars/images/blank.gif
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
cf-cache-status: HIT
age: 6229
cf-polished: status=not_needed
last-modified: Fri, 04 Oct 2013 15:13:34 GMT
content-length: 42
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "524edb1e-2a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=300
accept-ranges: bytes
cf-ray: 706c75845ab79b55-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 30ms
17ms XHR
application/javascript 108.138.16.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.16.177 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-16-177.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: aaJeHz3g2a7aWr9hYquBq.aDaObnNoK3
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 69916
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 28 Apr 2022 01:41:20 GMT
server: AmazonS3
date: Thu, 05 May 2022 21:09:45 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 9672a97668a5842cedcfaee3e743019e.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-P7
x-amz-cf-id: BFjYWyiUj9HtJRCWysfM-PlyuWWYBL6u7XsTVqhExZ0Hwa61K7LBDg==

GET
H/1.1 200
OK 182254-63191772774302.js Show response
js-sec.indexww.com/ht/p/ 35 KB
13 KB 67ms
18ms Script
text/javascript 69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/182254-63191772774302.js
Requested by: Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a7d14fde1a49f3fda3483a0b5f76ea9224048392ba49784aac5ba7af214de6b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:46 GMT
Content-Encoding: gzip
Last-Modified: Thu, 05 May 2022 20:56:31 GMT
Server: Apache
ETag: "da495f-8c84-5de49fa0207bf"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3017
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 12381
Expires: Thu, 05 May 2022 22:00:03 GMT

GET
H2 200 userSync.js Show response
ads.pubmatic.com/AdServer/js/ 7 KB
3 KB 68ms
15ms Script
text/javascript 69.192.160.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/userSync.js
Requested by: Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.160.199 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-199.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:14 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300709-1af3-5c4c7cca9e573"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: public, max-age=68554
accept-ranges: bytes
content-type: text/javascript
content-length: 2267
expires: Fri, 06 May 2022 16:12:20 GMT

GET
H2 200 sync.js Show response
ib.3lift.com/ 275 B
572 B 34ms
7ms Script
application/javascript 13.32.99.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ib.3lift.com/sync.js
Requested by: Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-100.fra60.r.cloudfront.net
Software: /
Resource Hash: c815be0139a92202ff8f262cc335f6ae103594bb1d92c1c479ed604adf384a16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:56:24 GMT
via: 1.1 968007545c497b68cc41825f11e930ba.cloudfront.net (CloudFront)
last-modified: Thu, 05 May 2022 20:56:24 GMT
age: 802
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900
x-amz-cf-pop: FRA60-P3
content-length: 275
x-amz-cf-id: lrAwblF1dksRR36qCt8H-R62E2oBqoXapDfI5ftErWEoQJOd-zrqrw==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
28 KB 106ms
75ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

48383a41ed3bcfa3419a78d51f77f1b68ae556b2ccb4be1d997ecce7b7a8eaf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28370
x-xss-protection: 0
server: sffe
etag: "1206 / 429 of 1000 / last-modified: 1651780199"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2 200 merlin_67390653.jpg
chorus.stimg.co/23440063/ 6 KB
6 KB 84ms
43ms Image
image/jpeg 2606:4700::6810:d653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://chorus.stimg.co/23440063/merlin_67390653.jpg?h=91&w=145&fit=crop&bg=999&crop=faces

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:d653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92b316ab9957cdb1690d079cbf5695a38cf8d1aa4f3c25b9ce2e31895254b44c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11366
cf-polished: origSize=6712
x-cache: HIT, HIT
x-imgix-id: c73c0d12e69699c6c7f9e6f1b1c912eeacd9940f
content-length: 6218
x-served-by: cache-sjc10049-SJC, cache-fra19148-FRA
last-modified: Thu, 05 May 2022 16:22:22 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
expires: Fri, 05 May 2023 21:09:46 GMT
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 706c7584b88c2373-ZRH
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:100,h2pri

GET
H2 200 merlin_67391875.jpg
chorus.stimg.co/23440796/ 72 KB
72 KB 62ms
26ms Image
image/jpeg 2606:4700::6810:d653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://chorus.stimg.co/23440796/merlin_67391875.jpg?w=600&h=600&format=auto%2Ccompress&cs=tinysrgb

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:d653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b191c93881caa58694408be0088adc1db8efcf8405892655b7387c5554b8d409

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3414
cf-polished: status=not_needed
x-cache: HIT, HIT
x-imgix-id: ac1104e5f702d79b911e3fee6c666cf16ef30a2c
content-length: 73409
x-served-by: cache-sjc10064-SJC, cache-fra19169-FRA
last-modified: Thu, 05 May 2022 19:44:42 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
expires: Fri, 05 May 2023 21:09:46 GMT
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 706c7584b88e2373-ZRH
cross-origin-resource-policy: cross-origin
cf-bgj: imgq:100,h2pri

GET
H2 200 /
apps.startribune.com/most_popular/ 43 B
199 B 397ms
397ms Image
image/gif 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://apps.startribune.com/most_popular/?cmd=inc&type=view&section=%2Fvariety&story_id=600167030
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
cf-cache-status: DYNAMIC
last-modified: Fri, 04 Oct 2013 15:13:26 GMT
server: cloudflare
etag: "524edb16-2b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif
cache-control: no-cache
accept-ranges: bytes
cf-ray: 706c75849b319b55-FRA
content-length: 43
expires: Thu, 05 May 2022 21:09:45 GMT

GET
H2 200 footer.vendor.min.js Show response
www.startribune.com/static/min/ 69 KB
23 KB 54ms
53ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/min/footer.vendor.min.js?d=1651780642
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ccc7150bb665c96f9db6bcc77a0532f65f015665a82df05af2bdf8b9673ac42c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:22 GMT
server: cloudflare
age: 4626
etag: W/"627422c2-1140f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c7582af929b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 footer.min.js Show response
www.startribune.com/static/min/ 23 KB
7 KB 24ms
24ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/min/footer.min.js?d=1651780637
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7af33583b997a7b91c6c5e0529d1954955b104190348bfdea4f9dcb2b12b246a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:17 GMT
server: cloudflare
age: 4626
etag: W/"627422bd-5dee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c7582f8239b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 queryly.v4.js Show response
www.queryly.com/js/ 45 KB
10 KB 88ms
32ms Script
application/x-javascript 2606:4700:20::ac43:497c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.queryly.com/js/queryly.v4.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:497c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: bd9bba4e41543bae3381e199fca2b629c99839ca0ea5608bb6b662fa999dc4c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 71977
x-powered-by: ASP.NET
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
last-modified: Fri, 22 Apr 2022 00:52:59 GMT
server: cloudflare
etag: W/"8067ab4fe355d81:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UJpsct5zbPOoBv2LntAiZNXE5%2FFi2cSBn7VtU5cizYbMyBvfHG5Qt%2Bm0A0bcT8F2T7KjKvlN6t6%2FuVgku6dpKkwfGYubTZKJhaun0wlKbLrCzCl2lYSPD9SGGgZGy9ylmhQxtrLIeZnWZAA0lQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 706c7584986359dd-MXP
access-control-allow-headers: *

GET
H2 200 pym.min.js Show response
www.startribune.com/static/vendor/pym.js/ 9 KB
3 KB 38ms
34ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/vendor/pym.js/pym.min.js?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7f736144a4c3c86a1e620f94d91b3c0eedcadac33888203e554dc2e7c3cfa66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4742
etag: W/"62742254-234a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c75843a739b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 article.vendor.min.js Show response
www.startribune.com/static/min/ 76 KB
22 KB 33ms
30ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/min/article.vendor.min.js?d=1651780642
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe0fa35cc17d816ca780946cfee61e0b1054d2693f00781ba99a609403e579af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:22 GMT
server: cloudflare
age: 4626
etag: W/"627422c2-12ecf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c75843a749b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 article.min.js Show response
www.startribune.com/static/min/ 6 KB
2 KB 34ms
30ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/min/article.min.js?d=1651780637
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ff6c8c0aa24917d6570e9e2f0fd5db27505ca2ac10709b462fc62914a802dd5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:17 GMT
server: cloudflare
age: 4626
etag: W/"627422bd-171a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c75843a759b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 StarTribunePageConfiguration.js Show response
www.startribune.com/analytics-assets/sitecatalyst/ 15 KB
6 KB 32ms
29ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/analytics-assets/sitecatalyst/StarTribunePageConfiguration.js?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03e7600e2ab3ad43bdbff18264184c0ab0996ecf9ea47bd854046b0ba522ed5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 58
etag: W/"62742254-3d5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c75843a769b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 123 KB
43 KB 73ms
24ms Script
application/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-5FJSN5B

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9db1b57a1f2a6aa8912555c191752479e7b2bb69c35be1f77da3e26fad0a19e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43644
x-xss-protection: 0
expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2 200 e2ma.js Show response
dk98ddgl0znzm.cloudfront.net/ 2 KB
2 KB 36ms
8ms Script
application/javascript 2600:9000:2250:6e00:b:c006:c80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dk98ddgl0znzm.cloudfront.net/e2ma.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:6e00:b:c006:c80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aab005e1e9c3d72739f90a0599a16112cd7713958aa506a36fadfc3030e90083

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: EVTdvh.cjMfGyK99DUWIUQF28TpmAa95
content-encoding: gzip
etag: W/"5f4361bbb5893a069002b83b10be287f"
last-modified: Fri, 07 Feb 2020 16:09:43 GMT
server: AmazonS3
age: 243902
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 375431e28d82888f474ac3665a4ceb66.cloudfront.net (CloudFront)
cache-control: max-age=604800
date: Tue, 03 May 2022 01:24:44 GMT
x-amz-cf-pop: FRA60-P2
x-amz-cf-id: BwWhHeCyLhUsPpWQDOzXankLhJSgG7sR6D3zndfLzoa73ZygFgLilQ==

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 107ms
70ms Script
text/javascript 2606:4700:440e::6812:2fe6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 706c7584ef51021d-ZRH

POST
H2 202 / Show response
sessions.bugsnag.com/ 21 B
97 B 148ms
148ms XHR
application/json 2600:1901:0:7a0b::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sessions.bugsnag.com/
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:7a0b:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: 0ba7c0356149946bf0642fab4ef85b95e7090f6f785d0fb84323d0c442e5190a

Request headers

Bugsnag-Payload-Version: 1.0
Referer: https://www.startribune.com/
Bugsnag-Sent-At: 2022-05-05T21:09:46.027Z
accept-language: de-DE,de;q=0.9
Bugsnag-Api-Key: 57098e87943fb0b8bcf51a8ffc9ca41a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Thu, 05 May 2022 21:09:46 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21
content-type: application/json

OPTIONS
H2 200 /
sessions.bugsnag.com/ Frame 0
0 169ms
148ms Preflight 2600:1901:0:7a0b::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sessions.bugsnag.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:7a0b:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: bugsnag-api-key,bugsnag-payload-version,bugsnag-sent-at,content-type
Access-Control-Request-Method: POST
Origin: https://www.startribune.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-headers: Origin, Content-Type, Accept, Authorization, User-Agent, Referer, X-Forwarded-For, Bugsnag-Api-Key, Bugsnag-Payload-Version, Bugsnag-Sent-At
access-control-allow-methods: POST
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 05 May 2022 21:09:46 GMT
via: 1.1 google

GET
H/1.1 200
OK wrap.js Show response
clarium.global.ssl.fastly.net/gpt/a/ 117 KB
37 KB 51ms
8ms Script
application/json 151.101.193.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/startribune.js?d=1651780660
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 505ac39a77f9d7a883cdcc25763d5d21526f4d74340a0143ad2c3b79ed78ffb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-meta-sha1: 4e673949dba548ae96c1866a340710969fb509fb
Date: Thu, 05 May 2022 21:09:46 GMT
Content-Encoding: gzip
Age: 41
X-Cache: HIT
Connection: keep-alive
Content-Length: 37609
x-amz-id-2: sWElrAoqL71bLWc0n4NjzvwZyCoKci7B3B486JOVaFueg9z+dkDAnXHzezPt+nB9hY9N7zVWt1E=
X-Served-By: cache-hhn4042-HHN
Last-Modified: Tue, 03 May 2022 17:19:49 GMT
Server: AmazonS3
X-Timer: S1651784986.389732,VS0,VE0
ETag: "1419bdd2511d8f8b7c91306d08de9d2a"
Vary: Accept-Encoding
x-amz-request-id: VMMHAABC6Z4DQTDC
Via: 1.1 varnish
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: application/json
X-Cache-Hits: 2

GET
H2 200 a30ed0c6e59d8bc6c6bf.js Show response
www.startribune.com/vendor/js/ 16 KB
5 KB 34ms
32ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/vendor/js/a30ed0c6e59d8bc6c6bf.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/startribune.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1588f72b26dece08032b25ba478f162b373ced6bf078e744eb8b3a570731c45f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:40 GMT
server: cloudflare
age: 56
etag: W/"627422d4-3f94"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c75843a7c9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 4cb3e2cab716988cae6b.js Show response
www.startribune.com/vendor/js/ 11 KB
4 KB 30ms
29ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/vendor/js/4cb3e2cab716988cae6b.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/startribune.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba29d48f1bb3678b362c54b6dd7661486fa1f125ab34c7e8875f6c49f28bd4c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:40 GMT
server: cloudflare
age: 56
etag: W/"627422d4-2aae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c75843a7e9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 183 KB
57 KB 68ms
41ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KD2KG7V

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bfcd2ba094844ba647d3efc48ff52401f963465c2b255e17958ded4300099bbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 58204
x-xss-protection: 0
expires: Thu, 05 May 2022 21:09:46 GMT

GET
H/1.1 200
OK 3104270409 Show response
tapi.optimizely.com/api/js/odds/project/ 186 B
608 B 448ms
417ms XHR
application/json 2a02:26f0:1700:1b2::19f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://tapi.optimizely.com/api/js/odds/project/3104270409?project=3104270409
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/3104270409.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:1700:1b2::19f0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx / Express
Resource Hash: aaac4cbaa8b811ff5a3f2ed45a5e8a24eceff8eb7cc9d0617c1111f00271e082

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 21:09:46 GMT
Server: nginx
X-Uncacheable: WTF
X-Powered-By: Express
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.startribune.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 186
Expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2 200 geo4.js Show response
cdn-pci.optimizely.com/js/ 312 B
746 B 15ms
14ms Script
application/javascript 23.205.242.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-pci.optimizely.com/js/geo4.js
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/3104270409.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.205.242.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-242-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 3a94613aee89a716410ca05e34b1f204e200569da359be8a83f665717b045cfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: OAjfW2hsfUCB6ky0IKAo94yDIUDQOyvh
server: AmazonS3
x-amz-request-id: K4WWFACA7ZRNPT0N
etag: "ab711da6d329d2f9dabaf111028b5243"
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
date: Thu, 05 May 2022 21:09:46 GMT
x-amz-replication-status: COMPLETED
timing-allow-origin: *
access-control-allow-headers: *
content-length: 312
x-amz-id-2: eKNY8RwO4P7txIKwKbqjvfl+2eW/eJ6tRPwjVfOpB/bHMkuUDE1c54NyzERO+UaCAXueQlwj3fw=

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 166 KB
61 KB 46ms
27ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KWTSNPP

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

32f99c53d803787082fa622605de20425d576183eee33c1ea549bb7786d6393f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61643
x-xss-protection: 0
expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2 200 rules-p-0fEc9CMkDiJ2g.js Show response
rules.quantcount.com/ 3 B
429 B 41ms
7ms Script
application/javascript 2600:9000:223c:a200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-0fEc9CMkDiJ2g.js
Requested by: Host: edge.quantserve.com
URL: https://edge.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:a200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 01:16:08 GMT
via: 1.1 cb4c4a25e4ef534686959996782c8476.cloudfront.net (CloudFront)
age: 71619
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:41:23 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: Z7gIr7PhLYSl4djjmznPtvFilDSa612sb_DKWOxY3xcTxK9noX8keQ==

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 44ms
9ms Script
application/javascript 18.66.139.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.139.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-139-6.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 01:46:07 GMT
content-encoding: gzip
etag: W/"1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 69820
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-cf-id: rVooEDWbOm8AMz6O1OfNff_L-eFF2tTnosaSS9CFjVN2vjs_9TQHSw==

GET
H2 200 embed.js Show response
comments.startribune.com/assets/js/ 58 KB
17 KB 61ms
9ms Script
application/javascript 2600:9000:2240:de00:1b:9dc4:7dc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.startribune.com/assets/js/embed.js

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:de00:1b:9dc4:7dc0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

223c7e0c5c07f06fa0becc80797f8d8346209c7866b050608cca339ff32ea414

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1690
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000
content-length: 17046
x-xss-protection: 1; mode=block
x-trace-id: 25c59220-c8ba-11ec-8d9e-e9848625f699
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 19 Oct 2021 16:26:10 GMT
x-frame-options: SAMEORIGIN
etag: W/"4296-17c995fe0d0"
vary: Accept-Encoding, Origin
content-language: en-US
via: 1.1 d954dd318e06aa0e69375f36dcd819de.cloudfront.net (CloudFront)
cache-control: public, max-age=1800, s-max-age=604800
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: application/javascript; charset=UTF-8
x-amz-cf-id: IKZClib-rDGrwKmqyCTnffgKZbwFNRJyue2AHTUlYnfpVKvWGBnAiQ==

GET
H2 200 icn-nav-utility-home-12-12.svg
www.startribune.com/static/img/icons/ 1 KB
793 B 46ms
45ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-utility-home-12-12.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30b5b387b2af0422603fb083bb5fef7bb8ea4dd9448752974aef34cb07a819e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 18:47:41 GMT
server: cloudflare
age: 556317
etag: W/"62683e4d-5dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845aa79b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-utility-sections-12-12.svg
www.startribune.com/static/img/icons/ 1 KB
684 B 47ms
46ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-utility-sections-12-12.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ba041d459ff73bbea0b0eca169115b9408d1d4b034bf5fd2037acb099bce2d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1553966
etag: W/"62599f3c-48d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845aab9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-shortnav-logo-160-25.svg
www.startribune.com/static/img/icons/ 5 KB
2 KB 45ms
44ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-shortnav-logo-160-25.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df226a155adce3a6de39dd9490d5a6ee7749b4f980cb1065014aa26042b769b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 21 Apr 2022 21:46:14 GMT
server: cloudflare
age: 844369
etag: W/"6261d0a6-14c9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845aac9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-sections-menu-arrow-up-25-15.svg
www.startribune.com/static/img/icons/ 1 KB
692 B 49ms
48ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-sections-menu-arrow-up-25-15.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7f86a23e0fe2e080671e9ab403c0f97b903d310a6ddbf0a2f6d7f0cff64759f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1558426
etag: W/"62599f3c-5c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845aae9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-arrow-grey-5-7.svg
www.startribune.com/static/img/icons/ 2 KB
920 B 44ms
43ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-arrow-grey-5-7.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8868b02f90658ebee9ce3733b03496b440dc7683ffbdd855742bcaa14bca4d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1553967
etag: W/"62599f3c-88a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845aaf9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-recirculation-prev-32-60.svg
www.startribune.com/static/img/icons/ 2 KB
881 B 45ms
44ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-recirculation-prev-32-60.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8084b55ac306c38df5f25b19877a7c9ff2772a55d60b83ee34f359b021d6b0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 18:47:41 GMT
server: cloudflare
age: 554410
etag: W/"62683e4d-79c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845ab19b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-recirculation-next-32-60.svg
www.startribune.com/static/img/icons/ 2 KB
856 B 47ms
47ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-recirculation-next-32-60.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd565ca42e11e3e16d770fdcfa20aceff863765d4ce338977774fb9d0aec5b48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1553455
etag: W/"62599f3c-78f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845ab39b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-social-textresize-50-50.svg
www.startribune.com/static/img/icons/ 819 B
585 B 46ms
45ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-social-textresize-50-50.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f985fdac841e2ed8bd742ab8c4ab6c774b2b749a38b9e443e18f6216a2ad8b6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1553455
etag: W/"62599f3c-333"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845ab59b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-social-facebook-50-50.svg
www.startribune.com/static/img/icons/ 762 B
549 B 44ms
43ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-social-facebook-50-50.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 521cb2d82b678a871ef9ffa3d0a64c5efd25b8205aa58ef7c09aaeb48028091c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1552930
etag: W/"62599f3c-2fa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75845ab99b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-social-twitter-50-50.svg
www.startribune.com/static/img/icons/ 1 KB
727 B 45ms
43ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-social-twitter-50-50.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1c13d3b4098b4b72a1d1c9e7c64e6e2cfabab881592539094fc2792cbd5d3c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1552931
etag: W/"62599f3c-459"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75846abf9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-social-email-50-50.svg
www.startribune.com/static/img/icons/ 795 B
554 B 45ms
44ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-social-email-50-50.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ac1ce876b1c079aa5121f78f4ac4a7d3eacdce4e01800204e8f9354d5ca38ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1552930
etag: W/"62599f3c-31b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75846ac09b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-social-print-50-50.svg
www.startribune.com/static/img/icons/ 2 KB
1021 B 45ms
44ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-social-print-50-50.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3dfcfe46812ed1dd92422b09ea616ca4e0c3fe2fca3b6629c929fdb20050bf76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1553456
etag: W/"62599f3c-8cd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75846ac49b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-reportercontact-email-28-28.svg
www.startribune.com/static/img/icons/ 2 KB
993 B 43ms
42ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-reportercontact-email-28-28.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e35459ebc980180795eeb562f13e11f2e658799cf211eedd86f03ce2b49a6eab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Apr 2022 14:47:04 GMT
server: cloudflare
age: 1286763
etag: W/"62601ce8-87e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75846ac69b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-reportercontact-phone-28-28.svg
www.startribune.com/static/img/icons/ 3 KB
1 KB 43ms
42ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-reportercontact-phone-28-28.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 073dc6cd62ff2feadf27900c4b57bccdb41dc4864a3a5f078a1c6d21362788d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 18:47:41 GMT
server: cloudflare
age: 552609
etag: W/"62683e4d-a52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75846ac79b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-reportercontact-twitter-28-23.svg
www.startribune.com/static/img/icons/ 3 KB
1 KB 45ms
44ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-reportercontact-twitter-28-23.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a75b9f2e608b1229187c60c7ae222219f1f3bf9bce8c764f3962c6659f438402

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1553220
etag: W/"62599f3c-c82"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75846ac89b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 c80c8df9-343a-4ee8-a64b-6213022724fd-3.woff
apps.startribune.com/fonts/Benton-Sans-Regular/ 60 KB
60 KB 45ms
24ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Benton-Sans-Regular/c80c8df9-343a-4ee8-a64b-6213022724fd-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3552f4c0b476b6d2bf67cb91fd10bafc9179a565e7152a3a2db69467e4b2b1b

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:33 GMT
server: cloudflare
age: 6707
etag: W/"54e4e115-f057"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75847ad49bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 34ba72ff-8e42-428e-b0a6-d43e43d09b7f-3.woff
apps.startribune.com/fonts/Benton-Sans-Bold/ 58 KB
58 KB 54ms
33ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Benton-Sans-Bold/34ba72ff-8e42-428e-b0a6-d43e43d09b7f-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cadc7e9c3c04fa463d9d6154f00e5a4a9e3fd1b4e4981541670e917cf5001be6

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:34 GMT
server: cloudflare
age: 5120
etag: W/"54e4e116-e887"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848ad69bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 90508854-65ad-4bc0-b4f5-13734269e40e-3.woff
apps.startribune.com/fonts/Whitman-Bold-OSF/ 33 KB
33 KB 54ms
33ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Whitman-Bold-OSF/90508854-65ad-4bc0-b4f5-13734269e40e-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa2efed3da08343d692099d9204c3e8b5b28cd0ceb5fcb57eb5415195f529cda

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:36 GMT
server: cloudflare
age: 7181
etag: W/"54e4e118-85bc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848ad89bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 8406d32c-8dc4-4285-a5ee-200b97edd2ab-3.woff
apps.startribune.com/fonts/Whitman-Display-Cond-Bold/ 39 KB
36 KB 54ms
33ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Whitman-Display-Cond-Bold/8406d32c-8dc4-4285-a5ee-200b97edd2ab-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb34f0a124215447457dec3c493304b624e796311a2536cab6ac040ae4247804

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:34 GMT
server: cloudflare
age: 2735
etag: W/"54e4e116-9d96"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848adb9bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 6da0e483-5b55-412e-9685-611b9bb101fd-3.woff
apps.startribune.com/fonts/Poynter-Serif-RE/ 23 KB
22 KB 54ms
33ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Poynter-Serif-RE/6da0e483-5b55-412e-9685-611b9bb101fd-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 887b7aa798b08fed889bbbfa2595ff741957a0ecbb0b7ceaae2a13bd6be80783

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:34 GMT
server: cloudflare
age: 6707
etag: W/"54e4e116-5c42"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848adc9bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 a9cccbf1-281e-4903-b5f3-4b5dcd9d9cfa-3.woff
apps.startribune.com/fonts/Poynter-Serif-RE-Bold/ 23 KB
22 KB 53ms
33ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Poynter-Serif-RE-Bold/a9cccbf1-281e-4903-b5f3-4b5dcd9d9cfa-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a83f13a1cf894555955c2d209c92c8ed9a261482f742dc6f967e5147861988b

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:34 GMT
server: cloudflare
age: 6309
etag: W/"54e4e116-5ccb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848ade9bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 fcc7dbe8-7d79-4278-a765-8e1eb8535c3f-3.woff
apps.startribune.com/fonts/Poynter-Serif-RE-Italic/ 24 KB
23 KB 53ms
34ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Poynter-Serif-RE-Italic/fcc7dbe8-7d79-4278-a765-8e1eb8535c3f-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2184861aab4d7c29703b8655e43b83d30891131df2af9cc9033d1fb18b2ff9dc

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:36 GMT
server: cloudflare
age: 7083
etag: W/"54e4e118-5f8a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848ae89bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 06f4dbf6-2449-4b99-9621-e8abb9e595a2-3.woff
apps.startribune.com/fonts/Benton-Sans-Condensed-Medium/ 65 KB
64 KB 52ms
33ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Benton-Sans-Condensed-Medium/06f4dbf6-2449-4b99-9621-e8abb9e595a2-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4123e3d83dc27ad19d34ed202c2b0b6ce4165a14521692c155dd69ae5713841a

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:34 GMT
server: cloudflare
age: 2735
etag: W/"54e4e116-102f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848adf9bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 cec9083e-fac8-488a-8891-4f7eacf77220-3.woff
apps.startribune.com/fonts/Popular-Bold/ 39 KB
38 KB 51ms
32ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Popular-Bold/cec9083e-fac8-488a-8891-4f7eacf77220-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5cb1cccd20f5bed658ff31f05112adfec80af47252e9a41ab9b947b67a4818fd

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:34 GMT
server: cloudflare
age: 2735
etag: W/"54e4e116-9a74"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848ad99bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 c35df3ea-93e1-47b6-9629-bc761414cf65-3.woff
apps.startribune.com/fonts/Whitman-Roman-OSF/ 34 KB
33 KB 52ms
34ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Whitman-Roman-OSF/c35df3ea-93e1-47b6-9629-bc761414cf65-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f13313560f4e8a7730d2636aa1b5d69bf64998aa02007206ccf6dc6a6044073

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:35 GMT
server: cloudflare
age: 6707
etag: W/"54e4e117-8700"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c75848aeb9bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 border-diagonal-5-5.png
www.startribune.com/static/img/patterns/ 104 B
192 B 22ms
22ms Image
image/png 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/patterns/border-diagonal-5-5.png
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fadb64b7b2828f2866d9b2d47e58f47ada8437fc72164f2ea950ff6d0eba05dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 18:47:41 GMT
server: cloudflare
age: 555830
etag: "62683e4d-68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 706c7584cba79b55-FRA
content-length: 104
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 64136bfc-6015-473a-b534-6f235774c8ab-3.woff
apps.startribune.com/fonts/Popular-Light/ 40 KB
39 KB 26ms
26ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Popular-Light/64136bfc-6015-473a-b534-6f235774c8ab-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5341d81f1ab5079c3567a929a79519675da8bad6067d314ec9ad02a332bcf41d

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:34 GMT
server: cloudflare
age: 2735
etag: W/"54e4e116-9fb3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c7584db949bdc-FRA
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 icn-nav-footer-logo-250-68.svg
www.startribune.com/static/img/icons/ 14 KB
4 KB 21ms
20ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-footer-logo-250-68.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a999c35be19ab39bf2b81d2adc2e06223be301d5b7d7550151d16da8e003efb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1558426
etag: W/"62599f3c-3994"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75850c249b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-footer-social-facebook-32-32.svg
www.startribune.com/static/img/icons/ 1 KB
864 B 21ms
21ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-footer-social-facebook-32-32.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac2f63aa8eb6183c69f1b96e12c3f45af4f7f7996d8a954fd96b1d4cedf11a92

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1558426
etag: W/"62599f3c-5ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75850c289b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-footer-social-twitter-32-32.svg
www.startribune.com/static/img/icons/ 2 KB
1 KB 24ms
24ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-footer-social-twitter-32-32.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74002ad9febb2d3e35b7342b799a72d6771e6834747e961fc59f38f028b1fe8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 18:47:41 GMT
server: cloudflare
age: 556317
etag: W/"62683e4d-815"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75850c299b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-footer-social-pinterest-32-32.svg
www.startribune.com/static/img/icons/ 5 KB
2 KB 20ms
19ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-footer-social-pinterest-32-32.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdaa9050a0320268f290feed6d773fbc5c200980fb439fd6ae4e7cff1ea5f298

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 21 Apr 2022 21:46:14 GMT
server: cloudflare
age: 842389
etag: W/"6261d0a6-13c9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75850c2b9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-nav-footer-social-instagram-32-32.svg
www.startribune.com/static/img/icons/ 5 KB
2 KB 24ms
23ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-nav-footer-social-instagram-32-32.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47d32110d2841d1f80713cab5d19775760b13e34a5fc87e5825321df5a264aff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 21 Apr 2022 21:46:14 GMT
server: cloudflare
age: 847758
etag: W/"6261d0a6-13cb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75850c2c9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 whitecloseicon.png
www.queryly.com/images/ 816 B
1 KB 33ms
33ms Image
image/png 2606:4700:20::ac43:497c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.queryly.com/images/whitecloseicon.png
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:497c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 63414c077003319f186a974d9be8a8a09a07a178e6bbe29181d93b6cd8dccff9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 158423
x-powered-by: ASP.NET
content-length: 816
last-modified: Thu, 11 Jun 2020 23:20:57 GMT
server: cloudflare
etag: "d7046f64640d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cGeHAS9RbpDYy5pK0JAHBATmtsrZorIXuE0Zy4YvrAvk76DIm%2B4PuV1rPmB0Rz%2BIEJ3Hu5ydg64Lbm5uBhkSU0UrALTZpVJC0XIH0pp8%2FjSxeqBcYMB%2BlbEXKufLYJ%2BOTXmQb72JVhg1ZLJRVA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 706c75855a7259dd-MXP
access-control-allow-headers: *

GET
H2 200 modal.twig Show response
www.startribune.com/twig/components/ 474 B
322 B 47ms
46ms XHR
text/html 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/twig/components/modal.twig
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/min/header.vendor.min.js?d=1651780642
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0761d20bb2e9b2420af2e1726c05da5b68c55ee01433fe742e48edbffef68c9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
age: 56
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: text/html
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 706c75855ca99b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Fri, 06 May 2022 21:08:50 GMT

GET
H2 200 modal-video.twig Show response
www.startribune.com/twig/components/ 500 B
543 B 25ms
25ms XHR
text/html 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/twig/components/modal-video.twig
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/min/header.vendor.min.js?d=1651780642
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 911961bc53d17352d7527a8c1db7fe14ce93af033e2bf7a54b40a588c5651229

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
age: 56
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: text/html
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
cf-ray: 706c75855caa9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Fri, 06 May 2022 21:08:50 GMT

GET
H2 200 session Show response
www.startribune.com/login/ 0
683 B 737ms
737ms XHR
text/html 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/login/session
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/vendor/jquery/dist/jquery.min.js?d=1651780532
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c75855cab9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

s31400110209891
smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/
Redirect Chain

https://smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/s31400110209891?AQB=1&ndh=1&pf=1&t=5%2F4%2F2022%2021%3A9%3A46%204%200&fid=0BB79D7335D16558-3147C74106571568&vmt=4DB8D2C6&vmf=metrics.s...
https://smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/s31400110209891?AQB=1&pccr=true&vidn=313A1E8D42F751BF-60001516F4C28429&ndh=1&pf=1&t=5%2F4%2F2022%2021%3A9%3A46%204%200&fid=0BB79D7335D...

43 B
271 B

18ms
18ms

Image
image/gif

13.36.218.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/s31400110209891?AQB=1&pccr=true&vidn=313A1E8D42F751BF-60001516F4C28429&ndh=1&pf=1&t=5%2F4%2F2022%2021%3A9%3A46%204%200&fid=0BB79D7335D16558-3147C74106571568&vmt=4DB8D2C6&vmf=metrics.startribune.com&ce=ISO-8859-1&ns=startribune&pageName=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&g=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cc=USD&events=event7&pe=lnk_o&pev2=private%20browser%20detected&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Server

13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
x-content-type-options: nosniff
x-c: main-1640.Id95fac.M0-564
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 06 May 2022 21:09:46 GMT
server: jag
xserver: anedge-b4b698fcd-nlf8s
etag: 3547181249301839872-4619868262722707969
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 04 May 2022 21:09:46 GMT

Redirect headers

date: Thu, 05 May 2022 21:09:46 GMT
x-content-type-options: nosniff
x-c: main-1640.Id95fac.M0-564
p3p: CP="This is not a P3P policy"
vary: Origin
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
location: https://smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/s31400110209891?AQB=1&pccr=true&vidn=313A1E8D42F751BF-60001516F4C28429&ndh=1&pf=1&t=5%2F4%2F2022%2021%3A9%3A46%204%200&fid=0BB79D7335D16558-3147C74106571568&vmt=4DB8D2C6&vmf=metrics.startribune.com&ce=ISO-8859-1&ns=startribune&pageName=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&g=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cc=USD&events=event7&pe=lnk_o&pev2=private%20browser%20detected&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
last-modified: Fri, 06 May 2022 21:09:46 GMT
server: jag
xserver: anedge-b4b698fcd-7z2xn
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 04 May 2022 21:09:46 GMT

GET
H2 204 insights.gif
ds.reson8.com/ 0
169 B 54ms
16ms Image
text/plain 104.18.9.110
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ds.reson8.com/insights.gif?rand=1651784986484&t=0&pixt=resonate&advkey=0013000000O4v2fAAB&opptykey=STRI0117A&evkey=159130&evtype=custom&resnc1=esp&resnc2=open&resnc3=&resnc4=D=g&resnc6=&resnc7=undefined&resnc8=Not%20Logged%20In&resnc9=New

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.9.110 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
server: cloudflare
cf-ray: 706c7585ccc35bf1-FRA
date: Thu, 05 May 2022 21:09:46 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 57 B
416 B 14ms
14ms XHR
application/json 108.138.16.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3151&u=https%3A%2F%2Fwww.startribune.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.16.177 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-16-177.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 8ea9df9aa296a2eac3fe1a8b6972fecea49c7295f723cf9c93356ff9301a09ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 17:28:03 GMT
via: 1.1 df327bd0c8709a81ade8602ac9ef16e0.cloudfront.net (CloudFront)
server: Server
age: 13303
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.startribune.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P7
content-length: 57
x-amz-cf-id: 53_L_UWhiymHjjbwqGpbudhaK3K1s7-9bYNqPWbRTpOU1_E8moyA5Q==

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
393 B 100ms
31ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=182254
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/182254-63191772774302.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: a7e091316dc3fa0efb8087abed0f2f7ba6a40f34833b629f9e538e8cc605c4bc

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.startribune.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 form-af8d1ecde2947c2491fbb744e17f6653.js Show response
dk98ddgl0znzm.cloudfront.net/ 13 KB
5 KB 7ms
7ms Script
application/javascript 2600:9000:2250:6e00:b:c006:c80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dk98ddgl0znzm.cloudfront.net/form-af8d1ecde2947c2491fbb744e17f6653.js
Requested by: Host: dk98ddgl0znzm.cloudfront.net
URL: https://dk98ddgl0znzm.cloudfront.net/e2ma.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:6e00:b:c006:c80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1932da1682d444e6101f31f7e54079b63b5d4821eddf7acff9326b614b245332

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 25 Feb 2022 00:06:00 GMT
content-encoding: gzip
last-modified: Fri, 07 Feb 2020 16:09:43 GMT
server: AmazonS3
age: 6037427
etag: W/"af8d1ecde2947c2491fbb744e17f6653"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: ShAWl5PeBAzoGuGvN6LktpYK5OAGXjv3
via: 1.1 375431e28d82888f474ac3665a4ceb66.cloudfront.net (CloudFront)
cache-control: max-age=63072000
x-amz-cf-pop: FRA60-P2
content-type: application/javascript; charset=utf-8
x-amz-cf-id: BxoyqjL2ZVG7LYAbipQIoWwCykB0seRf6PYHJFIOfHLOw-_WDm05bw==

GET
H2 200 / Show response
mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/ 246 B
535 B 167ms
115ms XHR
application/json 2a04:4e42:200::714
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/?host=startribune.com&domain=startribune.com&path=%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F
Requested by: Host: static.chartbeat.com
URL: https://static.chartbeat.com/js/chartbeat_mab.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::714 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 89d825984b5cba89b134d1f9e760c671741d0109201cdca9a9d7892994ff1a31

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
x-cache-hits: 0
age: 0
x-cache: MISS
cross-origin-resource-policy: cross-origin
content-length: 182
x-served-by: cache-mxp6972-MXP
access-control-allow-origin: *
x-timer: S1651784987.586029,VS0,VE99
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type: application/json
via: 1.1 varnish (Varnish/6.0), 1.1 varnish
cache-control: no-store, no-cache, must-revalidate, max-age=0, s-maxage=0
accept-ranges: bytes
expires: Tue, 03 May 2022 21:09:46 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame ABB1 15 KB
6 KB 19ms
18ms Document
text/html 69.192.160.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/userSync.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.160.199 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-199.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=111946
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 05 May 2022 21:09:46 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 07 May 2022 04:15:32 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H3 200 pubads_impl_2022050301.js Show response
securepubads.g.doubleclick.net/gpt/ 368 KB
125 KB 35ms
19ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

8cc13350e5c65223229a458ee1986bd13f4914bf953484681d70665643669c02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 16:07:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18136
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127789
x-xss-protection: 0
last-modified: Tue, 03 May 2022 08:34:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 05 May 2023 16:07:30 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 314 B
188 B 35ms
20ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.startribune.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

9caef30adcb06482d06cb9da4bc6b593d22311ec72a72bec0ec1ae9f677881f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 163
x-xss-protection: 0
expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2 200 pixel;r=429124666;rf=0;a=p-0fEc9CMkDiJ2g;url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F;uht=2;fpan=1;fpa=P0-17845705...
pixel.quantserve.com/ 35 B
371 B 30ms
13ms Image
image/gif 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=429124666;rf=0;a=p-0fEc9CMkDiJ2g;url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F;uht=2;fpan=1;fpa=P0-1784570543-1651784986536;pbc=;ns=0;ce=1;qjs=1;qv=a98acd33-20220316110313;cm=;gdpr=0;ref=;d=startribune.com;je=0;sr=1600x1200x24;dst=0;et=1651784986536;tzo=0;ogl=site_name.Star%20Tribune%2Ctype.article%2Ctitle.Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%2Cdescription.Is%20Mom%20or%20Dad's%20new%20squeeze%20a%20fraud%3F%20Or%20are%20%22helicopter%20children%22%20butting%20in%20whe%2Curl.https%3A%2F%2Fwww%252Estartribune%252Ecom%2Fsweetheart-scams-targeting-seniors-wreck-finances-an%2Cimage.https%3A%2F%2Fchorus%252Estimg%252Eco%2F23406668%2F1014812163_02elder042422%252Ejpg%3Fh%3D630%26w%3D1200%26fit%3Dc%2Cimage%3Aurl.https%3A%2F%2Fchorus%252Estimg%252Eco%2F23406668%2F1014812163_02elder042422%252Ejpg%3Fh%3D630%26w%3D1200%26fit%3Dc%2Cimage%3Awidth.1200%2Cimage%3Aheight.630

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:46 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=8428425&ns__t=1651784986542&ns_c=UTF-8&cv=3.5&c8=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%...
https://sb.scorecardresearch.com/b2?c1=2&c2=8428425&ns__t=1651784986542&ns_c=UTF-8&cv=3.5&c8=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-...

0
190 B

9ms
9ms

Image
text/plain

18.66.139.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=8428425&ns__t=1651784986542&ns_c=UTF-8&cv=3.5&c8=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&c7=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&c9=
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Server: 18.66.139.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-139-6.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
via: 1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
x-amz-cf-id: MaIIw4YPcGQ-vd0tnBZqAewdWC-f3IGo_1MZL67CJKurYdUd3fBwpw==
x-cache: Miss from cloudfront

Redirect headers

location: /b2?c1=2&c2=8428425&ns__t=1651784986542&ns_c=UTF-8&cv=3.5&c8=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&c7=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&c9=
date: Thu, 05 May 2022 21:09:46 GMT
via: 1.1 ed7f977b6d983a16331e3fe3f4764e9a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
content-length: 0
x-amz-cf-id: r4Wl2pOLITpnoAYD8bfpWZhhJVUG9T4pCWg45nWkf2GqW9g6eTWo4w==
x-cache: Miss from cloudfront

GET
H2 200 chartbeat_video.js Show response
static.chartbeat.com/js/ 68 KB
23 KB 7ms
7ms Script
application/x-javascript 2600:9000:223c:1a00:18:1fcd:34f:cdc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_video.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:1a00:18:1fcd:34f:cdc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 39ce831c2d42884a6bc694df10253f7d52b9e6c18c9e92b7ee5b00ba7ad0c14d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:15:12 GMT
content-encoding: gzip
last-modified: Wed, 20 Apr 2022 00:10:52 GMT
server: nginx
age: 3274
etag: W/"625f4f8c-110d3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
cache-control: max-age=7200
cross-origin-resource-policy: cross-origin
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: K5rEFgOgzVs8UpUiUe9anpkxf5o6duD7sq5aS_a9ZA4PPQfAqowb-g==
expires: Thu, 05 May 2022 22:15:12 GMT

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ 394 KB
115 KB 94ms
24ms Script
application/x-javascript 69.192.161.63
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/startribune.js?d=1651780660
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.161.63 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-161-63.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 9b51a836ae7316739f0c4ff04aa3f769b13f1700b512d7d8c36334b30400c863

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:46 GMT
Content-Encoding: gzip
x-amz-request-id: 2TRAGJH0901PRSKB
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
x-amz-id-2: HHMjhMI2MBFQ8t3pWU8kyRvLIi+BAJ+pInHAUT8LWAIv+sljgAeVCZa3uXxkdREFxPwUSrGQ/ZE=
Last-Modified: Wed, 04 May 2022 19:11:13 GMT
Server: AmazonS3
ETag: "a793fba08c1bc147128a6f6083fc6499"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 outbrain.js Show response
widgets.outbrain.com/ 199 KB
69 KB 74ms
16ms Script
application/x-javascript 69.192.161.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/outbrain.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/startribune.js?d=1651780660
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.161.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-161-85.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a34c7a131f7279405913ce6fdfdae8763d832264b4bea3b6dfd907598c5e6e9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
last-modified: Tue, 03 May 2022 08:16:48 GMT
etag: "16-PpiiYvE6AZ0+HEijKM5D/8e48Uc"
vary: Accept-Encoding
edge-cache-tag: widget-cheetah
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
x-traceid: 2c43e43e494a5ece14b45f90fdab32a
timing-allow-origin: *, *
content-length: 70248

GET
H2 200 3f9bae70fcebabf20e41.js Show response
www.startribune.com/vendor/js/ 8 KB
3 KB 23ms
23ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/vendor/js/3f9bae70fcebabf20e41.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/startribune.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60d941770f95d6b226bc5b606d16aa86e1a9d481a4aba334e46944885145f89b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:17:40 GMT
server: cloudflare
age: 56
etag: W/"627422d4-21d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 706c75864e2a9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 600167030 Show response
www.startribune.com/comments/news/count/ 230 B
242 B 812ms
812ms Fetch
application/json 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/comments/news/count/600167030
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c5c8f5bd9586220135e755f83e102736e8a51cdf30558406c14b0c106925af3

Request headers

Accept: application/json
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 05 May 2022 21:09:47 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c75864e329b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 600170818 Show response
www.startribune.com/comments/news/count/ 186 B
234 B 813ms
813ms Fetch
application/json 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/comments/news/count/600170818
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af43bbb3e6521131223d143f3a827a3a5eeddae18d9f2cf1ab37984cc856dec5

Request headers

Accept: application/json
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Thu, 05 May 2022 21:05:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c75865e3f9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 600170797 Show response
www.startribune.com/comments/news/count/ 198 B
215 B 765ms
765ms Fetch
application/json 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/comments/news/count/600170797
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c51761fe636c329d709cc8cbd32c47a9962db00f0d9da5ff39313ff6bee3ce42

Request headers

Accept: application/json
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Thu, 05 May 2022 21:05:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c75865e429b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 600170804 Show response
www.startribune.com/comments/news/count/ 190 B
268 B 738ms
738ms Fetch
application/json 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/comments/news/count/600170804
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 621e2de11d9427e5900f8b2b39f67ea1f48ecb1926fab8e2567ccc7ee03dd2a0

Request headers

Accept: application/json
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Thu, 05 May 2022 21:05:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c75865e439b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 600170785 Show response
www.startribune.com/comments/news/count/ 194 B
252 B 700ms
699ms Fetch
application/json 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/comments/news/count/600170785
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c40de768299d8a02f4fc7871624cb1c17608c7ddcaa77295a73bb1a86f367cc4

Request headers

Accept: application/json
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Thu, 05 May 2022 21:05:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c75865e459b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 icn-social-comments-50-50.svg
www.startribune.com/static/img/icons/ 855 B
624 B 27ms
27ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-social-comments-50-50.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d3ea1c3b563087d2c6bbb9831ff4763aa4ef8f28de046d20e4c026228ffc705

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1551132
etag: W/"62599f3c-357"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75865e4f9b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 icn-comments-count-bubble-45-26.svg
www.startribune.com/static/img/icons/ 2 KB
1010 B 43ms
42ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-comments-count-bubble-45-26.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed9f4886d112ec736af41b9591657376ead1e012336d70f42fb54827864e8bc2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/static/css/screen.css?d=1651780658
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 15 Apr 2022 16:37:16 GMT
server: cloudflare
age: 1550004
etag: W/"62599f3c-960"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75865e519b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KWTSNPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3037
date: Thu, 05 May 2022 20:19:09 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 05 May 2022 22:19:09 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/ 43 KB
12 KB 77ms
22ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/utag.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: dda0333f03de8708de824d724e0730c8b1ce266ebf34a78c048bd5cfe038406e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
last-modified: Wed, 23 Mar 2022 15:55:53 GMT
server: AkamaiNetStorage
etag: "f568ffff30aec21ba686031b00449768:1648050953.050018"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 11708
expires: Thu, 05 May 2022 21:14:46 GMT

GET
H2 200 r7omdkab9.js Show response
cdn.krxd.net/controltag/ 19 KB
6 KB 32ms
9ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/r7omdkab9.js
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 432b24e746b0dc77ab41d24adda02b9321ecd1772c38ce0e38bccaf5e695391b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Thu, 05 May 2022 21:09:46 GMT
via: 1.1 varnish, 1.1 varnish
age: 1047
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 5382
x-served-by: config-service-a003-ash-prod.krxd.net, cache-iad-kiad7000033-IAD, cache-hhn4078-HHN
x-response-time: 1
x-do-esi: esi
x-timer: S1651784987.687263,VS0,VE1
etag: "4a16bb18d8f0e705490852acfb6a5a2dcdb8b61e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 1

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 30ms
8ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b819b3ac2fe5857b7026a609f9115f0d50a7d6e8085ba5987d70ed6baaa41f4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26311
x-xss-protection: 0
pragma: public
x-fb-debug: 3stKZTyYfKLyYSa2scgM0QvfbMPreWvtrvh6m2Bl2nWnUcaw7k01QB0xOZPD/j8Xt2Cr06C7SqVEECUS1N1g5Q==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Thu, 05 May 2022 21:09:46 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 44ms
27ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SG3Y2YJFRQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KD2KG7V

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

66540d0f1ffe1e3153b014a4244f6e9dfa43d9207bb2fc5008656a21dea6844d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67723
x-xss-protection: 0
expires: Thu, 05 May 2022 21:09:46 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
434 B 58ms
16ms XHR
text/plain 69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=165166&u=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/182254-63191772774302.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 21:09:46 GMT
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[146.70.117.108], XFF:[]
Server: Apache
Access-Control-Allow-Origin: https://www.startribune.com
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-AK-CLIENT-GEO: 12
Expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame ABB1 2 KB
3 KB 839ms
153ms Script
text/html 192.82.242.209
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=53895637&p=160682&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.82.242.209 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: dff428642d69724e7bfe38c716b21fed11bbaaec4644f75b2218fdbe9d1af48d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 1014812163_02elder042422.jpg
chorus.stimg.co/23406668/ 29 KB
30 KB 227ms
227ms Image
image/jpeg 2606:4700::6810:d653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://chorus.stimg.co/23406668/1014812163_02elder042422.jpg?w=525&h=600&format=auto%2Ccompress&cs=tinysrgb&auto=compress&crop=faces&dpr=1

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6810:d653 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35bf2808642457d294b9065a479447004a5c367a38cd7545ddc04cce682893ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
x-cache: HIT, MISS
x-imgix-id: 90deb639e4c5773e41d90152be02875f8d3733b4
content-length: 30065
x-served-by: cache-sjc10028-SJC, cache-fra19171-FRA
last-modified: Sun, 01 May 2022 21:16:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 706c75873bc72373-ZRH
cross-origin-resource-policy: cross-origin
expires: Fri, 05 May 2023 21:09:46 GMT

GET
H2 200 icn-modal-60-60.svg
www.startribune.com/static/img/icons/ 819 B
553 B 19ms
19ms Image
image/svg+xml 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.startribune.com/static/img/icons/icn-modal-60-60.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d79ad786f23d2b6f6e2be291cc7bfccdbc9f6c3a947326b0dbbf99c9d61f47ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Apr 2022 18:47:41 GMT
server: cloudflare
age: 555815
etag: W/"62683e4d-333"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2592000
cf-ray: 706c75872fd89b55-FRA
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H/1.1 200
OK forms.js Show response
emma-content-aggregates-prd.s3.amazonaws.com/account/1788361/ 126 B
527 B 419ms
119ms Script
application/json 52.216.81.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://emma-content-aggregates-prd.s3.amazonaws.com/account/1788361/forms.js
Requested by: Host: dk98ddgl0znzm.cloudfront.net
URL: https://dk98ddgl0znzm.cloudfront.net/e2ma.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.81.176 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: c5bed027142a15f14eb7121b79d2b411396eaf8e6fbb18b941aced50ce1aced8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
Date: Thu, 05 May 2022 21:09:48 GMT
Last-Modified: Thu, 16 Apr 2020 15:19:54 GMT
Server: AmazonS3
x-amz-request-id: E68KQQ2AFJC3PYCG
ETag: "a07b36bb318a97314ce2745045c9cf57"
Content-Type: application/json
Accept-Ranges: bytes
Content-Length: 126
x-amz-id-2: uU8X9wcyoCnO5O3fbjWRnzibhJiSTLUZCMG/pWZT0ZhKXqBZdB5tvoslCS3yaKlexwMqShvPiac=

GET
H/1.1 200
OK d3d3LnN0YXJ0cmlidW5lLmNvbQ== Show response
tcheck.outbrainimg.com/tcheck/check/ 15 B
462 B 63ms
13ms XHR
application/json 23.35.229.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tcheck.outbrainimg.com/tcheck/check/d3d3LnN0YXJ0cmlidW5lLmNvbQ==
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-181.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:46 GMT
ETag: W/"f-ayLlCL3PuzXSThdu78iReSEjl6Y"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=11513
Access-Control-Allow-Credentials: false
Connection: keep-alive
X-TraceId: e94135d210d34cc1ae77122d9569b7cb
Content-Length: 15
Expires: Fri, 06 May 2022 00:21:39 GMT

GET
H2 200 px.gif
widget-pixels.outbrain.com/widget/detect/ 43 B
341 B 22ms
14ms Image
image/gif 69.192.161.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widget-pixels.outbrain.com/widget/detect/px.gif?ch=1
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.161.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-161-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
last-modified: Wed, 30 Sep 2020 14:22:29 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1601475749.911431"
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 43
expires: Sat, 04 Jun 2022 21:09:46 GMT

GET
H2 200 controltag.js.05f9d0dad02f8a1b0b028b868bc3a3e2 Show response
cdn.krxd.net/ctjs/ 248 KB
79 KB 7ms
7ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.05f9d0dad02f8a1b0b028b868bc3a3e2
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/r7omdkab9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7daa8dfc1349542ca90836b9becde99fa9bdf0b0599db5513c55ecbe556009a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
age: 2055631
x-cache: HIT
x-cache-hits: 2
content-length: 81058
x-served-by: cache-hhn4078-HHN
last-modified: Tue, 16 Jul 2019 17:45:11 GMT
x-timer: S1651784987.768797,VS0,VE0
etag: "05f9d0dad02f8a1b0b028b868bc3a3e2"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Fri, 13 Jul 2029 17:45:10 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
201 B 291ms
94ms Image
image/gif 52.200.205.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=startribune.com&p=%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&u=CvubWLEc3nSsSzM0&d=startribune.com&g=19787&g0=variety&g1=Rachel%20Hutton%20Star%20Tribune&n=1&f=00001&c=0&x=0&m=0&y=6710&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=3008&t=D6ruNmCMstYLDlCQQHCYwpkBDSKjGL&V=132&i=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&tz=0&sn=1&sv=D1mF6XDhQKENDi0pLtB9ixDaDqhG0x&sd=1&im=067b0ff3&_
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.205.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-205-243.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
content-length: 43
expires: 0

GET
H3 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
884 B 23ms
8ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 20:39:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1842
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 05 May 2022 21:39:04 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 19ms
14ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1368347683&t=pageview&_s=1&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&ul=en-us&de=UTF-8&dt=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAjAAAAAC~&jid=934669827&gjid=1321089360&cid=698713509.1651784987&tid=UA-69452634-2&_gid=1771020871.1651784987&_r=1&gtm=2wg540KWTSNPP&z=1552617588

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.startribune.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1705418706399109 Show response
connect.facebook.net/signals/config/ 306 KB
88 KB 176ms
167ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1705418706399109?v=2.9.58&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8062ce806e06a276a55dbf1c767f275bcee33f68d68d731aa7507e51e66fdcde

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: eZuL0Gbtu6bFiHWZZAkiHlnbnI/5QZcuhTrHqDrP2FeNbXTkw/ux/u+XWoXLsAQndp8w6LlT59aQpaT4thdbcw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 05 May 2022 21:09:46 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1651784986971
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 t Show response
jadserve.postrelease.com/ 115 B
539 B 308ms
95ms Script
text/javascript 3.213.149.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&ntv_mvi
Requested by: Host: s.ntv.io
URL: https://s.ntv.io/serve/load.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.149.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-149-116.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: 3055597f43adef2648996efac659bd63f616b0d1937f6e774ae3ac8fe35fb195

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: gzip
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: text/javascript;charset=UTF-8
content-length: 122
expires: Mon, 1 Jan 1990 12:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 13ms
13ms Ping
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-SG3Y2YJFRQ&gtm=2oe540&_p=1368347683&_z=ccd.tbB&cid=698713509.1651784987&ul=en-us&sr=1600x1200&ir=1&_s=1&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&dr=&sid=1651784986&sct=1&seg=0&dt=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&en=page_view&_fv=1&_ss=1&_eu=Q&ep.gtm_container_id=GTM-KD2KG7V&ep.gtm_container_version=87&ep.page_level=story&ep.page_section=variety&ep.content_type=story&ep.page_name=sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&ep.subsection=variety&epn.user_timezone_offset=0&ep.user_agent_string=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F101.0.4951.41%20safari%2F537.36&ep.audience_segment=grazer&ep.article_id=600167030&ep.logged_in_status=not%20logged%20in&ep.author=rachel%20hutton%20star%20tribune&ep.user_timezone_timestamp=2022-05-05%2021%3A09%3A46.715%20gmt%2B0000(gmt)&ep.session_id_2=1651784986716.5mpvc10k&ep.new_audience_segment_session=social%20grazer&ep.login_id=no%20login%20id&ep.content_source=star%20tribune&ep.publish_date=april%2022%2C%202022&ep.time_published=7%20am&ep.refreshed_page=no%20refresh&epn.visit_day_count=1&ep.all_sections=%2F%2C%2Fvariety%2C&ep.ad_blocker_cookie=&ep.new_audience_segment_user=social%20grazer&ep.gtm_tag_name=GA4%20Page%20View%20-%20Core%20Page%20View&up.audience_segment=grazer&up.dti_id=no%20dti%20id
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SG3Y2YJFRQ&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:46 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.startribune.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 53 B
749 B 46ms
13ms XHR
application/json 185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
content-type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 21:09:46 GMT
X-Proxy-Origin: 146.70.117.108; 146.70.117.108; 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: af17d065-e157-426e-9ed2-050299d74d6b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.startribune.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 53
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 58 B
356 B 313ms
285ms XHR
application/json 184.31.84.150
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?ac=j&s=164210&v=7.2&sd=1&r=%7B%22id%22%3A%226ec72d86-d9b9-4604-abcc-01ada537cc75%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22c592c0b7-09b8-430d-98a5-cbe88f32da1b%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A250%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A30%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659523%22%2C%22gpid%22%3A%227932%2Fzeus_top-leaderboard%22%7D%7D%2C%7B%22id%22%3A%2245ddf338-7e5e-49ec-b604-8c276f67a926%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A250%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A30%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659523%22%2C%22gpid%22%3A%227932%2Fzeus_top-leaderboard%22%7D%7D%2C%7B%22id%22%3A%2214e11fea-8748-4585-a5ab-fd821e30301b%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A250%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A30%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659523%22%2C%22gpid%22%3A%227932%2Fzeus_top-leaderboard%22%7D%7D%2C%7B%22id%22%3A%225d191aea-5aed-4a63-876a-8477c246c3ee%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A30%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A250%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A970%2C%22h%22%3A30%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659523%22%2C%22gpid%22%3A%227932%2Fzeus_top-leaderboard%22%7D%7D%2C%7B%22id%22%3A%22e0dea4aa-3c39-4ce1-83aa-6a381ef02286%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%2C%7B%22id%22%3A%225d3125c0-0c50-4571-a6d3-1c5ea9180ddd%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%2C%7B%22id%22%3A%2270363134-b134-4668-9622-4b0bec49cc60%22%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%2C%7B%22id%22%3A%226d517855-edd2-4d4f-ad13-fa6c802ba9ac%22%2C%22banner%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%2C%7B%22id%22%3A%223d4483a6-7c57-4325-84f9-15a707edb970%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%2C%7B%22id%22%3A%22ae921262-265c-4d32-9c20-5407cf3bceed%22%2C%22banner%22%3A%7B%22w%22%3A250%2C%22h%22%3A250%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%2C%7B%22id%22%3A%222e7f67e0-40be-4107-b18a-ed56bd538138%22%2C%22banner%22%3A%7B%22w%22%3A180%2C%22h%22%3A150%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%2C%7B%22id%22%3A%229a148b65-d848-4c99-9057-99fe926d0238%22%2C%22banner%22%3A%7B%22w%22%3A125%2C%22h%22%3A125%2C%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A1050%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%7D%2C%7B%22w%22%3A160%2C%22h%22%3A600%7D%2C%7B%22w%22%3A120%2C%22h%22%3A600%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%7D%2C%7B%22w%22%3A180%2C%22h%22%3A150%7D%2C%7B%22w%22%3A125%2C%22h%22%3A125%7D%5D%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22659526%22%2C%22gpid%22%3A%227932%2Fzeus_top-vertical%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F%22%2C%22ref%22%3A%22%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%7D%5D%7D%7D
Requested by: Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-84-150.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 569516ba841eb324b3946d522e2c4f48873bac83f54bde972d60a750246e02a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
x-ak-initial-geo: CC:[DE], RC:[HE], CN:[EU], CIP:[146.70.117.108], XFF:[]
server: Apache
content-type: application/json
access-control-allow-origin: https://www.startribune.com
x-cs-client-geo: 12
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 58
x-ak-client-geo: 12
expires: Thu, 05 May 2022 21:09:47 GMT

POST translator
hbopenbid.pubmatic.com/ 0
0

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 349 B
2 KB 289ms
122ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=8929&site_id=371832&tk_flint=custom&slots=2&size_id=2%3B15&alt_size_ids=55%2C57%3B9%2C10%2C14%2C54&zone_id=2031320%3B2031326&rp_floor=0.01
Requested by: Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0839bd1d6a58249f61205dc56075a57f8bcdb04380b74d6be734b0a830714ac0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 21:09:47 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.startribune.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 349
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
510 B 108ms
86ms XHR
application/json 52.29.205.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=zeus&v=1&referrer=www.startribune.com&debug=false

Requested by

Host: startribune.zeustechnology.com
URL: https://startribune.zeustechnology.com/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.29.205.29 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-29-205-29.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:46 GMT
accept-ch: sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.startribune.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
534 B 48ms
48ms XHR
text/javascript 108.138.16.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3151&u=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&pid=UrqjMBOicNo0i&cb=0&ws=1600x1200&v=7.75.0&t=1000&slots=%5B%7B%22sd%22%3A%22zeus_top-leaderboard%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%2C%22970x30%22%5D%2C%22sn%22%3A%22%2F7932%2Fwebsite%2Fweb_variety%22%7D%2C%7B%22sd%22%3A%22zeus_top-vertical%22%2C%22s%22%3A%5B%22300x1050%22%2C%22300x600%22%2C%22160x600%22%2C%22120x600%22%2C%22300x250%22%2C%22250x250%22%2C%22180x150%22%2C%22125x125%22%5D%2C%22sn%22%3A%22%2F7932%2Fwebsite%2Fweb_variety%22%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.16.177 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-16-177.fra56.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
via: 1.1 df327bd0c8709a81ade8602ac9ef16e0.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P7
x-amz-rid: J0AJHMKK1XQD9QN2022N
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.startribune.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 64
x-amz-cf-id: CGvWvQ-5bKki7afaxU2Y7v4p6bR8VbFHzyPViFJI5nbAVJ2F-a5Ynw==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 87 KB
34 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1dfcba54216b538dbfc614c790ea0d51e0242956711f5747527e606e48503d95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34547
x-xss-protection: 0
expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2 200 placement_invocation Show response
ob.cheqzone.com/ 48 KB
18 KB 32ms
7ms Script
text/javascript 52.222.236.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-10.fra56.r.cloudfront.net
Software: Caddy /
Resource Hash: 55ed920d444210fbe713cf81e8d6a615cd96d1b950b0704752209568e5754b30

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 17:34:14 GMT
content-encoding: gzip
server: Caddy
age: 12932
etag: "bf83-flSXooGsmrmYNlxSK09toJAtNHc"
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 ade2b5e2170ccd4f394b741b27bb0eec.cloudfront.net (CloudFront)
cache-control: max-age=43200
x-amz-cf-pop: FRA56-P4
content-length: 18458
x-amz-cf-id: shptCisf0I4mOCIOzYJrvLlXYa5fRnQvrPR541kj-lZyidN8zNft2w==
expires: Fri, 06 May 2022 05:34:14 GMT

GET
H2 200 utag.37.js Show response
tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/ 9 KB
3 KB 18ms
17ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/utag.37.js?utv=ut4.44.201803261943
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d32497d612d22a9df5aac17a67aff30afde87ae83e95f1063b480933f6919c69

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
last-modified: Mon, 29 Jun 2020 18:03:59 GMT
server: AkamaiNetStorage
etag: "5c68f49c00613aef8efbddf3bb23d911:1593453839.878029"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3338
expires: Fri, 20 May 2022 21:09:46 GMT

GET
H2 200 utag.76.js Show response
tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/ 8 KB
3 KB 19ms
18ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/utag.76.js?utv=ut4.44.202006052027
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 47bdb0e910bfabac15297272ade191ca8c0e9cfebe4d8bf988308307edfc6c13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
content-encoding: gzip
last-modified: Fri, 05 Jun 2020 19:58:09 GMT
server: AkamaiNetStorage
etag: "1f8a4e8c02b28435415b8367be32c4ad:1591387089.517412"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2375
expires: Fri, 20 May 2022 21:09:46 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
442 B 58ms
20ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-179757955-1&cid=698713509.1651784987&jid=1106271721&uid=no%20dti%20id&gjid=848790058&_gid=1771020871.1651784987&_u=aGDAgUAjAAAAAG~&z=2137394967

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 05 May 2022 21:09:46 GMT
content-type: text/plain
access-control-allow-origin: https://www.startribune.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1368347683&t=pageview&_s=1&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&ul=en-us&de=UTF-8&dt=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgUAjAAAAAC~&jid=1106271721&gjid=848790058&cid=698713509.1651784987&uid=no%20dti%20id&tid=UA-179757955-1&_gid=1771020871.1651784987&gtm=2wg540KD2KG7V&cg1=story&cg2=variety&cg3=variety&cg4=rachel%20hutton%20star%20tribune&cg5=sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&cd1=GTM-KD2KG7V&cd2=87&cd3=story&cd4=variety&cd5=story&cd6=sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&cd7=variety&cd8=0&cd9=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F101.0.4951.41%20safari%2F537.36&cd11=GA%20Page%20View%20-%20Core%20Page%20View&cd12=grazer&cd13=grazer&cd20=no%20dti%20id&cd21=no%20dti%20id&cd25=600167030&cd35=rachel%20hutton%20star%20tribune&cd37=&cd38=2022-05-05%2021%3A09%3A46.661%20gmt%2B0000(gmt)&cd39=1651784986663.yp9ntcgc&cd41=not%20logged%20in&cd42=social%20grazer&cd43=social%20grazer&cd49=no%20login%20id&cd50=no%20login%20id&cd51=star%20tribune&cd52=april%2022%2C%202022&cd53=7%20am&cd54=no%20refresh&cd59=1&cd62=not%20logged%20in&cd64=%2F%2C%2Fvariety%2C&cd65=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cd66=social%20grazer&cd67=&cd68=undefined&cd73=other&cd74=1&cd75=((grazer&cd76=social%20grazer&cd77=not%20logged%20in&cd78=false&cd22=698713509.1651784987&z=1522441382

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 05:04:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 57903
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1368347683&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&ul=en-us&de=UTF-8&dt=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Optimizely&ea=Assigned%20to%20Campaign&_u=aGDAgUAjAAAAAG~&jid=&gjid=&cid=698713509.1651784987&uid=no%20dti%20id&tid=UA-179757955-1&_gid=1771020871.1651784987&gtm=2wg540KD2KG7V&cg1=story&cg2=variety&cg3=variety&cg4=rachel%20hutton%20star%20tribune&cg5=sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&cd1=GTM-KD2KG7V&cd2=87&cd3=story&cd4=variety&cd5=story&cd6=sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&cd7=variety&cd8=0&cd9=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F101.0.4951.41%20safari%2F537.36&cd12=grazer&cd13=grazer&cd20=no%20dti%20id&cd21=no%20dti%20id&cd25=600167030&cd26=New%20Subscribe%20Page(21348093340)%3AOriginal(21415680090)&cd35=rachel%20hutton%20star%20tribune&cd37=&cd38=2022-05-05%2021%3A09%3A46.673%20gmt%2B0000(gmt)&cd39=1651784986673.oxuzwnke&cd41=not%20logged%20in&cd42=social%20grazer&cd43=social%20grazer&cd49=no%20login%20id&cd50=no%20login%20id&cd51=star%20tribune&cd52=april%2022%2C%202022&cd53=7%20am&cd54=no%20refresh&cd59=1&cd62=not%20logged%20in&cd64=%2F%2C%2Fvariety%2C&cd65=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cd66=social%20grazer&cd67=&cd68=undefined&cd73=other&cd74=1&cd75=((grazer&cd76=social%20grazer&cd77=not%20logged%20in&cd78=false&cd22=698713509.1651784987&z=1357330659

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 05:04:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 57903
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1368347683&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&ul=en-us&de=UTF-8&dt=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Optimizely&ea=Assigned%20to%20Campaign&_u=aGDAgUAjAAAAAG~&jid=&gjid=&cid=698713509.1651784987&uid=no%20dti%20id&tid=UA-179757955-1&_gid=1771020871.1651784987&gtm=2wg540KD2KG7V&cg1=story&cg2=variety&cg3=variety&cg4=rachel%20hutton%20star%20tribune&cg5=sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&cd1=GTM-KD2KG7V&cd2=87&cd3=story&cd4=variety&cd5=story&cd6=sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&cd7=variety&cd8=0&cd9=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F101.0.4951.41%20safari%2F537.36&cd12=grazer&cd13=grazer&cd20=no%20dti%20id&cd21=no%20dti%20id&cd25=600167030&cd35=rachel%20hutton%20star%20tribune&cd37=&cd38=2022-05-05%2021%3A09%3A46.711%20gmt%2B0000(gmt)&cd39=1651784986711.flqks3uf&cd41=not%20logged%20in&cd42=social%20grazer&cd43=social%20grazer&cd49=no%20login%20id&cd50=no%20login%20id&cd51=star%20tribune&cd52=april%2022%2C%202022&cd53=7%20am&cd54=no%20refresh&cd59=1&cd62=not%20logged%20in&cd64=%2F%2C%2Fvariety%2C&cd65=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cd66=social%20grazer&cd67=&cd68=undefined&cd73=other&cd74=1&cd75=((grazer&cd76=social%20grazer&cd77=not%20logged%20in&cd78=false&cd22=698713509.1651784987&z=1560031313

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 05:04:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 57903
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 s38828365663133
smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/ 43 B
252 B 17ms
16ms Image
image/gif 13.36.218.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.startribune.com/b/ss/nmminneapolis/1/JS-2.9.0/s38828365663133?AQB=1&ndh=1&pf=1&t=5%2F4%2F2022%2021%3A9%3A46%204%200&fid=0BB79D7335D16558-3147C74106571568&vmt=4DB8D2C6&vmf=metrics.startribune.com&ce=ISO-8859-1&ns=startribune&pageName=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families&g=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&cc=USD&ch=variety&server=startribune.com&events=event31%2Cevent32%2Cevent4&c1=D%3Dg&c3=story&c4=Star%20Tribune&c6=no%20refresh&c7=Variety&v7=Not%20Logged%20In&c12=Grazer&v12=D%3DpageName&v13=D%3DpageName&v14=D%3Dch&c15=Not%20Logged%20In&v15=D%3Dch&c16=D%3Dv7&v16=D%3Dc7&v17=D%3Dc7&v18=D%3Dc35&v19=D%3Dc35&c20=D%3Dv20&v20=No%20DTI%20ID&c22=1&v22=0&c24=article&c25=600167030&c33=D%3Dv7&v34=Social%20Grazer&c35=Rachel%20Hutton%20Star%20Tribune&c38=1&c39=New&v39=Social%20Grazer&c40=First%20Visit&c41=D%3DUser-Agent&c43=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&c45=7%20AM&c46=1&c48=no%20value&c49=no%20value&c50=no%20value&c52=Social%20Grazer&v53=D%3Dc70&c56=Grazer&v57=story&v61=%2B1&v63=%2B1&c65=April%2022%2C%202022&c70=1&c74=39&c75=11155&v80=D%3Dc46&v83=D%3Dc64&v86=D%3Dc12&v88=D%3Dc15&v92=5-5-2022&v93=D%3Dc38&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
x-content-type-options: nosniff
x-c: main-1640.Id95fac.M0-564
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 06 May 2022 21:09:46 GMT
server: jag
xserver: anedge-b4b698fcd-h2jpj
etag: 3547181248398131200-4619812267380791584
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 04 May 2022 21:09:46 GMT

GET
H2 200 proxy.3d2100fd7107262ecb55ce6847f01fa5.html Show response
cdn.krxd.net/partnerjs/xdi/ Frame FAA4 805 B
826 B 7ms
6ms Document
text/html 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.05f9d0dad02f8a1b0b028b868bc3a3e2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9

Request headers

Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1450801
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 525
content-type: text/html
date: Thu, 05 May 2022 21:09:46 GMT
etag: "3d2100fd7107262ecb55ce6847f01fa5"
expires: Fri, 19 Feb 2027 17:50:50 GMT
last-modified: Tue, 21 Feb 2017 17:50:54 GMT
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 165739
x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
x-served-by: cache-hhn4078-HHN
x-timer: S1651784987.949502,VS0,VE0

GET
H2 200 a-04p2.min.js Show response
b-code.liadm.com/ 26 KB
10 KB 34ms
7ms Script
application/javascript 2600:9000:225e:c200:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-04p2.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:c200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 153266090cd45ab1b1b2714e1283bf1a86da5777c32d4cba9e713a5967f64625

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 04:24:54 GMT
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
age: 60292
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-pop: FRA60-P4
content-encoding: gzip
x-amz-cf-id: lh4ldRglIkgof0rx8NscYDmld0nBdjdtSsNWIsM2vmmwahbNZJeTHQ==

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 15ms
15ms Script
application/x-javascript 23.35.236.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=advantagepublisherservices/startribune/202203231555&cb=1651784986955
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/advantagepublisherservices/startribune/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.209 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-209.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Thu, 05 May 2022 21:19:46 GMT

GET
H2 200 show_pla Show response
obs.cheqzone.com/ 3 KB
2 KB 305ms
109ms Script
text/javascript 2600:1f18:e8a:cd04:9b88:a313:d24d:af44
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.cheqzone.com/show_pla?id=65349&url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&sf=0&k=&idx=0&ch=&ext=&np=linux%20x86_64&nv=google%20inc.&rand=63102066926801981605271230560622032811816086910952680661291113791769&nc=0&tsf=0&tsfmi=&pv=0&cb=1651784987010&ref=&pit=1&hl=2&op=0&fs=1600x1200&ss=1600x1200&pre=0&jsonp=OBR.extern.onCheqResponse&mr=&ag=4117521382&at=&bid=e30%3D&di=W1siZWYiLDQ0MTddLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbDJcIixcInZcIjpcImdvb2dsZSBpbmMu%0D%0AIChnb29nbGUpXCIsXCJyXCI6XCJhbmdsZSAoZ29vZ2xlLCB2dWxrYW4gMS4yLjAgKHN3aWZ0c2hh%0D%0AZGVyIGRldmljZSAoc3ViemVybykgKDB4MDAwMGMwZGUpKSwgc3dpZnRzaGFkZXIgZHJpdmVyKVwi%0D%0ALFwic2x2XCI6XCJ3ZWJnbCBnbHNsIGVzIDMuMDAgKG9wZW5nbCBlcyBnbHNsIGVzIDMuMCBjaHJv%0D%0AbWl1bSlcIixcImd2ZXJcIjpcIndlYmdsIDIuMCAob3BlbmdsIGVzIDMuMCBjaHJvbWl1bSlcIixc%0D%0AImd2ZW5cIjpcIndlYmtpdFwiLFwiYmVuXCI6NixcIndnbFwiOjEsXCJncmVuXCI6XCJ3ZWJraXQg%0D%0Ad2ViZ2xcIixcInNlZlwiOjEwNTE2OTQwODksXCJzZWNcIjpcIlwifSJdLFstMSwiLSJdLFstMiwi%0D%0ANyxlWUc5WDEvWDF0WmxTMjJkNTF4OFlOWTlNeEpRRU1DZFVCSEpMODZMMjNBQ0dVaEJJd0lTU0VF%0D%0AQWNJSmZSZUFnUUlFRm9JbmRDeHdRWGpobzI3MTk2bU1qT3Yvcjg3MHV4cUZ4Il0sWy0zLCJbXCJp%0D%0AbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJtaGpmYm1kZ2NmamJicGFlb2pvZm9ob2VmZ2llaGphaVwi%0D%0ALFwiaW50ZXJuYWwtbmFjbC1wbHVnaW5cIl0iXSxbLTQsIi0iXSxbLTUsIi0iXSxbLTYsIntcIndc%0D%0AIjpbXCIwXCIsXCJjaHJvbWVcIixcInpldXNBZFVuaXRQYXRoXCIsXCIkXCIsXCJqUXVlcnlcIixc%0D%0AImFwc3RhZ0xPQURFRFwiLFwiYXBzdGFnXCIsXCJyZWdlbmVyYXRvclJ1bnRpbWVcIixcIl9fY29y%0D%0AZS1qc19zaGFyZWRfX1wiLFwiZ29vZ2xldGFnXCIsXCJ6ZXVzXCIsXCJzdHJpYlwiLFwiYXN5bmNc%0D%0AIixcImNvcmVcIixcImdsb2JhbFwiLFwiU3lzdGVtXCIsXCJhc2FwXCIsXCJPYnNlcnZhYmxlXCIs%0D%0AXCJzZXRJbW1lZGlhdGVcIixcImNsZWFySW1tZWRpYXRlXCIsXCJCdWdzbmFnXCIsXCJzdFdlYnBh%0D%0AY2tKc29ucFwiLFwiX2Nscm1cIixcIjJmMWFjYzZjM2E2MDZiMDgyZTVlZWY1ZTU0NDE0ZmZiXCIs%0D%0AXCJHbG9iYWxEYXRhQXBpXCIsXCJhZFwiLFwiaG9tZXBhZ2VWaXNpdENvdW50XCIsXCJ2aXNpdERh%0D%0AeXMzMFwiLFwidmlzaXRDb3VudDMwXCIsXCJpZ25vcmVNZXRlclwiLFwiU3RhclRyaWJ1bmVcIixc%0D%0AInJlYWRDb29raWVcIixcImRhdGFMYXllclwiLFwiZGlzYWJsZUFsbENsaWNrc1wiLFwib3B0X3Rh%0D%0AcmdldFwiLFwiX1wiLFwiZ2V0Q29va2llXCIsXCJzdG9yYWdlQXZhaWxhYmxlXCIsXCJnZXRWaXNp%0D%0AdERheXMzMFwiLFwiZ2V0VmlzaXRDb3VudDMwXCIsXCJoYXNVc2VyU3Vic2NyaXB0aW9uVmFsdWVc%0D%0AIixcImpRdWVyeUFuYWx5dGljc0F0dHJpYnV0ZXNcIixcInByaW50QW5hbHl0aWNzQXR0cmlidXRl%0D%0Ac1wiLFwiYmluZE1ldGVyRXZlbnRcIixcImxpbWl0U3RvcnlDb3VudFwiLFwidmFsaWRhdGVJbnB1%0D%0AdFwiLFwiZW1tYUFqYXhcIixcIm9wdF9saWdodGJveENsb3NlXCIsXCJqUXVlcnkxMTEzMDg3OTk0%0D%0ANTgxNzg1MzA4M1wiLFwib3B0aW1pemVseUVkaXRvcmlhbFwiXSxcIm5cIjpbXSxcImRcIjpbXX0i%0D%0AXSxbLTcsIi0iXSxbLTgsIi0iXSxbLTksIisiXSxbLTEwLCItIl0sWy0xMSwie1widFwiOlwiXCIs%0D%0AXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwi%0D%0AdHdpdHRlcjp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiXX0iXSxbLTEyLCJudWxsIl0s%0D%0AWy0xMywiLSJdLFstMTQsIntcIm9cIjowLjAwNjIzMDUyOTU5NTAxNTU3Nn0iXSxbLTE1LCItIl0s%0D%0AWy0xNiwiMCJdLFstMTcsIjQiXSxbLTE4LCJbMCwwLDAsMV0iXSxbLTE5LCJbMCwwLDAsMCwwLDAs%0D%0AMSwyNCwyNCxcIi1cIiwxNjAwLDEyMDAsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyMDAsMCww%0D%0ALDAsMCxcIi1cIixcIi1cIl0iXSxbLTIwLCI2OTg3MTM1MDkuMTY1MTc4NDk4NyJdLFstMjEsIiZy%0D%0Ac2t1bmtfcGxhdHlwdXM9MWg5bmlncSExaDc4ZjhxOjYwMDE2NzAzMCEiXSxbLTIyLCJbXCJuXCIs%0D%0AXCJuXCJdIl0sWy0yMywiKyJdLFstMjQsIltdIl0sWy0yNSwiLSJdLFstMjYsIntcInRqaHNcIjo0%0D%0AMjEwMDAwMCxcInVqaHNcIjozNzMwMDAwMCxcImpoc2xcIjozNzYwMDAwMDAwfSJdLFstMjcsIlsw%0D%0ALDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0yOCwiZW4tVVMiXSxbLTI5LCJ7XCJ2XCI6WzIsMiwyLDIs%0D%0AMCwwLDAsMiwwLDIsMCwyLDAsMCwyLDIsMiwyLDBdfSJdLFstMzAsIltcInZcIiwwXSJdLFstMzEs%0D%0AImZhbHNlIl0sWy0zMiwiMiJdLFstMzMsIi0iXSxbLTM0LCItIl0sWy0zNSwiWzE2NTE3ODQ5ODcw%0D%0AMDQsMF0iXSxbLTM2LCJbXCI0LzNcIixcIjQvM1wiXSJdLFstMzcsIi0xNDQtNjYtMTgwLSJdLFst%0D%0AMzgsImksLTEsLTEsMCwwLDEsMCwxOSwyMSwxNjM2LDEwNDQsMCwyNjA0LjcsMjYwNC43LDMyNDAs%0D%0AMzI0MSJdLFstMzksIltcIjIwMDMwMTA3XCIsMCxcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96%0D%0AaWxsYVwiLG51bGwsbnVsbCx0cnVlLDgsZmFsc2UsbnVsbCwwXSJdLFstNDAsIjMzIl0sWy00MSwi%0D%0ALSJdLFstNDIsIjE3MjQyOTc2NTMiXSxbLTQzLCIwMDAwMDAwMTAxMDAwMDAxMDAxMTEwMTEwMCJd%0D%0ALFstNDQsIjAsMCwwLDUiXSxbLTQ1LCItIl0sWy00NiwiMCJdLFstNDcsIkV0Yy9Vbmtub3duLGVu%0D%0ALVVTLGxhdG4sZ3JlZ29yeSJdLFstNDgsIjAsMCJdLFstNDksIi0iXSxbImJuY2giLDQ3XV0%3D&tsfu=&fst=1600x1200&dep=0&cpos=%5B%7B%22x%22%3A317%2C%22y%22%3A7237%2C%22w%22%3A0%2C%22h%22%3A0%7D%2C%7B%22w%22%3A1600%2C%22h%22%3A1200%7D%5D&ver=41&cri=3dTxtRRyUF&sdd=%7B%7D&pto=3247
Requested by: Host: ob.cheqzone.com
URL: https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd04:9b88:a313:d24d:af44 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: df1780dbaa24782c6a4761dc11c2f8efc00da359be71c637a78845bc4bdb29e8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: gzip
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript
content-length: 1636
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.js Show response
www.startribune.com/static/js/snowplow/ 73 KB
26 KB 28ms
27ms Script
application/javascript 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/static/js/snowplow/sp.js?d=1651780532
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b8ee02bddec67b4e38863e28da563f65c682459773ba2a0800a839bc98755e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 05 May 2022 19:15:32 GMT
server: cloudflare
age: 4740
etag: W/"62742254-125f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
cf-ray: 706c7588faf39b55-FRA
expires: Sat, 04 Jun 2022 21:09:47 GMT

GET
H2

200

/ Show response
www.startribune.com/api/personalize/
Redirect Chain

https://www.startribune.com/api/personalize
https://www.startribune.com/api/personalize/

58 B
480 B

250ms
250ms

XHR
application/json

104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.startribune.com/api/personalize/
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f6ae7267bbccf8eaf5eb9f38898a68937bf610a96e7370ef1a7e19b9d727cef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c75893b689b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

date: Thu, 05 May 2022 21:09:47 GMT
cf-cache-status: HIT
server: cloudflare
age: 56
location: https://www.startribune.com/api/personalize/
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
access-control-allow-credentials: true
cf-ray: 706c7588fafb9b55-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 104 KB
40 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-179757955-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KD2KG7V

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

45e0cfab6b933f47684ff5fdb674f6c44e4f77defdd37c3819246146db6634b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40739
x-xss-protection: 0
expires: Thu, 05 May 2022 21:09:47 GMT

GET
H2 200 r7omdkab9.js Show response
cdn.krxd.net/controltag/ Frame FAA4 19 KB
6 KB 7ms
6ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/r7omdkab9.js
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 432b24e746b0dc77ab41d24adda02b9321ecd1772c38ce0e38bccaf5e695391b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Thu, 05 May 2022 21:09:47 GMT
via: 1.1 varnish, 1.1 varnish
age: 1047
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 5382
x-served-by: config-service-a003-ash-prod.krxd.net, cache-iad-kiad7000033-IAD, cache-hhn4078-HHN
x-response-time: 1
x-do-esi: esi
x-timer: S1651784987.042449,VS0,VE0
etag: "4a16bb18d8f0e705490852acfb6a5a2dcdb8b61e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 2

GET
H2 200 sync-container.js Show response
b-code.liadm.com/ 6 KB
6 KB 7ms
7ms Script
application/javascript 2600:9000:225e:c200:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/sync-container.js
Requested by: Host: b-code.liadm.com
URL: https://b-code.liadm.com/a-04p2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:c200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-version-id: CQKQeFXs_ero.dSxGj8yyrCkT6TzPcRS
via: 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront)
etag: W/"ae5e94de938b0387eda6df8f20da811a"
last-modified: Wed, 02 Jun 2021 16:15:01 GMT
server: AmazonS3
age: 2150806
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
date: Sun, 10 Apr 2022 23:43:01 GMT
x-amz-cf-pop: FRA60-P4
accept-ranges: bytes
content-length: 5904
x-amz-cf-id: 7h9rdM9cbai4eoBAH0gfiQZpThfi6ny_NeS_hRXhTWd-RkmWeeWOtw==

GET
H3 200 590074241155998 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 149ms
148ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/590074241155998?v=2.9.58&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5271d2f11a7bac0e94c52ba67a46241c371ce38bfe99713bb977f61e0666f70e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: ghc9TK+CKxIBN06BX0im8+SowDnVi7U/Tjq1xYoIj6AxQBwIEPRGyIXNn442Zm53HBU3Ngk1PnGnV40iSgxH+Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 05 May 2022 21:09:47 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1651784987208
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
410 B 57ms
7ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1705418706399109&ev=PageView&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&rl=&if=false&ts=1651784987062&sw=1600&sh=1200&v=2.9.58&r=stable&ec=0&o=30&par[0]=%7B%22extractorID%22%3A%221699661006885203%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22USD%22%7D%7D%7D&par[1]=%7B%22extractorID%22%3A%223477016955738911%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&fbp=fb.1.1651784987061.1665536184&it=1651784986796&coo=false&rqm=GET

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 05 May 2022 21:09:47 GMT

GET
H2 200 272338b9-1d0f-4e54-928f-2d4e01274039 Show response
consumer.krxd.net/consent/get/ 235 B
427 B 58ms
35ms Script
text/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/272338b9-1d0f-4e54-928f-2d4e01274039?idt=device&dt=kxcookie&callback=Krux.ns.nucleus.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.05f9d0dad02f8a1b0b028b868bc3a3e2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ea1a1e48ad5f7af53d7ceeeb3ec5f4ef786771fff28c215f6fe52715d6698074

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a006-dub-prod.krxd.net, cache-hhn4049-HHN
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1651784987.093626,VS0,VE29
content-length: 188
x-cache-hits: 0, 0

GET
H2 200 controltag.js.05f9d0dad02f8a1b0b028b868bc3a3e2 Show response
cdn.krxd.net/ctjs/ Frame FAA4 248 KB
79 KB 7ms
7ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.05f9d0dad02f8a1b0b028b868bc3a3e2
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/r7omdkab9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7daa8dfc1349542ca90836b9becde99fa9bdf0b0599db5513c55ecbe556009a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: gzip
age: 2055632
x-cache: HIT
x-cache-hits: 3
content-length: 81058
x-served-by: cache-hhn4078-HHN
last-modified: Tue, 16 Jul 2019 17:45:11 GMT
x-timer: S1651784987.076881,VS0,VE0
etag: "05f9d0dad02f8a1b0b028b868bc3a3e2"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Fri, 13 Jul 2029 17:45:10 GMT

GET
H/1.1 200
OK i
d1epsz32winqbo.cloudfront.net/ 43 B
504 B 34ms
6ms Image
image/gif 52.222.206.199
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1epsz32winqbo.cloudfront.net/i?stm=1651784987083&e=pv&url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&page=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&tv=js-2.6.2&tna=co&aid=startribune_web&p=web&tz=UTC&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1600x1200&cd=24&cookie=1&eid=359b763d-a421-4774-8b5a-48d2a35b8f28&dtm=1651784987082&vp=1600x1200&ds=1600x9062&vid=1&sid=83bcbec0-3fc7-4a8f-9660-df1f4f4db022&duid=fd32cb3b-7bb3-4eb6-8da6-78faa9424175&fp=1351496004&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoiaWdsdTpjb20uc25vd3Bsb3dhbmFseXRpY3Muc25vd3Bsb3cvd2ViX3BhZ2UvanNvbnNjaGVtYS8xLTAtMCIsImRhdGEiOnsiaWQiOiIwODNiNmYzZC1kYzkzLTQ1NWQtYTM5MC1lZTQ1MjM5NTVkZGUifX0seyJzY2hlbWEiOiJpZ2x1OmNvbS5zdGFydHJpYnVuZS90cmFja1BhZ2VWaWV3L2pzb25zY2hlbWEvMS0wLTE1IiwiZGF0YSI6eyJhZG9iZUlkIjoiW0NTXXYxfDMxM0ExRThENDJGNzUxQkYtNjAwMDE1MTZGNEMyODQyOVtDRV0iLCJjb250ZW50QXJ0aWNsZUlkIjoiNjAwMTY3MDMwIiwiY29udGVudEFydGljbGVUeXBlIjoic3RvcnkiLCJjb250ZW50QXV0aG9yIjoiUmFjaGVsIEh1dHRvbiBTdGFyIFRyaWJ1bmUiLCJjb250ZW50UHViRGF0ZSI6IkFwcmlsIDIyLCAyMDIyIiwiY29udGVudFNlY3Rpb24iOiJ2YXJpZXR5IiwiY29udGVudFN1YnNlY3Rpb24iOiJWYXJpZXR5IiwiY3VycmVudFVzZXJTZWdtZW50IjoxMDAsImR0aUlkIjoiTm8gRFRJIElEIiwibG9nZ2VkSW5TdGF0dXMiOiIiLCJyZWZlcnJpbmdEb21haW4iOiIiLCJ1c2VybmFtZSI6IiIsInZpc2l0RGF5Q291bnROdW1iZXJEYXlzVXNlclZpc2l0ZWRQYXN0MzAiOjEsImxvZ2luQWNjb3VudElkIjoiTm8gTG9naW4gQWNjb3VudCBJRCJ9fV19
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.206.199 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-206-199.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 04:05:32 GMT
Via: 1.1 e45d812d65a0d0336b945e28b9381462.cloudfront.net (CloudFront)
Last-Modified: Thu, 18 Aug 2016 20:00:08 GMT
Server: AmazonS3
Age: 61763
ETag: "fb02f374b8f73825415db1bccd4bd76d"
X-Cache: Hit from cloudfront
Content-Type: image/gif
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-P3
Accept-Ranges: bytes
Content-Length: 43
X-Amz-Cf-Id: oMJkIB6iW5IWYvGHN-HMCCQrL3pWeTnQYcZfcou8gFLHvr3iZeDzkg==

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1651784987160&aid=a-04p2&se=e30&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&tna=v2.3.0&pu=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wrec...
https://rp4.liadm.com/j?dtstmp=1651784987160&aid=a-04p2&se=e30&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&tna=v2.3.0&pu=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wre...

48 B
587 B

301ms
94ms

XHR
application/json

34.202.82.185
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1651784987160&aid=a-04p2&se=e30&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&tna=v2.3.0&pu=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&wpn=lc-bundle&c=PHRpdGxlPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXMgLSBTdGFyVHJpYnVuZS5jb208L3RpdGxlPjxsaW5rIHJlbD0iY2Fub25pY2FsIiBocmVmPSJodHRwczovL3d3dy5zdGFydHJpYnVuZS5jb20vc3dlZXRoZWFydC1zY2Ftcy10YXJnZXRpbmctc2VuaW9ycy13cmVjay1maW5hbmNlcy1hbmQtZGV2YXN0YXRlLWZhbWlsaWVzLzYwMDE2NzAzMC8iPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJJcyBNb20gb3IgRGFkJ3MgbmV3IHNxdWVlemUgYSBmcmF1ZD8gT3IgYXJlICZxdW90O2hlbGljb3B0ZXIgY2hpbGRyZW4mcXVvdDsgYnV0dGluZyBpbiB3aGVyZSB0aGV5IGRvbid0IGJlbG9uZz8gIj48aDEgY2xhc3M9ImFydGljbGUtaGVhZGxpbmUiPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXM8L2gxPg&i6=MjAwMTphYzg6MjA6MjcyOjoyZQ%3D%3D&n3pc=true

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Server

34.202.82.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-202-82-185.compute-1.amazonaws.com

Software

Resource Hash

6721c7a449dc4434563fcb1cad928e7c2bd51cd35ff4d3535029c4f72adc6722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
x-pixel-event-id: 8512c42c-0caa-446c-af83-9f790b8015ba
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: null
x-xss-protection: 1; mode=block
vary: Origin
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: a3097dc979b362a5
request-time: 0
content-length: 48
x-content-type-options: nosniff

Redirect headers

date: Thu, 05 May 2022 21:09:47 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
location: https://rp4.liadm.com/j?dtstmp=1651784987160&aid=a-04p2&se=e30&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&tna=v2.3.0&pu=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&wpn=lc-bundle&c=PHRpdGxlPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXMgLSBTdGFyVHJpYnVuZS5jb208L3RpdGxlPjxsaW5rIHJlbD0iY2Fub25pY2FsIiBocmVmPSJodHRwczovL3d3dy5zdGFydHJpYnVuZS5jb20vc3dlZXRoZWFydC1zY2Ftcy10YXJnZXRpbmctc2VuaW9ycy13cmVjay1maW5hbmNlcy1hbmQtZGV2YXN0YXRlLWZhbWlsaWVzLzYwMDE2NzAzMC8iPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJJcyBNb20gb3IgRGFkJ3MgbmV3IHNxdWVlemUgYSBmcmF1ZD8gT3IgYXJlICZxdW90O2hlbGljb3B0ZXIgY2hpbGRyZW4mcXVvdDsgYnV0dGluZyBpbiB3aGVyZSB0aGV5IGRvbid0IGJlbG9uZz8gIj48aDEgY2xhc3M9ImFydGljbGUtaGVhZGxpbmUiPlN3ZWV0aGVhcnQgc2NhbXMgdGFyZ2V0aW5nIHNlbmlvcnMgd3JlY2sgZmluYW5jZXMg4oCUIGFuZCBkZXZhc3RhdGUgZmFtaWxpZXM8L2gxPg&i6=MjAwMTphYzg6MjA6MjcyOjoyZQ%3D%3D&n3pc=true
x-frame-options: DENY
access-control-allow-origin: https://www.startribune.com
x-xss-protection: 1; mode=block
vary: Origin
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: 46cec793e3e12bab
request-time: 0
content-length: 0
x-content-type-options: nosniff

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
364 B 417ms
94ms XHR
text/plain 50.17.6.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/3104270409.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.6.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-6-135.compute-1.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 05 May 2022 21:09:47 GMT
Server: nginx/1.21.0
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.startribune.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: 541b6f9c-d611-426c-b233-7218b8784fe8

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 31ms
14ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=590074241155998&ev=PageView&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&rl=&if=false&ts=1651784987267&sw=1600&sh=1200&v=2.9.58&r=stable&ec=0&o=30&fbp=fb.1.1651784987061.1665536184&it=1651784986796&coo=false&rqm=GET

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 05 May 2022 21:09:47 GMT

GET
H2 200 imp.gif
obs.cheqzone.com/tracker/ 43 B
79 B 93ms
93ms Image
image/gif 2600:1f18:e8a:cd04:9b88:a313:d24d:af44
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.cheqzone.com/tracker/imp.gif?e=37dfbd8ee84e00136fefc03dee4e829a9225c24f567d51c5c30f41b0254384cfa532ff1a285aa40e98d022e0b44dc87ea4a36fde4c1b8c682309094d0ba0bfea9475489e91da563e351aff717718956a8b70cd0130003f8101424d3f065cc3bf775d36fa26e877cb55e2cc7ce2586fb01f6f3903d053f054abd1c5d52fe87547ed62d2f1157f84163343714593d65337fd78afe6d4e3474fbf4e8dbd39e821da61c45085052aae2d05f91e46042e9e5b32b49affa125be2ab8589801f95c0c2cf38e6b256a655c9b6599857ea95a61a7d4f232331e32d786302080903b477442750c1bef8828796d76e4ba152cebfea755c9a444771e2bb5a5a384800cc6b9a326f746c0016537dd9fcfe6ad6b89cc9133d56c5384e6c82c1908f77f6ba195157aead9eb17de50ae04eb9b1dc148d5cc79d62427d4cc66ca6f82d2bef1deecb21b7ba32fe7bea87a543db4d237c4e643e1104e57815d0e83d9d4888fbc9227c32c90c6f5ae53df5f5b1aa35e6497c7c41d24d1b328fa01e6971dc62df879424c019b61ec5a8696fb7eefd73fc15ca9cfcbcb69ce010478e84b5842684a6ed1bc68b452d8cbcb25a89128ec852bdd94e3f97e9fa6a84e677d87f81152d8a70c5d14ffe0e77be76fc4b303ada333f53ef562ce4e824d89f962944f64f9ffcc32226b35457b481846eeb4913a835fee1917166ae7b24fdf991e0bfebbdfa5ae70d0b9b1ee8cf9b3e3091a6db818d8a4536f9f512747c569367070f57ba66a1ac0eddd608f68cb268aa830d0be0d986712272006600e9fc6e0c72178539a045893d3dbd6acd8001794a2c90884d36129cad813207bbcc0cb5c25ab35c60add5cb67de84d9e9657a1e465f091cc90dd127efda37b718876eb&cb=1651784987325&cri=3dTxtRRyUF
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd04:9b88:a313:d24d:af44 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
cache-control: no-cache, no-store, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT
content-length: 43
content-type: image/gif

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 377ms
88ms XHR
application/json 64.202.112.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1651784987326&sessionId=b460e06e-5795-ee15-d5fd-1e7e0438a2d1&url=www.startribune.com&cheqSource=1&cheqEvent=0&exitReason=4
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.95 Leesburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 21:09:47 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: a72f7cff6854e38061f5bea104590700
Content-Length: 4
Expires: 0

GET
H2 200 get Show response
odb.outbrain.com/utils/ 36 KB
14 KB 298ms
205ms Script
text/javascript 151.101.14.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.startribune.com%2Fvariety%2F600167030.html%3Fpage%3Dall%26prepage%3D1%26c%3Dy&idx=0&rand=66550&key=NANOWDGT01&widgetJSId=AR_1&va=true&et=true&format=html&pdobuid=-1&adblck=false&abwl=false&clss=E1vJs2vqbYQczI4wSEghhVtYMvcJxwlEsa04Z9gadL1HY5r35exeVk0JFjBC3sKZtSLjFLLsirpLqfTz&px=317&py=7559&vpd=6359&activeTab=true&darkMode=false&settings=true&recs=true&version=2000701&sig=%26rskunk_p&apv=false&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&dpr=1&secured=true&cmpStat=0&ccpaStat=0&ogn=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.132 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0a0906614a0baa77eb46193476f4603b809b827ee07ca500fdb3806d155519d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
via: 1.1 varnish, 1.1 varnish
traffic-path: NYDC1, LGA, FRA, Europe1
x-timer: S1651784987.425160,VS0,VE198
accept-ranges: bytes
x-served-by: cache-lga21931-LGA, cache-fra19138-FRA
vary: Accept-Encoding, User-Agent
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
x-cache-hits: 0, 0
x-traceid: 92ba02494bfacc8f5e473a1bc535ef4c
content-encoding: gzip
content-length: 13679
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 7BD4 0
15 B 8ms
7ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.startribune.com
Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.startribune.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 21:09:47 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 9EBB
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=972F0026-35CA-4B00-B65E-0D0186B9F64A
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=972F0026-35CA-4B00-B65E-0D0186B9F64A

35 B
468 B

19ms
19ms

Document
image/gif

37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=972F0026-35CA-4B00-B65E-0D0186B9F64A

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 05 May 2022 21:09:47 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 05 May 2022 21:09:47 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=972F0026-35CA-4B00-B65E-0D0186B9F64A
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 503 b9pj45k4 Show response
sync-tm.everesttech.net/upi/pid/ Frame C03D 0
177 B 35ms
7ms Document
text/plain 151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Thu, 05 May 2022 21:09:47 GMT
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-hhn4035-HHN
x-timer: S1651784988.609337,VS0,VE0

GET
H/1.1

200
OK

adx Show response
match.prod.bidr.io/cookie-sync/ Frame 7EB2
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFIMmwwN0U2SG9BQUR6aDVMUmQxdw&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

43 B
430 B

34ms
31ms

Document
image/gif

52.215.3.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.215.3.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-215-3-215.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Length: 43
Date: Thu, 05 May 2022 21:09:48 GMT
Server: nginx
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 355
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 21:09:47 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E047
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:13106274-3d1c-4800-999e-7561e5f7c89f&gdpr=0&gdpr_consent=

42 B
514 B

20ms
16ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:13106274-3d1c-4800-999e-7561e5f7c89f&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 05 May 2022 12:47:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx
x-lat: amspug0022:0:425

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Thu, 05 May 2022 21:09:47 GMT
Expires: Thu, 05 May 2022 21:09:46 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4390 fb8620d master ord-pixel-x56 config:1.0.0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:13106274-3d1c-4800-999e-7561e5f7c89f&gdpr=0&gdpr_consent=

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame ABB1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ly8AJjXKSwC2Xg0Bhrn2Sg%3D%3D
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=ly8AJjXKSwC2Xg0Bhrn2Sg%3D%3D&google_tc=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

28ms
25ms

Image
text/html

69.192.160.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Server: 69.192.160.199 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-199.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:48 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=111944
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5549
expires: Sat, 07 May 2022 04:15:32 GMT

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 420486.gif
idsync.rlcdn.com/ Frame ABB1 0
98 B 41ms
17ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/420486.gif?partner_uid=972F0026-35CA-4B00-B65E-0D0186B9F64A
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame ABB1
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7a4d6274-3d1c-4e00-98dd-a982585fab83

0
48 B

23ms
21ms

Image
text/plain

198.47.127.20
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7a4d6274-3d1c-4e00-98dd-a982585fab83
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Server: 198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Thu, 05 May 2022 21:09:47 GMT
Server: MT3 4390 fb8620d master ord-pixel-x14 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7a4d6274-3d1c-4e00-98dd-a982585fab83
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 05 May 2022 21:09:46 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame ABB1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTcyRjAwMjYtMzVDQS00QjAwLUI2NUUtMEQwMTg2QjlGNjRB&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTcyRjAwMjYtMzVDQS00QjAwLUI2NUUtMEQwMTg2QjlGNjRB&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
187 B

29ms
18ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
cache-control: no-store, no-cache, private
x-lat: amspug002:0:334
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame ABB1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPLOP1dGWNUM-muH25YDM0I&google_cver=1

42 B
362 B

31ms
20ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPLOP1dGWNUM-muH25YDM0I&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
cache-control: no-store, no-cache, private
x-lat: amspug003:0:416
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPLOP1dGWNUM-muH25YDM0I&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame ABB1 43 B
610 B 77ms
20ms Image
image/gif 159.122.14.34
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.122.14.34 , United States, ASN36351 (SOFTLAYER, US),

Reverse DNS

22.0e.7a9f.ip4.static.sl-reverse.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 04 May 2022 21:09:47 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame ABB1
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3553154561202639106&gdpr=0&gdpr_consent=&us_privacy=

1 B
478 B

61ms
15ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3553154561202639106&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:46 GMT
cache-control: no-store, no-cache, private
x-lat: amspug008:0:532
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3553154561202639106&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame ABB1 70 B
264 B 32ms
31ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:47 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 972F0026-35CA-4B00-B65E-0D0186B9F64A
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame ABB1 43 B
989 B 105ms
33ms Image
image/gif 2a05:d018:d29:3602:4db1:160f:679a:106f
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/972F0026-35CA-4B00-B65E-0D0186B9F64A?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:4db1:160f:679a:106f Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame ABB1
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=972F0026-35CA-4B00-B65E-0D0186B9F64A&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=972F0026-35CA-4B00-B65E-0D0186B9F64A&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-etaf_MVE2uW2QdP5uYrif3FzjNzyhI4-~A&gdpr=0&gdpr_consent=

0
260 B

61ms
14ms

Image
text/plain

198.47.127.20
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-etaf_MVE2uW2QdP5uYrif3FzjNzyhI4-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Server: 198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-etaf_MVE2uW2QdP5uYrif3FzjNzyhI4-~A&gdpr=0&gdpr_consent=
date: Thu, 05 May 2022 21:09:47 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 ob_logo_67x12.png
widgets.outbrain.com/images/widgetIcons/ 2 KB
3 KB 26ms
25ms Image
image/png 69.192.161.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/ob_logo_67x12.png
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.161.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-161-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
last-modified: Sun, 01 May 2022 07:29:08 GMT
server: AkamaiNetStorage
etag: "c52b07e749f7a09fa7b97b7e195e06ce:1651391314.747852"
access-control-allow-methods: GET,POST
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2326
expires: Sat, 04 Jun 2022 21:09:47 GMT

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ 3 KB
3 KB 29ms
27ms Image
image/svg+xml 69.192.161.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.192.161.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-161-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
last-modified: Sun, 01 May 2022 07:29:08 GMT
server: AkamaiNetStorage
etag: "9d26fa4e7238ed94f1d0d92afb453b3e:1651391295.775433"
access-control-allow-methods: GET,POST
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 2735
expires: Sat, 04 Jun 2022 21:09:47 GMT

GET
H2 200 a6cd39cd-f989-4756-ba40-dfd8fdcee7ca-3.woff
apps.startribune.com/fonts/Popular-Regular/ 40 KB
39 KB 21ms
21ms Font
application/font-woff 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apps.startribune.com/fonts/Popular-Regular/a6cd39cd-f989-4756-ba40-dfd8fdcee7ca-3.woff
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/static/css/screen.css?d=1651780658
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: daf1a01cae3e5a194cd502d2c84a86dc2d3d8dda6fb2d6384842ad0320488e47

Request headers

Referer: https://www.startribune.com/
Origin: https://www.startribune.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 Feb 2015 18:59:35 GMT
server: cloudflare
age: 7182
etag: W/"54e4e117-9eeb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=300
cf-ray: 706c758cccfa9bdc-FRA
expires: Thu, 05 May 2022 21:14:47 GMT

GET
H/1.1 200
OK l Show response
mcdp-nydc1.outbrain.com/ 2 B
292 B 361ms
94ms Fetch
text/plain 64.202.112.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-nydc1.outbrain.com/l?token=9d39b8543fb4fdd87ec8ae10f5827286_38391_1651784987570&tm=874&eT=0&widgetWidth=640&widgetHeight=598&widgetX=317&widgetY=7559&wRV=2000701&pVis=1&lsd=-1&eIdx=&cnsnt=no_consent&cheq=1&rtt=303&oo=true&ab=0&wl=0
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/vendor/js/bugsnag.js?d=1651780660
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.95 Leesburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: gzip
X-TraceId: 9acdf5b20adce9e7da170402704cfae7
Content-Type: text/plain; charset=UTF-8
Content-Length: 28
access-control-expose-headers: content-range

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 769A 0
15 B 7ms
7ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.startribune.com
Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.startribune.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 21:09:47 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK a-04p2 Show response
i.liadm.com/s/c/ Frame 11E9 1 KB
1 KB 404ms
108ms Document
text/html 23.23.81.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-04p2?s=&cim=&ps=true&ls=true&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&

Requested by

Host: b-code.liadm.com
URL: https://b-code.liadm.com/sync-container.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.23.81.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-23-81-221.compute-1.amazonaws.com

Software

Resource Hash

fcb6b852716571353a0a9a67869f612282ca95e1a62ff2caec1f2b068cde5221

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 669
Content-Type: text/html; charset=UTF-8
Date: Thu, 05 May 2022 21:09:48 GMT
ETag: 1.61803398874
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding

GET
H/1.1 200
OK baker
sli.startribune.com/ 19 B
368 B 370ms
40ms Image
image/gif 2a02:26f0:1700:5::5f65:1b51
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sli.startribune.com/baker?dtstmp=1651784987822
Requested by: Host: www.startribune.com
URL: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:5::5f65:1b51 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 05 May 2022 21:09:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Expires: Thu, 05 May 2022 21:09:48 GMT
Connection: keep-alive
Content-Length: 19
Content-Type: image/gif

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 39ms
17ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.startribune.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 41ms
18ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.startribune.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 21:09:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
298 B 202ms
202ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4449079688472532&correlator=2522690823888316&eid=31067407%2C31067418&output=ldjh&gdfp_req=1&vrg=2022050301&ptt=17&impl=fifs&iu_parts=7932%2Cwebsite%2Cweb_variety&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C110x38%2C86x40%2C970x250%7C970x90%7C728x90%7C970x30%2C300x1050%7C300x600%7C160x600%7C120x600%7C300x250%7C250x250%7C180x150%7C125x125&ifi=1&adks=3079592786%2C4248636007%2C1485013105%2C230647623%2C2042942245&sfv=1-0-38&ecs=20220505&ists=16&fsapi=false&prev_scp=ukv%3Doop1%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_overlay.init.dsk%7Cukv%3Dnl2%26pos%3D2%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_navtab-left-2.init.dsk%7Cukv%3Dnr2%26pos%3D2%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_navtab-2.init.dsk%7Cukv%3Dhz1%26pos%3D1%26rfs%3Dfalse%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_top-leaderboard.init.dsk%26amznbid%3D2%26amznp%3D2%7Cukv%3Dr1%26pos%3D1%26rfs%3Dfalse%26zeus_rendercount%3D1%26zeus_slot%3Dzeus_top-vertical.init.dsk%26amznbid%3D2%26amznp%3D2&eri=1&cust_params=zeus%3Dapplied%26ct%3Ds%26ctid%3D600167030%26auid%3D6370540%26secs%3D%252Cvariety%26ref%3Do%26user%3Dnotloggedin&sc=1&cookie_enabled=1&abxe=1&dt=1651784987886&lmt=1651784987&dlt=1651784985285&idt=1563&biw=1600&bih=1200&adxs=800%2C525%2C1288%2C800%2C1134&adys=40%2C0%2C0%2C301%2C701&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x0%7C1x-1%7C1x-1%7C970x250%7C300x1050&msz=1x0%7C1x-1%7C1x-1%7C1x0%7C1x125&fws=4%2C516%2C516%2C4%2C516&ohw=1600%2C1600%2C1600%2C1600%2C1600&ga_vid=698713509.1651784987&ga_sid=1651784988&ga_hid=1368347683&ga_fc=true&ga_cid=1771020871.1651784987&btvi=0%7C0%7C0%7C0%7C0&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

403ed7f0619dcde88eabc939f52558a167564bfdca309c864eb864e50a2b33cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 267
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.startribune.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
778dc798f143c5f37de79678f2b6368f.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5B85 6 KB
4 KB 72ms
16ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://778dc798f143c5f37de79678f2b6368f.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 21:09:47 GMT
expires: Fri, 05 May 2023 21:09:47 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
364 B 95ms
95ms XHR
text/plain 50.17.6.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/3104270409.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.6.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-6-135.compute-1.amazonaws.com
Software: nginx/1.21.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 05 May 2022 21:09:48 GMT
Server: nginx/1.21.0
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.startribune.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: 2ac95d3b-54f3-48ab-a01c-8d4f5f1e1060

GET
H/1.1

200
OK

366a34773f8e49e7a97ecafb0d5fe318
i.liadm.com/s/e/a-04p2/0/ Frame 11E9
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=36&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-04p2%2F0%2F366a34773f8e49e7a97ecafb0d5fe318%3Fmpid%3D7156%26muid%3D%5BMM_UUID%5D&3bb4b731-23fe-42f3-a7f1-d2a...
https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=7156&muid=7a4d6274-3d1c-4e00-98dd-a982585fab83

43 B
257 B

162ms
94ms

Image
image/gif

23.23.81.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=7156&muid=7a4d6274-3d1c-4e00-98dd-a982585fab83

Requested by

Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04p2?s=&cim=&ps=true&ls=true&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&

Protocol

HTTP/1.1

Server

23.23.81.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-23-81-221.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:47 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Date: Thu, 05 May 2022 21:09:48 GMT
Server: MT3 4390 fb8620d master ord-pixel-x55 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=7156&muid=7a4d6274-3d1c-4e00-98dd-a982585fab83
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 05 May 2022 21:09:47 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 11E9 70 B
264 B 32ms
32ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04p2?s=&cim=&ps=true&ls=true&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

52164
i.liadm.com/s/ Frame 11E9
Redirect Chain

https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D
https://x.bidswitch.net/ul_cb/syncd?dsp_id=256&user_group=2&user_id=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=%2F%2Fi.liadm.com%2Fs%2F52176%3Fbidder_id%3D5298%26bidder_uuid%3D%24%7BBSW_UID%7D
https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=c7a805c1-a924-403d-8b0f-811817ab3df3
https://x.bidswitch.net/sync?ssp=liveintent&user_id=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42
https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=liveintent
https://x.bidswitch.net/sync?dsp_id=188&user_id=gmninktZRSx47NyhPiT7TJJGdWw&user_group=1&ssp=liveintent
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=c7a805c1-a924-403d-8b0f-811817ab3df3

43 B
419 B

96ms
95ms

Image
image/gif

23.23.81.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=c7a805c1-a924-403d-8b0f-811817ab3df3

Requested by

Protocol

HTTP/1.1

Server

23.23.81.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-23-81-221.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:48 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: //i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=c7a805c1-a924-403d-8b0f-811817ab3df3
Date: Thu, 05 May 2022 21:09:48 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

366a34773f8e49e7a97ecafb0d5fe318
i.liadm.com/s/e/a-04p2/0/ Frame 11E9
Redirect Chain

https://dpm.demdex.net/ibs:dpid=127444&dpuuid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-04p2%2F0%2F366a34773f8e49e7a97ecafb0d5fe318%3Fmpid%3D82775%26muid%3D%2...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=127444&dpuuid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&redir=https%3A%2F%2Fi.liadm.com%2Fs%2Fe%2Fa-04p2%2F0%2F366a34773f8e49e7a97ecafb0d5fe318%3Fmp...
https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=82775&muid=37847770442068973854162994277148793725

43 B
257 B

202ms
101ms

Image
image/gif

23.23.81.221
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=82775&muid=37847770442068973854162994277148793725

Requested by

Protocol

HTTP/1.1

Server

23.23.81.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-23-81-221.compute-1.amazonaws.com

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:47 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

DCS: dcs-prod-irl1-2-v031-06c0bc431.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: iVrPxjpIR+E=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://i.liadm.com/s/e/a-04p2/0/366a34773f8e49e7a97ecafb0d5fe318?mpid=82775&muid=37847770442068973854162994277148793725
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

live_intent_sync
x.dlx.addthis.com/e/ Frame 11E9
Redirect Chain

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&rd=Y

43 B
604 B

166ms
165ms

Image
image/gif

104.111.215.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.dlx.addthis.com/e/live_intent_sync?na_exid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&rd=Y

Requested by

Protocol

Server

104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-215-191.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:48 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 05 May 2022 21:09:48 GMT
content-length: 43
strict-transport-security: max-age=2628000
content-type: image/gif

Redirect headers

location: https://x.dlx.addthis.com/e/live_intent_sync?na_exid=3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42&rd=Y
pragma: no-cache
date: Thu, 05 May 2022 21:09:48 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Thu, 05 May 2022 21:09:48 GMT

GET
H2 200 /
trc.taboola.com/sg/liveintent/1/cm/ Frame 11E9 43 B
240 B 95ms
45ms Image
image/gif 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/liveintent/1/cm/
Requested by: Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04p2?s=&cim=&ps=true&ls=true&duid=3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-vcl-time-ms: 27
pragma: no-cache
date: Thu, 05 May 2022 21:09:48 GMT
via: 1.1 varnish
server: nginx
x-timer: S1651784988.297031,VS0,VE27
x-served-by: cache-mxp6955-MXP
x-cache: MISS
cache-control: no-cache, no-store
accept-ranges: bytes
x-cache-hits: 0

GET
H/1.1

200
OK

35004
i6.liadm.com/s/ Frame 11E9
Redirect Chain

https://b1sync.zemanta.com/usersync/liveintent/?cb=%2F%2Fi.liadm.com%2Fs%2F35004%3Fbidder_id%3D98254%26bidder_uuid%3D__ZUID__
https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=
https://i6.liadm.com/s/35004?bidder_id=98254&bidder_uuid=

43 B
419 B

300ms
96ms

Image
image/gif

2600:1f18:444a:4680:27f9:539b:c9b0:d2ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/35004?bidder_id=98254&bidder_uuid=

Requested by

Protocol

HTTP/1.1

Server

2600:1f18:444a:4680:27f9:539b:c9b0:d2ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://i.liadm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:48 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/35004?bidder_id=98254&bidder_uuid=
Date: Thu, 05 May 2022 21:09:48 GMT
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 5E2D
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
1023 B

8ms
8ms

Document
text/html

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/sync.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: ca9ece8922d01998f68936d638cc283012c02dd2466ff00a1be5e576c8829d6f

Request headers

Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 455
content-type: text/html; charset=utf-8
date: Thu, 05 May 2022 21:09:49 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 05 May 2022 21:09:49 GMT
location: /sync?&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 optout_check Show response
beacon.krxd.net/ 61 B
221 B 109ms
35ms Script
text/javascript 52.211.24.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/optout_check?callback=Krux.ns.nucleus.kxjsonp_optOutCheck
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.05f9d0dad02f8a1b0b028b868bc3a3e2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.211.24.23 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-211-24-23.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8fd5775107c7a62ffb04469dbcf659da7b39d1a5598bb0534b20df33c4ee77bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:49 GMT
cache-control: private, max-age=0, s-max-age=0
x-request-time: D=32 t=1651784989
x-served-by: beacon-n017-dub-prod.krxd.net
content-type: text/javascript

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 48ms
23ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022050301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6ce14d676a10fd892359302a454ca4724d5dcd0b65eb0b11458b93fe79ffa946

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 05 May 2022 21:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10504
x-xss-protection: 0

POST
H2 200 rum Show response
www.startribune.com/cdn-cgi/ 0
77 B 29ms
29ms XHR
text/plain 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.startribune.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
content-type: application/json

Response headers

date: Thu, 05 May 2022 21:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.startribune.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 706c7595cc469b55-FRA
vary: Origin

POST
H2 200 rum Show response
www.startribune.com/cdn-cgi/ 0
221 B 28ms
21ms XHR
text/plain 104.17.51.114
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.startribune.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.51.114 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
content-type: application/json

Response headers

date: Thu, 05 May 2022 21:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.startribune.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 706c7595ec9a9b55-FRA
vary: Origin

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 5E2D 70 B
264 B 32ms
32ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:49 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5E2D
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D
date: Thu, 05 May 2022 21:09:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 5E2D 170 B
188 B 19ms
18ms Image
image/png 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5E2D
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjE4Mzg1OTUzMTcwODAwMjI1NjE5NQ%3D%3D
date: Thu, 05 May 2022 21:09:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 5E2D 0
707 B 193ms
161ms Image
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2183859531708002256195&dbredirect=true&gdpr=1&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:48 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: A8410FFB71454EE3BCF282D64AC566A5 Ref B: FRAEDGE1309 Ref C: 2022-05-05T21:09:49Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXeSimG6zkPe3EfbDhHlw==

GET
H2

200

xuid
eb2.3lift.com/ Frame 5E2D
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2183859531708002256195?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-u9QMPwpE2oQiOJglSjItqtepcmLCO9w3tIuevRpXUA--~A&dongle=0883

37 B
354 B

11ms
11ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-u9QMPwpE2oQiOJglSjItqtepcmLCO9w3tIuevRpXUA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Thu, 05 May 2022 21:09:49 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-u9QMPwpE2oQiOJglSjItqtepcmLCO9w3tIuevRpXUA--~A&dongle=0883
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 5E2D 43 B
220 B 9ms
8ms Image
image/gif 3.120.28.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=triplelift&user_id=2183859531708002256195&gdpr=1&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.28.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-120-28-2.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Thu, 05 May 2022 21:09:49 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/ Frame 5E2D
Redirect Chain

https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=2183859531708002256195
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=2183859531708002256195&dcc=t

0
0

98ms
98ms

Image
text/html

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=2183859531708002256195&dcc=t
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Server: 52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Thu, 05 May 2022 21:09:49 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 0H88W3KMVNM2D1K0BGJ3
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=2183859531708002256195&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 5E2D
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1

37 B
139 B

9ms
9ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma: no-cache
Date: Thu, 05 May 2022 21:09:49 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H/1.1 400
Request failed due to privacy signals setuid
ib.adnxs.com/prebid/ Frame 5E2D 0
0 17ms
16ms Image
text/html 185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=1&gdpr_consent=&uid=2183859531708002256195
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 41ms
18ms Script
text/javascript 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050301.js?cb=31067407

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 05 May 2022 21:09:49 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0294 13 KB
5 KB 24ms
7ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 7643
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 19:02:26 GMT
expires: Fri, 05 May 2023 19:02:26 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 53D7 783 B
1 KB 41ms
20ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d130ef8643fc2f6e41cd3553fd668dc253167834b1ee48a509c8a1ed4db8ac86

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rQdoUcebTZSDD6AaxCq0xw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.startribune.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-rQdoUcebTZSDD6AaxCq0xw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 05 May 2022 21:09:49 GMT
expires: Thu, 05 May 2022 21:09:49 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js Show response
pagead2.googlesyndication.com/bg/ Frame 0294 35 KB
13 KB 30ms
10ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea4019076476224330f3b3f4fa21af893f81abf9e80cb924911e8186167d9042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 17:23:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13523
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 05 May 2023 17:23:29 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 53D7 0
0 57ms
55ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022050301&jk=4449079688472532&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0294 0
9 B 6ms
6ms Image
text/plain 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?H7N4dg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame ABB1 0
128 B 24ms
17ms Script
text/plain 198.47.127.20
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=160682&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=160682&s=&predirect=&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 05 May 2022 21:09:48 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 47ms
47ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022050301&jk=4449079688472532&bg=!0NOl05fNAAZX5TVhd-U7ACkAdvg8WlMfROhD_v1z702tqw-z8JO-VH-vRhrh6b15gRs1Vk3VX02M0wIAAABKUgAAAAVoAQcKAOBSimiip6Wuz1rfsmolhTcz3XQBpimpMpUsbEmwsHFqgMQEOalu2JHeYl1H4uzdMx9d8A6OOGd5Jbhu_FIe40SkwFTN9i8J7-STcAWhNhoubpJTB0iiOfvvCAfdEciH02B8XH3v65PXFz7Kx6hTA1wagrYO5uhY9QlRYiZOiFA3tEo99cbg8aRbw5NePfssJQQ-_YdhF_xf-FoeYTP7lkfP3MlMfp4oJVfLVwjjc4VzWLr7A8bZ7FWC-YcFBEXw7vOGEEll5RBaheMy3ckbO5-rq6KwRJqP-B03sz4IYhWC4ZkCqdrBcB96u1x_UBIf3ZmFMPsvRyQ7SlhBVezYzFtWW_MYj5U1modkFMLPk23RWM1HBNhCwc9nYrAjz0ODItRgEwlHLsEU9kFOvmSRbDWp9HZ0oqzeGk5maewDORISUbFS1uf9sdN7xDk3ii1RSk9qUQgCZVHF-_Ecsbe-UcBPmw6mcnmhcahVE8slnh0lxQFmOM8JeJUlHH4t3pqeI_77IWuRX5VvfLAeGAgx3ShAkGGpIjgD02qqJgm4UoYi5eqiKdKX37_6Jna4rV8JDSo89OpleqKp6bY8FKcshejsmmWZSJIavjsO4wcAsMo-H1WIDebTctHOB4U0_7Y_q-PahKTiIwI4szBOaJuFPAyVhUBp3b843L1rEYdousmEU5vd9GJo44eKM9s7o9-Y381TILlTK62R8PdAt4D95Qvgxj-ZpCBWjb9lLQhCfgzPisj9N2V7wPp7MehxmvHIKFesgU7nLNI6A13EmC48-puLT_JJvwg1ckZnGnEdrjSbe8Wh8_ue3KJ6Ih-ItnnQuBINqDnMge2kTXIPa77lq5hF5pqcI1SEnCrrqMwXMS_xBMycBtGItOfpjxdhi47rd_pFrucR4-GDNCtgVOCpQ8GUHck4UoU8wUsOQ-IX0eb8atq1w7X_BjWxoUoSfjuSqCrDNHjF4IWwZCYOQw6eKejLS7Ceq8jrHuFRq0ihgJMsKBsYiB_0qAOX2OgUVuKImidIzPn_tvn-meZ3J9iL9aNvV5MHBR8vOIBbxYA7g-dYAGvdVam8bsV8KQwLS_LAFyzb2-ormnjvfiaeX9o1eXKcaLQ4jpxhncwcIE-qLkXLogorxPF9sm48330efT1sFjGq4kkTCuLoXsv7mL7zt7YMGo7dO1IVTtEPoOZettjN21JVw1bVeY_7GvKpdw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.startribune.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 14ms
14ms Ping
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-SG3Y2YJFRQ&gtm=2oe540&_p=1368347683&_z=ccd.tbB&cid=698713509.1651784987&ul=en-us&sr=1600x1200&ir=1&dl=https%3A%2F%2Fwww.startribune.com%2Fsweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families%2F600167030%2F&dr=&sid=1651784986&sct=1&seg=0&dt=Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families%20-%20StarTribune.com&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SG3Y2YJFRQ&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.startribune.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 05 May 2022 21:09:51 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.startribune.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: hbopenbid.pubmatic.com
URL: https://hbopenbid.pubmatic.com/translator?source=zeus_client

Verdicts & Comments Add Verdict or Comment

288 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

90 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030	1969-12-31 23:59:59	Name: ntvSession Value: {}
www.startribune.com/sweetheart-scams-targeting-seniors-wreck-finances-and-devastate-families/600167030	1970-01-20 02:49:44	Name: _liChk Value: 0.11454031400950337
.3lift.com/sync	1970-01-20 04:59:20	Name: sync Value: CgoIoQEQo_O6sIkwCgoIgQIQo_O6sIkwCgoIkQIQo_O6sIkwCgoI5gEQo_O6sIkwCgoIhwIQo_O6sIkwCgkICRCj87qwiTAKCQg6EKPzurCJMAoJCAsQo_O6sIkwCgoIjAIQo_O6sIkwCgkIXxCj87qwiTA=
i.liadm.com/s	1970-01-20 03:32:56	Name: _li_ss Value: MgUIBhCbEjIFCAoQmxIyBQgLEJsSMgUIfhCbEjIGCIsBEJsSMgUIeRCbEjIGCIEBEJsSMgUIDBCbEjIJCP____8HEJsS
.startribune.com/	1969-12-31 23:59:59	Name: click_mobile Value: 0
.startribune.com/	1970-01-20 07:08:56	Name: optimizelyEndUserId Value: oeu1651784986169r0.3246720758861643
.startribune.com/	1970-01-23 06:41:45	Name: rskunk_platypus Value: 1h9nigq!1h78f8q:600167030!
.startribune.com/	1978-01-11 21:31:40	Name: privateBrowser Value: true
.startribune.com/	1970-01-21 22:39:11	Name: s_fid Value: 0BB79D7335D16558-3147C74106571568
.startribune.com/	1970-01-20 03:27:21	Name: s_vnum Value: 1654041600460%26vn%3D1
.startribune.com/	1970-01-20 02:49:46	Name: s_invisit Value: true
.startribune.com/	1970-01-20 02:49:46	Name: undefined_s Value: First%20Visit
.startribune.com/	1969-12-31 23:59:59	Name: s_cc Value: true
www.startribune.com/	1970-01-20 03:30:04	Name: user_segment Value: Social%20Grazer
www.startribune.com/	1969-12-31 23:59:59	Name: session_first_page Value: story
www.startribune.com/	1969-12-31 23:59:59	Name: session_segment Value: Social%20Grazer
.startribune.com/	1970-01-20 03:32:56	Name: s_nr Value: 1651784986469-New
.startribune.com/	1970-01-20 02:49:46	Name: omniture_pn Value: Sweetheart%20scams%20targeting%20seniors%20wreck%20finances%20%E2%80%94%20and%20devastate%20families
.startribune.com/	1970-01-20 02:49:46	Name: omniture_ch Value: variety
.startribune.com/	1970-01-20 02:49:46	Name: omniture_p7 Value: Variety
.startribune.com/	1970-01-20 02:49:46	Name: omniture_p3 Value: story
www.startribune.com/	1970-01-20 12:18:32	Name: _cb_ls Value: 1
.scorecardresearch.com/	1970-01-20 20:06:32	Name: UID Value: 12Af4092d852ddbca2d8bfd1651784986
.startribune.com/	1970-01-20 11:35:20	Name: rec_sections Value: [{"name":"Variety","path":"/variety","subdomain":"www","linkdomain":"startribune.com"}]
.quantserve.com/	1970-01-20 12:19:59	Name: mc Value: 62743d1a-89d22-b1205-9060c
.startribune.com/	1970-01-20 12:14:13	Name: __qca Value: P0-1784570543-1651784986536
www.startribune.com/	1970-01-20 12:18:32	Name: _cb Value: CvubWLEc3nSsSzM0
www.startribune.com/	1970-01-20 12:18:32	Name: _chartbeat2 Value: .1651784986766.1651784986766.1.D1mF6XDhQKENDi0pLtB9ixDaDqhG0x.1
www.startribune.com/	1970-01-20 02:49:46	Name: _cb_svref Value: null
.startribune.com/	1970-01-20 20:20:56	Name: s_vi Value: [CS]v1\|313A1E8D42F751BF-60001516F4C28429[CE]
.startribune.com/	1970-01-20 02:51:11	Name: _gid Value: GA1.2.1771020871.1651784987
.startribune.com/	1970-01-20 02:49:45	Name: _gat_UA-69452634-2 Value: 1
.startribune.com/	1970-01-20 20:20:56	Name: _ga_SG3Y2YJFRQ Value: GS1.1.1651784986.1.0.1651784986.0
.startribune.com/	1970-01-20 02:51:11	Name: adblocker Value: false
.startribune.com/	1970-01-20 11:35:20	Name: a_ps_main Value: v_id:0180960eb10b00207e4d6626461003073006f06b00b08$_sn:1$_ss:1$_st:1651786786892$ses_id:1651784986892%3Bexp-session$_pn:1%3Bexp-session
.startribune.com/	1970-01-20 02:49:45	Name: _dc_gtm_UA-179757955-1 Value: 1
.startribune.com/	1970-01-20 20:20:56	Name: _ga Value: GA1.2.698713509.1651784987
www.startribune.com/	1970-01-20 03:32:56	Name: snowp_first_page_type Value: story
.startribune.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .startribune.com
.startribune.com/	1970-01-20 20:20:56	Name: _lc2_fpi Value: 3350b91a8ea8--01g2b0xcd8q95qzwtdkvy6j1fd
.startribune.com/	1970-01-20 04:59:20	Name: _fbp Value: fb.1.1651784987061.1665536184
www.startribune.com/	1970-01-20 02:49:46	Name: _sp_ses.428e Value: *
www.startribune.com/	1970-01-20 20:20:56	Name: _sp_id.428e Value: fd32cb3b-7bb3-4eb6-8da6-78faa9424175.1651784987.1.1651784987.1651784987.83bcbec0-3fc7-4a8f-9660-df1f4f4db022
.postrelease.com/	1970-01-20 11:35:20	Name: opt_out Value: 1
.facebook.com/	1970-01-20 04:59:20	Name: fr Value: 05sX7lCZ0sPevHKMc..BidD0b...1.0.BidD0b.
.rubiconproject.com/	1970-01-20 11:35:20	Name: khaos Value: L2TI4SYQ-19-FSTQ
.rubiconproject.com/	1970-01-20 11:35:20	Name: audit Value: 1\|hLZGFuTafB24Lv3yeG0dNQ/5onLiA/RiY1TdhAkPVQDHQJWDSP5VGSaRrALBWtVX3k674ERTYYFmNxFypEQgB2jYHTlS9mMv0uPFRQQ0AjrQD5U7tEfUTQ==
.startribune.com/	1970-01-20 02:49:52	Name: session_cookie_set Value: true
.startribune.com/	1978-01-11 21:31:40	Name: tagDetected Value: true
.startribune.com/	1970-01-20 02:49:52	Name: news_laravel_session Value: eyJpdiI6InZHdmJIUHozU05YKzA2VGJrRGJ1Ync9PSIsInZhbHVlIjoidUErZUlpK1psNGJ3QysyS0VVMVRvMTRsNmJjcnpSZE5wMFF2QVRTRUl5dEc3VDA0WjZVckRTakE1MkR5L3BQQ01sS0RqUG15ZHgzWlJpeTZsK29pUGRtTjlnWjBBbThvL01KL0N6bHNPcDF0TVE0c2IwUURyb0VrK1IzdXlzZGYiLCJtYWMiOiJhOGIzN2FjODk5YTAyYjRhYzJmNDg5M2NkOWEyMzM1N2U3NDJlNGZjY2YzMjdiYzVjMjE5ZDFiZTFhNTU0NWQ3IiwidGFnIjoiIn0%3D
.liadm.com/	1970-01-20 20:20:56	Name: lidid Value: 3bb4b731-23fe-42f3-a7f1-d2ae7ff54c42
.pubmatic.com/	1970-01-20 04:59:20	Name: KADUSERCOOKIE Value: 972F0026-35CA-4B00-B65E-0D0186B9F64A
.pubmatic.com/	1970-01-20 04:59:20	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-20 02:51:11	Name: pi Value: 160682:2
.pubmatic.com/	1970-01-20 04:59:20	Name: DPSync3 Value: 1651795200%3A174%7C1652918400%3A197_201%7C1652313600%3A164
.pubmatic.com/	1970-01-20 04:59:20	Name: SyncRTB3 Value: 1652918400%3A13_54_166_7_220_21_22_71%7C1652313600%3A223_2
.adform.net/	1970-01-20 03:34:23	Name: C Value: 1
.turn.com/	1970-01-20 07:08:56	Name: uid Value: 3553154561202639106
.analytics.yahoo.com/	1970-01-20 11:35:20	Name: IDSYNC Value: 18z8~24px
.simpli.fi/	1970-01-20 11:36:47	Name: suid Value: B95D7F4015C54302BB3BE21B920117D4
.adform.net/	1970-01-20 04:16:08	Name: uid Value: 3257455526061432553
.yahoo.com/	1970-01-20 11:35:42	Name: A3 Value: d=AQABBBs9dGICENDor0DDSmWyJQSvWvx1jCEFEgEBAQGOdWJ-YgAAAAAA_eMAAA&S=AQAAAtPOi0kB-v-K8I_-gBYl1pg
.pubmatic.com/	1970-01-20 03:32:56	Name: KRTBCOOKIE_22 Value: 14911-3553154561202639106
.pubmatic.com/	1970-01-20 04:59:20	Name: PUBMDCID Value: 3
.bidr.io/	1970-01-20 12:18:18	Name: bito Value: AAH2l07E6HoAADzh5LRd1w
.bidr.io/	1970-01-20 12:18:18	Name: bitoIsSecure Value: ok
.mathtag.com/	1970-01-20 12:15:40	Name: uuid Value: 7a4d6274-3d1c-4e00-98dd-a982585fab83
.pubmatic.com/	1970-01-20 03:32:56	Name: KRTBCOOKIE_27 Value: 16735-uid:13106274-3d1c-4800-999e-7561e5f7c89f&KRTB&16736-uid:13106274-3d1c-4800-999e-7561e5f7c89f&KRTB&23019-uid:13106274-3d1c-4800-999e-7561e5f7c89f&KRTB&23208-uid:13106274-3d1c-4800-999e-7561e5f7c89f
.pubmatic.com/	1970-01-20 03:32:56	Name: KRTBCOOKIE_80 Value: 22987-CAESEPLOP1dGWNUM-muH25YDM0I&KRTB&16514-CAESEPLOP1dGWNUM-muH25YDM0I&KRTB&23025-CAESEPLOP1dGWNUM-muH25YDM0I
.pubmatic.com/	1970-01-20 03:32:56	Name: PugT Value: 1651784987
.doubleclick.net/	1970-01-20 12:11:20	Name: IDE Value: AHWqTUnyApIDGegycLCRHkEosfr1gbpigwhBeJo9vE1V85XdMJslQekz3-0zez51ajM
.startribune.com/	1970-01-20 12:11:20	Name: __gads Value: ID=5dd37aad52db4c02:T=1651784987:S=ALNI_Mb_3kozOwNQV-NRmRDSLI26d4euNA
.bidswitch.net/	1970-01-20 11:35:20	Name: tuuid Value: c7a805c1-a924-403d-8b0f-811817ab3df3
.bidswitch.net/	1970-01-20 11:35:20	Name: c Value: 1651784988
.bidswitch.net/	1970-01-20 11:35:20	Name: tuuid_lu Value: 1651784988
.demdex.net/	1970-01-20 07:08:56	Name: demdex Value: 37847770442068973854162994277148793725
.dpm.demdex.net/	1970-01-20 07:08:56	Name: dpm Value: 37847770442068973854162994277148793725
.addthis.com/	1970-01-20 12:19:59	Name: na_id Value: 2022050521094800015791696373
.addthis.com/	1970-01-20 12:19:59	Name: na_tc Value: Y
.addthis.com/	1970-01-20 12:19:59	Name: uid Value: 62743d1cbed858dd
.addthis.com/	1970-01-20 12:19:59	Name: ouid Value: 62743d1c0001bec2e31b6d5e444c9b2d375586cb54a18027563a
.dlx.addthis.com/	1970-01-20 03:32:56	Name: na_sc_x Value: 1
sync.srv.stackadapt.com/	1970-01-20 11:35:20	Name: sa-user-id Value: s%3A0-8269e29e-4b59-452c-78ec-dca13e24fb4c.mxgkN%2B0hgtCC5JSWWaUAcGplTbrexRD%2FzWd0s4TB%2Frk
.srv.stackadapt.com/	1970-01-20 11:35:20	Name: sa-user-id-v2 Value: s%3AgmninktZRSx47NyhPiT7TJJGdWw.bpQdpxAZRmK9T8Kf4iX3QBDNQOutESKARt0eahuIwFw
.3lift.com/	1970-01-20 04:59:20	Name: tluid Value: 2183859531708002256195
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 20:21:38	Name: bcookie Value: "v=2&3911ba60-4b99-484c-858c-233c9c12468e"
.linkedin.com/	1970-01-20 20:16:31	Name: li_gc Value: MTswOzE2NTE3ODQ5ODk7MjswMjH9VaGl/qQOpTm5xxgpRY3VIewvxKrmJRPX0CGp2vWSBA==
.linkedin.com/	1970-01-20 02:51:11	Name: lidc Value: "b=TGST07:s=T:r=T:a=T:p=T:g=2340:u=1:x=1:i=1651784989:t=1651871389:v=2:sig=AQHE8FmnNLbbEICJBoXx71vmqFPXh9Xq"
.pubmatic.com/	1970-01-20 03:32:56	Name: SPugT Value: 1651784988

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://kit.fontawesome.com/a076d05399.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://dc8xl0ndzn2cb.cloudfront.net/js/startribunecom/v0/keywee.min.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://idsync.rlcdn.com/420486.gif?partner_uid=972F0026-35CA-4B00-B65E-0D0186B9F64A Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=1&gdpr_consent=&uid=2183859531708002256195 Message: Failed to load resource: the server responded with a status of 400 (Request failed due to privacy signals)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

778dc798f143c5f37de79678f2b6368f.safeframe.googlesyndication.com
ad.turn.com
ads.pubmatic.com
adservice.google.com
adservice.google.de
apps.startribune.com
as-sec.casalemedia.com
b-code.liadm.com
b1sync.zemanta.com
beacon.krxd.net
c.amazon-adsystem.com
c1.adform.net
cdn-pci.optimizely.com
cdn.krxd.net
chorus.stimg.co
clarium.global.ssl.fastly.net
cm.g.doubleclick.net
code.jquery.com
comments.startribune.com
connect.facebook.net
consumer.krxd.net
d1epsz32winqbo.cloudfront.net
dc8xl0ndzn2cb.cloudfront.net
dk98ddgl0znzm.cloudfront.net
dpm.demdex.net
ds.reson8.com
eb2.3lift.com
edge.quantserve.com
emma-content-aggregates-prd.s3.amazonaws.com
fastlane.rubiconproject.com
fonts.googleapis.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.liadm.com
i6.liadm.com
ib.3lift.com
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
jadserve.postrelease.com
js-sec.indexww.com
kit.fontawesome.com
log.outbrainimg.com
logx.optimizely.com
mab.chartbeat.com
match.adsrvr.org
match.prod.bidr.io
maxcdn.bootstrapcdn.com
mcdp-nydc1.outbrain.com
ob.cheqzone.com
obs.cheqzone.com
odb.outbrain.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.quantserve.com
pr-bh.ybp.yahoo.com
px.ads.linkedin.com
rp.liadm.com
rp4.liadm.com
rules.quantcount.com
s.amazon-adsystem.com
s.ntv.io
sb.scorecardresearch.com
securepubads.g.doubleclick.net
sessions.bugsnag.com
simage2.pubmatic.com
simage4.pubmatic.com
sli.startribune.com
smetrics.startribune.com
startribune.zeustechnology.com
static.chartbeat.com
static.cloudflareinsights.com
static.startribune.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.mathtag.com
sync.srv.stackadapt.com
tags.tiqcdn.com
tapi.optimizely.com
tcheck.outbrainimg.com
tlx.3lift.com
tpc.googlesyndication.com
trc.taboola.com
um.simpli.fi
unpkg.com
ups.analytics.yahoo.com
users.startribune.com
widget-pixels.outbrain.com
widgets.outbrain.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleoptimize.com
www.googletagmanager.com
www.queryly.com
www.startribune.com
x.bidswitch.net
x.dlx.addthis.com
hbopenbid.pubmatic.com
104.111.215.191
104.17.51.114
104.18.9.110
108.138.16.177
13.32.99.100
13.32.99.77
13.36.218.177
142.250.185.98
142.250.186.66
15.197.193.217
151.101.130.133
151.101.14.132
151.101.193.194
151.101.66.133
151.101.66.49
159.122.14.34
18.66.107.155
18.66.139.6
184.31.84.150
185.33.220.240
185.64.189.110
192.82.242.209
198.47.127.20
2001:4de0:ac18::1:a:3a
2001:678:cb4:bbbb::11
216.200.232.253
23.205.242.213
23.23.81.221
23.35.229.181
23.35.236.209
2600:1901:0:7a0b::
2600:1f18:444a:4680:27f9:539b:c9b0:d2ce
2600:1f18:730:b130:4c96:5596:18cd:cf5
2600:1f18:e8a:cd04:9b88:a313:d24d:af44
2600:9000:223c:1a00:18:1fcd:34f:cdc1
2600:9000:223c:a200:6:44e3:f8c0:93a1
2600:9000:2240:de00:1b:9dc4:7dc0:93a1
2600:9000:2250:6e00:b:c006:c80:93a1
2600:9000:225e:c200:8:8845:1500:93a1
2602:803:c004:200::143
2606:4700:20::ac43:497c
2606:4700:440e::6812:2fe6
2606:4700::6810:7daf
2606:4700::6810:d653
2606:4700::6812:1734
2606:4700::6812:bcf
2620:116:800d:21:51e4:db4b:4436:b305
2620:1ec:21::14
2a00:1450:4001:803::2001
2a00:1450:4001:803::200e
2a00:1450:4001:808::2002
2a00:1450:4001:808::2004
2a00:1450:4001:80e::200a
2a00:1450:4001:80f::2002
2a00:1450:4001:811::2001
2a00:1450:4001:827::2002
2a00:1450:4001:828::2008
2a00:1450:4001:82b::200e
2a00:1450:400c:c08::9a
2a02:26f0:1700:1b2::19f0
2a02:26f0:1700:5::5f65:1b51
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42:200::714
2a04:4e42::300
2a05:d018:d29:3602:4db1:160f:679a:106f
3.120.28.2
3.126.56.137
3.213.149.116
34.202.82.185
34.253.74.200
35.244.174.68
37.157.4.29
50.17.6.135
52.200.205.243
52.211.24.23
52.215.3.215
52.216.81.176
52.222.206.199
52.222.236.10
52.29.205.29
52.46.130.91
54.145.48.80
64.202.112.95
69.192.160.199
69.192.160.245
69.192.161.63
69.192.161.85
70.42.32.127
76.223.111.18
03e7600e2ab3ad43bdbff18264184c0ab0996ecf9ea47bd854046b0ba522ed5f
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
064512d2c7ac68701fe8a95c2ab127d1b1679f45fc90f9d4e798b204535264c3
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
073dc6cd62ff2feadf27900c4b57bccdb41dc4864a3a5f078a1c6d21362788d6
0761d20bb2e9b2420af2e1726c05da5b68c55ee01433fe742e48edbffef68c9f
0839bd1d6a58249f61205dc56075a57f8bcdb04380b74d6be734b0a830714ac0
0a0906614a0baa77eb46193476f4603b809b827ee07ca500fdb3806d155519d7
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ba7c0356149946bf0642fab4ef85b95e7090f6f785d0fb84323d0c442e5190a
0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94
0ff6c8c0aa24917d6570e9e2f0fd5db27505ca2ac10709b462fc62914a802dd5
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
153266090cd45ab1b1b2714e1283bf1a86da5777c32d4cba9e713a5967f64625
1588f72b26dece08032b25ba478f162b373ced6bf078e744eb8b3a570731c45f
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1909b2a83fd41494d94862c4323944d9d0aa1f1e653f252ea5a73fc5944308b0
1932da1682d444e6101f31f7e54079b63b5d4821eddf7acff9326b614b245332
194bddaf8d8931c8448c70ba7594b6c3d5b5b498e32cd498a9fb8acb41bec72c
1a83f13a1cf894555955c2d209c92c8ed9a261482f742dc6f967e5147861988b
1dfcba54216b538dbfc614c790ea0d51e0242956711f5747527e606e48503d95
2184861aab4d7c29703b8655e43b83d30891131df2af9cc9033d1fb18b2ff9dc
223c7e0c5c07f06fa0becc80797f8d8346209c7866b050608cca339ff32ea414
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
3055597f43adef2648996efac659bd63f616b0d1937f6e774ae3ac8fe35fb195
30b5b387b2af0422603fb083bb5fef7bb8ea4dd9448752974aef34cb07a819e3
32f99c53d803787082fa622605de20425d576183eee33c1ea549bb7786d6393f
35bf2808642457d294b9065a479447004a5c367a38cd7545ddc04cce682893ba
39ce831c2d42884a6bc694df10253f7d52b9e6c18c9e92b7ee5b00ba7ad0c14d
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
3a94613aee89a716410ca05e34b1f204e200569da359be8a83f665717b045cfe
3b046f53b8fd2ddd9d786821fa3f2e6e57237a2cd020d129edba49edc0777529
3b0487ca4e4d055b43695b3d79d41f5326c76973a0df0852dc90b7b8016f2dea
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9
3dfcfe46812ed1dd92422b09ea616ca4e0c3fe2fca3b6629c929fdb20050bf76
3f13313560f4e8a7730d2636aa1b5d69bf64998aa02007206ccf6dc6a6044073
403ed7f0619dcde88eabc939f52558a167564bfdca309c864eb864e50a2b33cb
4123e3d83dc27ad19d34ed202c2b0b6ce4165a14521692c155dd69ae5713841a
432b24e746b0dc77ab41d24adda02b9321ecd1772c38ce0e38bccaf5e695391b
443d3cf527dcca16fb9ddd0d0207869b01267ffaf4cc6d9f0427b6e8e7855d41
45e0cfab6b933f47684ff5fdb674f6c44e4f77defdd37c3819246146db6634b5
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
47bdb0e910bfabac15297272ade191ca8c0e9cfebe4d8bf988308307edfc6c13
47d32110d2841d1f80713cab5d19775760b13e34a5fc87e5825321df5a264aff
48383a41ed3bcfa3419a78d51f77f1b68ae556b2ccb4be1d997ecce7b7a8eaf9
487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4ac1ce876b1c079aa5121f78f4ac4a7d3eacdce4e01800204e8f9354d5ca38ee
4ba041d459ff73bbea0b0eca169115b9408d1d4b034bf5fd2037acb099bce2d1
4be319fc7e78bf1beb5b73bb76e33e445bf3170ebcd66fd72639743115287a2a
4c2da6a4b58d98534cce3c565778d2ea4c7d007d45cb89b1def875604d531b3f
4fa7e2c91b482631979bb9e1613e0017ab89d2092becf42f997002fd5f638bb7
505ac39a77f9d7a883cdcc25763d5d21526f4d74340a0143ad2c3b79ed78ffb9
521cb2d82b678a871ef9ffa3d0a64c5efd25b8205aa58ef7c09aaeb48028091c
5271d2f11a7bac0e94c52ba67a46241c371ce38bfe99713bb977f61e0666f70e
5341d81f1ab5079c3567a929a79519675da8bad6067d314ec9ad02a332bcf41d
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
55ed920d444210fbe713cf81e8d6a615cd96d1b950b0704752209568e5754b30
569516ba841eb324b3946d522e2c4f48873bac83f54bde972d60a750246e02a2
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a
5c5c8f5bd9586220135e755f83e102736e8a51cdf30558406c14b0c106925af3
5cb1cccd20f5bed658ff31f05112adfec80af47252e9a41ab9b947b67a4818fd
60d941770f95d6b226bc5b606d16aa86e1a9d481a4aba334e46944885145f89b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
621e2de11d9427e5900f8b2b39f67ea1f48ecb1926fab8e2567ccc7ee03dd2a0
63414c077003319f186a974d9be8a8a09a07a178e6bbe29181d93b6cd8dccff9
648aacd32da86d341dec60d5ece0de2cfc7d578e981fad920af31a8ad8ab874c
66540d0f1ffe1e3153b014a4244f6e9dfa43d9207bb2fc5008656a21dea6844d
6721c7a449dc4434563fcb1cad928e7c2bd51cd35ff4d3535029c4f72adc6722
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b8ee02bddec67b4e38863e28da563f65c682459773ba2a0800a839bc98755e7
6ce14d676a10fd892359302a454ca4724d5dcd0b65eb0b11458b93fe79ffa946
6d3ea1c3b563087d2c6bbb9831ff4763aa4ef8f28de046d20e4c026228ffc705
7350b2ac8571e45f6df355bf93d32283ea4510429ae9b6df5b5cc1c2bf99d1e1
74002ad9febb2d3e35b7342b799a72d6771e6834747e961fc59f38f028b1fe8c
786f8e86896c85d5941a05d0519c32b261947a8c229f5581f308595381b7448e
7a999c35be19ab39bf2b81d2adc2e06223be301d5b7d7550151d16da8e003efb
7af33583b997a7b91c6c5e0529d1954955b104190348bfdea4f9dcb2b12b246a
7daa8dfc1349542ca90836b9becde99fa9bdf0b0599db5513c55ecbe556009a4
8062ce806e06a276a55dbf1c767f275bcee33f68d68d731aa7507e51e66fdcde
8258eba81486390ca4f592d4978e0f133ffba77f2d763eee6f865004e66229cc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
887b7aa798b08fed889bbbfa2595ff741957a0ecbb0b7ceaae2a13bd6be80783
89d825984b5cba89b134d1f9e760c671741d0109201cdca9a9d7892994ff1a31
8cc13350e5c65223229a458ee1986bd13f4914bf953484681d70665643669c02
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ea9df9aa296a2eac3fe1a8b6972fecea49c7295f723cf9c93356ff9301a09ec
8f6ae7267bbccf8eaf5eb9f38898a68937bf610a96e7370ef1a7e19b9d727cef
8fd5775107c7a62ffb04469dbcf659da7b39d1a5598bb0534b20df33c4ee77bd
909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4
911961bc53d17352d7527a8c1db7fe14ce93af033e2bf7a54b40a588c5651229
92b316ab9957cdb1690d079cbf5695a38cf8d1aa4f3c25b9ce2e31895254b44c
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9b51a836ae7316739f0c4ff04aa3f769b13f1700b512d7d8c36334b30400c863
9caef30adcb06482d06cb9da4bc6b593d22311ec72a72bec0ec1ae9f677881f1
9db1b57a1f2a6aa8912555c191752479e7b2bb69c35be1f77da3e26fad0a19e9
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a23f809d57a90856a15bbc2e97a7152f866bc8d3caf4daf564b29400115da830
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a34c7a131f7279405913ce6fdfdae8763d832264b4bea3b6dfd907598c5e6e9a
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a75b9f2e608b1229187c60c7ae222219f1f3bf9bce8c764f3962c6659f438402
a7c85f3d7ece16fc2394c5446e2e3e1f195c00179bccb210b36c88496747480c
a7d14fde1a49f3fda3483a0b5f76ea9224048392ba49784aac5ba7af214de6b9
a7e091316dc3fa0efb8087abed0f2f7ba6a40f34833b629f9e538e8cc605c4bc
a7f86a23e0fe2e080671e9ab403c0f97b903d310a6ddbf0a2f6d7f0cff64759f
aa2efed3da08343d692099d9204c3e8b5b28cd0ceb5fcb57eb5415195f529cda
aaac4cbaa8b811ff5a3f2ed45a5e8a24eceff8eb7cc9d0617c1111f00271e082
aab005e1e9c3d72739f90a0599a16112cd7713958aa506a36fadfc3030e90083
ac2f63aa8eb6183c69f1b96e12c3f45af4f7f7996d8a954fd96b1d4cedf11a92
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
af43bbb3e6521131223d143f3a827a3a5eeddae18d9f2cf1ab37984cc856dec5
afe53f75618262939f434d7360e8efb44870d222a5533d2cbdb57b83bfdcd326
b191c93881caa58694408be0088adc1db8efcf8405892655b7387c5554b8d409
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b7f736144a4c3c86a1e620f94d91b3c0eedcadac33888203e554dc2e7c3cfa66
b819b3ac2fe5857b7026a609f9115f0d50a7d6e8085ba5987d70ed6baaa41f4e
ba29d48f1bb3678b362c54b6dd7661486fa1f125ab34c7e8875f6c49f28bd4c8
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd9bba4e41543bae3381e199fca2b629c99839ca0ea5608bb6b662fa999dc4c2
bfcd2ba094844ba647d3efc48ff52401f963465c2b255e17958ded4300099bbb
c40de768299d8a02f4fc7871624cb1c17608c7ddcaa77295a73bb1a86f367cc4
c48feaca5f6fa70585397cfbfb1ffd5a41b98ff4959d2c36d6f8b2f1f5b06de1
c51761fe636c329d709cc8cbd32c47a9962db00f0d9da5ff39313ff6bee3ce42
c5bed027142a15f14eb7121b79d2b411396eaf8e6fbb18b941aced50ce1aced8
c815be0139a92202ff8f262cc335f6ae103594bb1d92c1c479ed604adf384a16
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca9ece8922d01998f68936d638cc283012c02dd2466ff00a1be5e576c8829d6f
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cadc7e9c3c04fa463d9d6154f00e5a4a9e3fd1b4e4981541670e917cf5001be6
ccc7150bb665c96f9db6bcc77a0532f65f015665a82df05af2bdf8b9673ac42c
cdaa9050a0320268f290feed6d773fbc5c200980fb439fd6ae4e7cff1ea5f298
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d130ef8643fc2f6e41cd3553fd668dc253167834b1ee48a509c8a1ed4db8ac86
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d2e2354fca132f5f3d823d32c8fd0d29605d70a0f2afb30a2c6ab7e5059a1170
d32497d612d22a9df5aac17a67aff30afde87ae83e95f1063b480933f6919c69
d79ad786f23d2b6f6e2be291cc7bfccdbc9f6c3a947326b0dbbf99c9d61f47ca
d8868b02f90658ebee9ce3733b03496b440dc7683ffbdd855742bcaa14bca4d1
d9dbc312e7775ef5c4497342d0ad73cc63aaecd608bf72dc2caf90b021387cd0
daf1a01cae3e5a194cd502d2c84a86dc2d3d8dda6fb2d6384842ad0320488e47
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dda0333f03de8708de824d724e0730c8b1ce266ebf34a78c048bd5cfe038406e
df1780dbaa24782c6a4761dc11c2f8efc00da359be71c637a78845bc4bdb29e8
df226a155adce3a6de39dd9490d5a6ee7749b4f980cb1065014aa26042b769b1
dff428642d69724e7bfe38c716b21fed11bbaaec4644f75b2218fdbe9d1af48d
e35459ebc980180795eeb562f13e11f2e658799cf211eedd86f03ce2b49a6eab
e3552f4c0b476b6d2bf67cb91fd10bafc9179a565e7152a3a2db69467e4b2b1b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e72f38bf3d37c3d117ee522bc23d12b15d950acdbe76b822461108395b6b0389
e8084b55ac306c38df5f25b19877a7c9ff2772a55d60b83ee34f359b021d6b0e
ea1a1e48ad5f7af53d7ceeeb3ec5f4ef786771fff28c215f6fe52715d6698074
ea4019076476224330f3b3f4fa21af893f81abf9e80cb924911e8186167d9042
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ed9f4886d112ec736af41b9591657376ead1e012336d70f42fb54827864e8bc2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1c13d3b4098b4b72a1d1c9e7c64e6e2cfabab881592539094fc2792cbd5d3c0
f5731ba3eb13d83dc933a992ee948c49a112dd5cd8bd943be09d63af861d7bf6
f985fdac841e2ed8bd742ab8c4ab6c774b2b749a38b9e443e18f6216a2ad8b6a
fadb64b7b2828f2866d9b2d47e58f47ada8437fc72164f2ea950ff6d0eba05dd
fb34f0a124215447457dec3c493304b624e796311a2536cab6ac040ae4247804
fbd1ebc8ad24a533074a4a5001e04131f66affb9a341d93e53a820847bbed820
fcb6b852716571353a0a9a67869f612282ca95e1a62ff2caec1f2b068cde5221
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fd565ca42e11e3e16d770fdcfa20aceff863765d4ce338977774fb9d0aec5b48
fe0fa35cc17d816ca780946cfee61e0b1054d2693f00781ba99a609403e579af
fe2d2acf53d793fbf319ed329c357c1f5af5da48ad7dc9a7ce33c3c4511f5acd

www.startribune.com Open in urlscan Pro 104.17.51.114 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

229 Requests

91 %HTTPS

42 %IPv6

61 Domains

100 Subdomains

84 IPs

9 Countries

2749 kBTransfer

7855 kBSize

90 Cookies

37 Outgoing links

Redirected requests

229 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.startribune.com Open in urlscan Pro
104.17.51.114 Public Scan

Screenshot
Live screenshot

Full Image

229
Requests

91 %
HTTPS

42 %
IPv6

61
Domains

100
Subdomains

84
IPs

9
Countries

2749 kB
Transfer

7855 kB
Size

90
Cookies

229 HTTP transactions
0 data transactions