login5.demonyins.top Open in urlscan Pro
2606:4700:3031::ac43:d8c7 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login5.demonyins.top/
Submission: On May 15 via automatic, source certstream-suspicious (May 15th 2023, 5:45:22 pm UTC) — Scanned from DE

Summary HTTP 134 Redirects Links 80 Behaviour Indicators

Summary

This website contacted 34 IPs in 3 countries across 24 domains to perform 134 HTTP transactions. The main IP is 2606:4700:3031::ac43:d8c7, located in United States and belongs to CLOUDFLARENET, US. The main domain is login5.demonyins.top.
TLS certificate: Issued by GTS CA 1P5 on April 3rd 2023. Valid for: 3 months.

This is the only time login5.demonyins.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3031::ac43:d8c7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
42	151.101.1.164 151.101.1.164	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
4	52.3.42.214 52.3.42.214	14618 (AMAZON-AES) (AMAZON-AES)
2	2600:9000:249... 2600:9000:2491:cc00:4:b37b:9440:93a1	16509 (AMAZON-02) (AMAZON-02)
3	52.222.208.154 52.222.208.154	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	37.252.171.149 37.252.171.149	29990 (ASN-APPNEX) (ASN-APPNEX)
5	2602:803:c003... 2602:803:c003:200::21	26667 (RUBICONPR...) (RUBICONPROJECT)
1	34.107.148.139 34.107.148.139	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	3.72.132.166 3.72.132.166	16509 (AMAZON-02) (AMAZON-02)
6	52.222.209.4 52.222.209.4	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	143.204.215.54 143.204.215.54	16509 (AMAZON-02) (AMAZON-02)
1 3	13.32.121.72 13.32.121.72	16509 (AMAZON-02) (AMAZON-02)
1	23.35.228.23 23.35.228.23	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
1 2	142.250.186.166 142.250.186.166	15169 (GOOGLE) (GOOGLE)
1	2600:9000:205... 2600:9000:2057:1c00:18:1fcd:351:7bc1	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:20:... 2606:4700:20::ac43:4842	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2606:4700:20:... 2606:4700:20::681a:7e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.172.179.242 54.172.179.242	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	20.50.2.28 20.50.2.28	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
134	34

10 2606:4700:3031::ac43:d8c7 (United States)

ASN13335 (CLOUDFLARENET, US)

login5.demonyins.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 151.101.1.164 (United States)

ASN54113 (FASTLY, US)

g1.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static01.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
samizdat-graphql.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static01.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vp.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a1.nyt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.3.42.214 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-42-214.compute-1.amazonaws.com

a.et.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2491:cc00:4:b37b:9440:93a1 (United States)

ASN16509 (AMAZON-02, US)

rumcdn.geoedge.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.208.154 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-208-154.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.149 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2602:803:c003:200::21 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.148.139 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 139.148.107.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

nytimes-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.72.132.166 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-72-132-166.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.222.209.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-209-4.fra56.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.215.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-54.fra53.r.cloudfront.net

dd.nytimes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.121.72 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-72.fra60.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.228.23 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-228-23.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f6.1e100.net

5290727.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:1c00:18:1fcd:351:7bc1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4842 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:20::681a:7e5 (United States)

ASN13335 (CLOUDFLARENET, US)

platform.iteratehq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
iteratehq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.172.179.242 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-179-242.compute-1.amazonaws.com

pnytimes.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.50.2.28 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

collector.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	nyt.com g1.nyt.com — Cisco Umbrella Rank: 9950 static01.nyt.com — Cisco Umbrella Rank: 7579 vp.nyt.com — Cisco Umbrella Rank: 16310 a1.nyt.com — Cisco Umbrella Rank: 8598	2 MB
15	nytimes.com samizdat-graphql.nytimes.com — Cisco Umbrella Rank: 6927 a.et.nytimes.com — Cisco Umbrella Rank: 6616 als-svc.nytimes.com Failed www.nytimes.com — Cisco Umbrella Rank: 4493 static01.nytimes.com — Cisco Umbrella Rank: 11070 dd.nytimes.com — Cisco Umbrella Rank: 11192 purr.nytimes.com Failed a.nytimes.com Failed meter-svc.nytimes.com Failed	145 KB
14	googlesyndication.com 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 143 pagead2.googlesyndication.com — Cisco Umbrella Rank: 107	64 KB
10	demonyins.top login5.demonyins.top	729 KB
9	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 310 aax.amazon-adsystem.com — Cisco Umbrella Rank: 406	63 KB
8	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 205 5290727.fls.doubleclick.net — Cisco Umbrella Rank: 10637	169 KB
6	iteratehq.com platform.iteratehq.com — Cisco Umbrella Rank: 7828 iteratehq.com — Cisco Umbrella Rank: 6848	32 KB
5	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 491	4 KB
3	brandmetrics.com cdn.brandmetrics.com — Cisco Umbrella Rank: 3226 collector.brandmetrics.com — Cisco Umbrella Rank: 3645	17 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 164	844 B
3	google.com adservice.google.com — Cisco Umbrella Rank: 83 www.google.com — Cisco Umbrella Rank: 2	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 39	21 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 50	2 KB
2	3lift.com tlx.3lift.com — Cisco Umbrella Rank: 533 eb2.3lift.com — Cisco Umbrella Rank: 389	725 B
2	openx.net nytimes-d.openx.net — Cisco Umbrella Rank: 13133 u.openx.net — Cisco Umbrella Rank: 683	512 B
2	media.net prebid.media.net — Cisco Umbrella Rank: 1430 cs.media.net — Cisco Umbrella Rank: 1560	1 KB
2	geoedge.be rumcdn.geoedge.be — Cisco Umbrella Rank: 1720	116 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	154 KB
1	chartbeat.net pnytimes.chartbeat.net — Cisco Umbrella Rank: 7989	201 B
1	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 1680	24 KB
1	gstatic.com fonts.gstatic.com	13 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 192	59 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 7680	531 B
1	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 232	866 B
134	24

	Domain	Requested by
18	static01.nyt.com	login5.demonyins.top
12	g1.nyt.com	login5.demonyins.top g1.nyt.com 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
10	login5.demonyins.top	login5.demonyins.top rumcdn.geoedge.be
6	tpc.googlesyndication.com	12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com rumcdn.geoedge.be
6	aax.amazon-adsystem.com	c.amazon-adsystem.com
6	securepubads.g.doubleclick.net	login5.demonyins.top rumcdn.geoedge.be securepubads.g.doubleclick.net 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com www.googletagservices.com
5	pagead2.googlesyndication.com	www.googletagservices.com securepubads.g.doubleclick.net tpc.googlesyndication.com
5	static01.nytimes.com	12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
5	fastlane.rubiconproject.com	www.nytimes.com
4	iteratehq.com	platform.iteratehq.com
4	a.et.nytimes.com	login5.demonyins.top
3	sb.scorecardresearch.com	1 redirects login5.demonyins.top
3	12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com	securepubads.g.doubleclick.net rumcdn.geoedge.be 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
3	c.amazon-adsystem.com	login5.demonyins.top c.amazon-adsystem.com
3	samizdat-graphql.nytimes.com	login5.demonyins.top
2	platform.iteratehq.com	login5.demonyins.top platform.iteratehq.com
2	cdn.brandmetrics.com	www.googletagmanager.com rumcdn.geoedge.be
2	a1.nyt.com	login5.demonyins.top www.googletagmanager.com
2	5290727.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	dd.nytimes.com	login5.demonyins.top dd.nytimes.com
2	fonts.googleapis.com	client 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
2	adservice.google.com	rumcdn.geoedge.be 5290727.fls.doubleclick.net
2	rumcdn.geoedge.be	login5.demonyins.top rumcdn.geoedge.be
2	www.googletagmanager.com	login5.demonyins.top www.googletagmanager.com
1	collector.brandmetrics.com	cdn.brandmetrics.com
1	www.google.com	rumcdn.geoedge.be
1	pnytimes.chartbeat.net
1	static.chartbeat.com	login5.demonyins.top
1	eb2.3lift.com	login5.demonyins.top
1	cs.media.net	login5.demonyins.top
1	u.openx.net	login5.demonyins.top
1	vp.nyt.com	login5.demonyins.top
1	fonts.gstatic.com	fonts.googleapis.com
1	www.googletagservices.com	12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
1	adservice.google.de	rumcdn.geoedge.be
1	tlx.3lift.com	www.nytimes.com
1	nytimes-d.openx.net	www.nytimes.com
1	prebid.media.net	www.nytimes.com
1	ib.adnxs.com	www.nytimes.com
1	www.nytimes.com	login5.demonyins.top
0	meter-svc.nytimes.com Failed	login5.demonyins.top
0	a.nytimes.com Failed	login5.demonyins.top
0	purr.nytimes.com Failed	login5.demonyins.top
0	als-svc.nytimes.com Failed	login5.demonyins.top
134	45

This site contains links to these domains. Also see Links.

Domain
www.nytimes.com
cn.nytimes.com
cooking.nytimes.com
theathletic.com
nytimes.com
help.nytimes.com
www.nytco.com
nytmediakit.com
www.tbrandstudio.com

Subject Issuer	Validity	Valid
*.demonyins.top GTS CA 1P5	`2023-04-03` - `2023-07-02`	3 months	crt.sh
nytimes.com Thawte RSA CA 2018	`2023-03-22` - `2024-04-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
a.et.nytimes.com R3	`2023-03-17` - `2023-06-15`	3 months	crt.sh
gw.geoedge.be Amazon RSA 2048 M01	`2023-02-21` - `2023-10-10`	8 months	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
prebid.media.net GTS CA 1D4	`2023-05-09` - `2023-08-07`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
*.google.de GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
dd.nytimes.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-08` - `2024-04-06`	a year	crt.sh
*.scorecardresearch.com Amazon RSA 2048 M02	`2023-03-01` - `2024-01-28`	a year	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-02-18`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2022-05-06` - `2023-06-03`	a year	crt.sh
brandmetrics.com GTS CA 1P5	`2023-05-10` - `2023-08-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-06` - `2024-05-04`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2022-12-19` - `2023-12-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.brandmetrics.com Go Daddy Secure Certificate Authority - G2	`2023-05-10` - `2024-06-10`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://login5.demonyins.top/
Frame ID: 0CA11BFE9629A09ED3AC84631B729153
Requests: 102 HTTP requests in this frame

Frame: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 3F9CB363FF17178A813D9357FBDB0609
Requests: 1 HTTP requests in this frame

Frame: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 8A27AD748974CB87C109071BBD7879FE
Requests: 21 HTTP requests in this frame

Frame: https://5290727.fls.doubleclick.net/activityi;dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demonyins.top%2F
Frame ID: 58F65B7FC5D19F895B7FFAC4021CECE5
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 3901FC087D34FCD9CED38E14ADCD1D52
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2C8355E909D67755A16AADC2F2F35AC9
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The New York Times - Breaking News, US News, World News and Videos

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Datadome (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

134
Requests

94 %
HTTPS

55 %
IPv6

24
Domains

45
Subdomains

34
IPs

3
Countries

4045 kB
Transfer

8278 kB
Size

18
Cookies

80 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nytimes.com/es/
Title: Español

Search URL Search Domain Scan URL

URL: https://cn.nytimes.com/
Title: 中文

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/section/todayspaper
Title: Today’s Paper

Search URL Search Domain Scan URL

URL: https://cooking.nytimes.com/
Title: Cooking

Search URL Search Domain Scan URL

URL: https://theathletic.com/
Title: The Athletic

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/wirecutter/
Title: Wirecutter

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/crosswords
Title: Games

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/15/upshot/migrations-college-super-cities.html
Title: College-Educated Workers Are Leaving Coastal Cities, Analysis ShowsThe college graduates who fill white-collar jobs are migrating away from the country’s most expensive major metros — and have been since before the pandemic.10 min read<img src="https://static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/migrations-college-super-cities-promo-threeByTwoMediumAt2X-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/middleeast/turkey-election-polls-erdogan.html
Title: Analysis: Erdogan’s Grip on Power Is Loosened but Not Broken, Vote ShowsDespite a struggling economy and the opposition to Turkey’s drift toward one-man rule, President Recep Tayyip Erdogan was leading ahead of a presidential runoff.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/middleeast/turkey-election-results-erdogan-runoff.html
Title: Here are four takeaways from Turkey’s nail-biting presidential election.4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/15/world/europe/turkey-election-results.html
Title: These maps show how every province in Turkey has voted so far.

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2023/05/15/world/russia-ukraine-news
Title: Britain Promises More Missiles and Drones on Zelensky’s VisitA brief stop in England by President Volodymyr Zelensky of Ukraine on Monday came after a whirlwind trip through Europe’s capitals over the weekend.See more headlines 8+

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/business/economy/russia-airlines-sanctions-ukraine.html
Title: Russian customs data showed that millions of dollars of U.S.-made aircraft parts were sent to Russia last year.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/world/europe/wagner-prigozhin-bakhmut.html
Title: The Wagner leader disputed a report that he offered to betray Russia.2 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/science/environmental-dna-ethics-privacy.html
Title: Your DNA Can Now Be Pulled From Thin Air. Privacy Experts Are Worried.Environmental DNA research has aided conservation, but scientists say its ability to glean information about human populations and individuals poses dangers.8 min read<img src="https://static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/15sci-dna-ethics-A-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="An artist’s illustration depicting a blue and black vortex pulling DNA helixes from a pond in a park surrounded by trees and skyscrapers." class="css-122y91a"/>Isabel Seliger

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/business/diversity-equity-inclusion-belonging.html
Title: Why Some Companies Are Opting to Use the Term ‘Diversity and Belonging’The changing terminology reflects new thinking among some consultants, who say traditional D.E.I. strategies haven’t worked out as planned.7 min read<img src="https://static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/07DEI-BELONGING-02-sub-qktb-threeByTwoMediumAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Karith Foster, the chief executive of Inversity Solutions, wears an eggplant-colored dress and waves one hand in the air as she speaks to an audience." class="css-122y91a"/>Karith Foster, chief executive of the consultancy Inversity Solutions, said an overemphasis on identity groups and a tendency to reduce people to “victim or villain” can alienate. Nick Oxford for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/nyregion/brooklyn-seltzer-boys.html
Title: Inside the Last Old-School Seltzer Shop in New YorkBrooklyn Seltzer Boys has a century-old carbonator and a museum with a spritzing station. Beat that, LaCroix.Juan Arredondo for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/north-carolina-abortion-veto-roy-cooper.html
Title: Abortion Showdown in North Carolina May Hinge on a Single VoteAfter the G.O.P.-led legislature passed a 12-week ban, the Democratic governor vetoed the bill. The Republicans could override it, if they stay unified.6 min read<img src="https://static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/00nat-nc-abortion-showdown-01-wtcq-threeByTwoMediumAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A man in a white dress shirt and light blue tie speaks at a podium. " class="css-122y91a"/>Roy Cooper, the Democratic governor of North Carolina, vetoed a bill banning abortion at 12 weeks. Kate Medley for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/nyregion/nyc-garage-collapse.html
Title: A Crumbling New York Garage Collapsed. Dozens More Have Similar Problems.The fatal failure of a building in Manhattan raised questions about parking structures across the city. Records and interviews revealed widespread issues.10 min read<img src="https://static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/00ny-collapse46-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Fallen bricks cover a car at a collapsed garage on Ann Street." class="css-122y91a"/>Dave Sanders for The New York Times

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/technology/eu-microsoft-activision-blizzard.html
Title: E.U. Approves Microsoft’s $69 Billion Deal for ActivisionThe green light follows objections to the blockbuster deal by American and British regulators on the grounds that it would undercut competition.4 min read<img src="https://static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Men wearing headphones are seated at a long table in front of computer screens in a dark room with purple, pink and green neon lights. " class="css-122y91a"/>Sergio Flores/Bloomberg

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/television/succession-alan-ruck.html
Title: Alan Ruck Is Ready to Leave the Roy FamilyAs “Succession” nears its end, the veteran actor is looking forward to closing the book on Connor Roy.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/arts/television/succession-recap-season-4-episode-8.html
Title: “Succession” recap: It’s election night in America. Stay away from the bodega sushi.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/television/succession-election.html
Title: Democracy went up for sale in “Succession.” In the real world, the price is usually cheaper, our critic writes.6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/arts/friars-club-last-call.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/15friars-01-zvpb-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman walks past a stone townhouse whose first floor features purple canopies." class="css-122y91a"/>Hiroko Masuike/The New York TimesIs It Last Call at New York’s Friars Club?The headquarters of the legendary entertainment fraternity is facing the threat of foreclosure as its leaders look for a buyer to help keep the party going.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/11/sports/tennis/pickleball-platform-tennis-padel.html
Title: <img src="https://static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="An overhead shot of a large outdoor facility with multiple blue courts. A palm-tree-lined road can be seen in the distance." class="css-122y91a"/>Are you on team tennis, pickleball or padel? Or all three?6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/12/science/demon-shark-new-species-australia.html
Title: <img src="https://static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/12xp-shark-01-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Apristurus ovicorrugatus, a long, gray shark with bright white eyes." class="css-122y91a"/>There’s something “spooky” about this newly discovered shark species.2 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/section/opinion
Title: Opinion

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/trump-cnn-biden-jordan-neely.html
Title: Gail Collins and Bret StephensTrump Cannot Be Unseen7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/youth-achievement-happiness.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/15gopnik-lead-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A photograph of a young pianist’s hand on a keyboard." class="css-122y91a"/>Adam GopnikWhat We Lose When We Push Our Kids to ‘Achieve’6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/france-macron-le-pen.html
Title: Mitchell Abidor and Miguel LagoHow Marine Le Pen Became France’s Voice of Reason5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/chips-incentives-biden.html
Title: Nathan M. Jensen and Steven PedigoWhy Laws Meant to Create Jobs Can Be So Destructive for Our Cities5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/letter-to-graduates-hope-despair.html
Title: <img src="https://static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/margaret-renkl-new-thumbLarge.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Margaret Renkl" class="css-122y91a"/>Margaret RenklGraduates, My Generation Wrecked So Much That’s Precious. How Can I Offer You Advice?5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/title-42-border-immigration.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/15villavicencio-ktlv-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A child looking through the gap in a rusty corrugated metal wall." class="css-122y91a"/>Karla Cornejo VillavicencioImmigrants Love America the Way It Needs to Be Loved4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/opinion/letters/ralph-nader-third-parties.html
Title: Letters From Our ReadersRalph Nader and Others Clash Over the Value of Third Parties5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/jordan-neely-killing-subway.html
Title: <img src="https://static01.nyt.com/images/2023/01/10/opinion/david-french/david-french-thumbLarge-v2.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="David French" class="css-122y91a"/>David FrenchWhen the Rule of Law Fails Us5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/sudan-medicine-doctors.html
Title: Farah StockmanLeaders Stay, Others Run5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/mothers-day-stepmother.html
Title: Rachel Louise SnyderWhat Do You Say When the Person You Love Most in the World Returns?7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/debt-limit-constitution.html
Title: Michael W. McConnellThe Case for Violating the Debt Limit Is Dangerous Nonsense4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/opinion/digital-screen-time-children.html
Title: Tish Harrison WarrenManaging Screen Time Is a Family Matter7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/interactive/2023/05/11/opinion/pandemic-learning-losses-steep-but-not-permanent.html
Title: Tom Kane and Sean ReardonParents Don’t Understand How Far Behind Their Kids Are in School

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/frankenheimer-seconds-movie.html
Title: Jamelle BouieJohn Frankenheimer Pointed His Camera Toward the Things We Cannot Escape6 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/trump-town-hall-cnn.html
Title: Maureen DowdAs Sun Tzu Says, ‘Know the Enemy’4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/13/opinion/trump-cnn-tv-news.html
Title: Bill SammonWe’re Asking the Wrong Questions About the Trump Town Hall4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/podcasts/the-daily/banning-spywear.html
Title: Listen to ‘The Daily’Inside the U.S. government’s double-edged relationship with the most powerful and notorious hacking tool.<img src="https://static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/the-daily-album-art-square320-v5.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/briefing/the-case-for-journalistic-independence-ag-sulzberger.html
Title: Read The MorningCovid coverage offers a case study of journalistic independence, David Leonhardt writes.7 min read<img src="https://static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/the-morning-icon-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/us/migrants-condition-title-42-ends.html
Title: After a Border Policy Ends, the Migration Surge Abates. For Now.Economic hardship, climate change, political instability and gang violence will continue to spur emigration to the U.S. from many corners of the world.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/health/alzheimers-mutation-gene.html
Title: Mutation Protected Man From Alzheimer’s Disease, Hinting at TreatmentA man in his early 40s showed physical signs of the illness, but didn’t develop symptoms until he was nearly 70 because of a protective gene.3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/politics/biden-monica-bertagnolli-nih.html
Title: A Cancer Surgeon and Patient Is Biden’s Pick to Lead N.I.H.President Biden said that he had selected Dr. Monica Bertagnolli to be the next director of the National Institutes of Health.3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/us/chicago-mayor-brandon-johnson-policing-migrants.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15nat-chicago-new-mayor-promo-ljcz/15nat-chicago-new-mayor-promo-ljcz-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>Jamie Kelter Davis for The New York TimesWhat Chicago’s New Mayor Says About the City’s Biggest ChallengesBrandon Johnson, a progressive Democrat who was sworn in today, explains how he plans to manage the nation’s third-largest city in a complicated moment.4 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/style/spring-fashion-street-style.html
Title: <img src="https://static01.nyt.com/images/2023/05/14/multimedia/16STYLE-OUTSIDE-SPRING-02-zkwm/16STYLE-OUTSIDE-SPRING-02-zkwm-threeByTwoMediumAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman, seen from the hips up, standing on a street. She has dark curly hair that falls below her shoulders and is wearing a pink cross-body bag, a green bomber jacket, a blue, green and orange striped sweater and a chain necklace. " class="css-122y91a"/>Spring Dressing Isn’t ImpossibleThe key? Don’t worry about following rules.1 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/style/wardrobe-update-color.html
Title: <img src="https://static01.nyt.com/images/2023/05/12/multimedia/12openThread-QA-fjhm/12openThread-QA-fjhm-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="Cruz Beckham, wearing sunglasses and a bright yellow and royal purple jacket; Jaden Smith, in head-to-toe camouflage print; and Justin Timberlake, wearing a Kenzo jacket the color of a martini olive, sitting in the front row of a fashion show." class="css-122y91a"/>How Do I Upgrade My Carhartt Wardrobe?A reader wants to spruce up a closet full of “drab Pacific Northwest earth tones.”3 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/11/business/ana-ros-michelin-woman-chef.html
Title: <img src="https://static01.nyt.com/images/2023/04/27/multimedia/00Transforming-Chef-vkjl/00Transforming-Chef-vkjl-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A woman in a white chef’s outfit leans on a large wooden table with her hand on her chin. Next to her on the table is a tall plant in a pot. In the background are framed paintings on the wall. " class="css-122y91a"/>Ana Ros, One of the World’s Best ChefsShe broke through the boys’ club of fine dining, earning two Michelin stars.7 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/books/anne-berest-the-postcard.html
Title: <img src="https://static01.nyt.com/images/2023/05/11/multimedia/11Berest-01-hfqg/11Berest-01-hfqg-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="The author Anne Berest is seen in profile, in a white button-down shirt. " class="css-122y91a"/>A Mysterious Postcard Sparks a NovelAnne Berest’s “The Postcard” is part Holocaust drama, part family mystery.5 min read

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/15/books/review/henry-threadgill-easily-slip-into-another-world.html
Title: <img src="https://static01.nyt.com/images/2023/05/15/multimedia/15threadgill-review-wzbl/15threadgill-review-wzbl-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale" alt="A black-and-white photograph of Henry Threadgill playing the saxophone." class="css-122y91a"/>Vietnam Changed How He Heard the WorldHenry Threadgill’s memoir traces his wartime experience to his jazz career.5 min read

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519232/2023/05/15/ja-morant-gun-instagram-live-punishment/
Title: All Ja Morant Had to Do Was Learn From His Suspension. He Didn’t. Now What?After another gun-related incident, the N.B.A. star’s luck has almost certainly run out, our columnist writes.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519445/2023/05/15/dodgers-padres-nl-west-standard/
Title: Why the Dodgers, Not the Padres, Remain the StandardUntil proven otherwise, there is a separator between these two teams: One knows how to win.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4519924/2023/05/15/sixers-celtics-game-7-playoffs-uncertainty/
Title: This Year Might Have Been the 76ers’ Best Chance at a Title. They Blew It.Nobody took a greater individual hit with their Game 7 performance than Joel Embiid.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4509806/2023/05/15/fourth-official-premier-league-hell/
Title: The Worst Job in Soccer: ‘It’s 90 Minutes of Hell’

Search URL Search Domain Scan URL

URL: https://theathletic.com/4474815/2023/05/15/florida-football/
Title: College Football Is in an Arms Race. One Storied Program Is Falling Behind.

Search URL Search Domain Scan URL

URL: https://theathletic.com/4520492/2023/05/15/manchester-city-premier-league-title/
Title: Could Premier League Punishments Affect the Title Race?

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/games/wordle/index.html
Title: WordleGuess the 5-letter word with 6 chances.<img src="https://static01.nyt.com/images/2022/03/02/crosswords/alpha-wordle-icon-new/alpha-wordle-icon-new-square320-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/2023/05/14/crosswords/wordle-review-answer-694.html
Title: Today’s Wordle ReviewOur columnist reviews the day’s puzzle. Warning: Contains spoilers!2 min read<img src="https://static01.nyt.com/images/2023/05/14/crosswords/14wordle-review-art/14wordle-review-art-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="On a muted red background in painterly strokes, three langurs ranging in tone from teal to green run and jump alongside a b-boy dancer wearing a bright magenta hoodie and army green pants. The day's Wordle number is layered on top." class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://nytimes.com/games/digits
Title: Digits | BetaChallenge yourself with a daily numbers puzzle.<img src="https://static01.nyt.com/images/2023/03/21/crosswords/alpha-digits-icon-beta/alpha-digits-icon-beta-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/puzzles/spelling-bee
Title: Spelling BeeHow many words can you make with 7 letters?<img src="https://static01.nyt.com/images/2019/04/18/homepage/spelling-bee-logo-bulletin/spelling-bee-logo-bulletin-square320-v5.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/puzzles/letter-boxed
Title: Letter BoxedCreate words using letters around the square.<img src="https://static01.nyt.com/images/2021/05/27/multimedia/alpha-letterboxed-promo-1622145789727/alpha-letterboxed-promo-1622145789727-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale" alt="" class="css-122y91a"/>

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014792127-Copyright-notice
Title: © 2023 The New York Times Company

Search URL Search Domain Scan URL

URL: https://www.nytco.com/
Title: NYTCo

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115015385887-Contact-Us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115015727108-Accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.nytco.com/careers/
Title: Work with us

Search URL Search Domain Scan URL

URL: https://nytmediakit.com/
Title: Advertise

Search URL Search Domain Scan URL

URL: https://www.tbrandstudio.com/
Title: T Brand Studio

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/privacy/cookie-policy#how-do-i-manage-trackers
Title: Your Ad Choices

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/privacy/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014893428-Terms-of-service
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us/articles/115014893968-Terms-of-sale
Title: Terms of Sale

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/ca/?action=click&region=Footer&pgtype=Homepage
Title: Canada

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/international/?action=click&region=Footer&pgtype=Homepage
Title: International

Search URL Search Domain Scan URL

URL: https://help.nytimes.com/hc/en-us
Title: Help

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/subscription?campaignId=37WXW
Title: Subscriptions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 110

https://5290727.fls.doubleclick.net/activityi;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demonyins.top%2F HTTP 302
https://5290727.fls.doubleclick.net/activityi;dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demonyins.top%2F

Request Chain 116

https://sb.scorecardresearch.com/c2/3005403/cs.js HTTP 302
https://sb.scorecardresearch.com/internal-c2/3005403/cs.js

134 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login5.demonyins.top/ 538 KB
96 KB 714ms
647ms Document
text/html 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d9a59fc4834b4435f67f3d6d247c7cec68b50e18a9931084111ece2adec475a8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 237
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: s-maxage=30,no-cache
cf-cache-status: DYNAMIC
cf-ray: 7c7d3174d9ba9049-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-type: text/html; charset=utf-8
date: Mon, 15 May 2023 17:45:11 GMT
last-modified: Mon, 15 May 2023 17:41:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7xOVEyyZ5cFGfm9h1Tbc5FvKXxUkb9DM9eZNUe5smJIN1y74sGNT3FpJuRMWZZUjknQx6dcyesyEboYK6SOYVVdWidvzqPaVQqQ9DiTVbiGW3ym51KEane7LqNNpuXaHtckw%2BqnCaYjksVaYFkX9IUvH8A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; preload; includeSubdomains
vary: Accept-Encoding, Fastly-SSL
x-api-version: F-F-VI
x-b3-traceid: 565230f5032a40188009cc04232bcbc3
x-cache: MISS, HIT
x-cache-hits: 0, 1
x-cloud-trace-context: a264424cc355fbac84e474a8ec86263a/10166225743120571928;o=1
x-content-type-options: nosniff
x-frame-options: DENY
x-gdpr: 0
x-nyt-app-webview: 0
x-nyt-data-last-modified: Mon, 15 May 2023 17:41:14 GMT
x-nyt-edge-cache: MISS-HIT
x-nyt-route: homepage
x-origin-time: 2023-05-15 17:41:14 UTC
x-pagetype: vi-homepage
x-served-by: cache-lga21961-LGA, cache-sna10726-LGB
x-timer: S1684172712.675314,VS0,VE4
x-xss-protection: 1; mode=block

GET
H2 200 web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
g1.nyt.com/fonts/css/ 60 KB
10 KB 126ms
19ms Stylesheet
text/css 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

09bff184ea094a06e46d7f26512fd7b245304078a27f1ba8084488cbcf7704de

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Fri, 19 Jan 2024 14:25:45 GMT
date: Mon, 15 May 2023 17:45:11 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 10034365
x-guploader-uploadid: ADPycdu8r8EIkDKHQncby-VxhC4_p_retMia2725uERdqg3x4PWqarMbAFr8Ibt9W3TTJubkfCi_3gQtjgkfPrPzZrZXWJ9J46L7
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 9868
x-served-by: cache-fra-etou8220070-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172712.933045,VS0,VE0
etag: "b79308aee772cf8921761a4fdb884fe5"
vary: Accept-Encoding
x-goog-generation: 1673991774978541
x-goog-hash: crc32c=ay5bmg==, md5=t5MIrudyz4khdhpP24hP5Q==
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 9868
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 18468

GET
H2 200 global-f449cfd9976ad673ef2b7ab5098b85be.css
login5.demonyins.top/vi-assets/static-assets/ 6 KB
3 KB 2689ms
2689ms Stylesheet
text/css 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/global-f449cfd9976ad673ef2b7ab5098b85be.css

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57bc281be64ff5ec8e3c2258640df6097a32f08ac5a2c346f214300eb430f176

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsIkqZ227oSkhi_DuQFG3K-bLhwXa1gCU8NN5dnwn05jZE56FGlKAHTE3mGwjBW8GspHPN_ZTL3sWhFI_lboEiuTA
x-goog-stored-content-encoding: identity
x-origin-time: 2022-10-12 15:49:59 UTC
x-served-by: cache-sna10739-LGB
x-timer: S1684172714.065982,VS0,VE1
etag: W/"e74f8b7c668251280cf3e52e20455a1c"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1665589250507895
content-type: text/css; charset=utf-8
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/global-f449cfd9976ad673ef2b7ab5098b85be.css
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 437
expires: Thu, 12 Oct 2023 15:49:59 GMT
date: Mon, 15 May 2023 17:45:14 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 12 Oct 2022 15:40:50 GMT
server: cloudflare
x-goog-hash: crc32c=jAKqfw==, md5=50+LfGaCUSgM8+UuIEVaHA==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I7WZLB34BlqG%2B34Zy93bYZoQfu%2FGnpl%2BBDy3%2BnUWLJBf2Z9keYMsVVgbc%2BqIAu4iNFfW8zmklI7L7FibTclcbbSp%2FODupd9KDRdKhXHwTSm1bcAa0nutWlGBIMpFUqrwYa%2BkpLqOHGJfo%2Fdtw5jBeW0txg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 5656
cf-ray: 7c7d3178ee109049-FRA

GET
H3 200 adslot-6cfc3a3f6d8b97c7ed5d.js Show response
login5.demonyins.top/vi-assets/static-assets/ 22 KB
9 KB 1451ms
1450ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/adslot-6cfc3a3f6d8b97c7ed5d.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88c02f49ec94fda86796bb949e3674af90a3b642839f424a4c13e510259a49b4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdtFud2DScbQxsNseMq9LLPLoKbKs64XIgl0nTVYW-ZPFHcRI4W4fdZ38lT77yRtlZ3FHNL2hsOlw-FTL0L86gvmdA
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-09 16:20:10 UTC
x-served-by: cache-sna10734-LGB
x-timer: S1684172713.042160,VS0,VE1
etag: W/"de5aa7ec9e5831fb28f94291b754ad06"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1683591394785641
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/adslot-6cfc3a3f6d8b97c7ed5d.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 15528
expires: Wed, 08 May 2024 16:20:10 GMT
date: Mon, 15 May 2023 17:45:13 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 09 May 2023 00:16:34 GMT
server: cloudflare
x-goog-hash: crc32c=/TEQzw==, md5=3lqn7J5YMfso+UKRt1StBg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IcZOFOCpNDfxwB7fI4Swf0Z2AnBDFquwefZrElItGZRwkKXB88tpelITDVnE0qkVk%2FUKhNrp5p%2BokvLRUH7V1qBH1g6eg3B9%2F%2B5YUTqjPg1C9dEiVYGdL4mMtDUMsHYPWInq1Fq83OiU%2BdZW24c7%2BUOSNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 22455
cf-ray: 7c7d3179ff979bf5-FRA

GET
H2 200 migrations-college-super-cities-promo-threeByTwoSmallAt2X-v3.png
static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/ 5 KB
6 KB 43ms
20ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/11/upshot/migrations-college-super-cities-promo/migrations-college-super-cities-promo-threeByTwoSmallAt2X-v3.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d4c5b9f51bf43056dacc9054f4a0ca873b8b9ef2afb9eb445a62d5cc6c426dd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:56:21 GMT
date: Mon, 15 May 2023 17:45:13 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2931
x-guploader-uploadid: ADPycds1vaZaGuRRwVI19p1s5hZifhadsL2b4xdTVxou7JPtabON2MDUjKNW3Olg6F6Cb7NX-0VtSbOcZoI2kfGeqlo7sfvqL1Ww
x-cache: HIT, HIT
fastly-io-info: ifsz=6963 idim=600x400 ifmt=png ofsz=5138 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 5138
x-served-by: cache-iad-kiad7000107-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172713.474649,VS0,VE0
etag: "oAAnPmik7S+cpW4zkJny51Y3vnT+7aHzXrSDICAzEx8"
vary: Accept
x-goog-generation: 1684169781405530
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=HuZetw==, md5=5dZsBOhm7OlCQJwcs2yW2w==
cache-control: public, max-age=604800, stale-if-error=86400, stale-while-revalidate=30
x-goog-stored-content-length: 6963
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 15, 20

GET
H2 200 15friars-01-zvpb-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/ 27 KB
28 KB 24ms
24ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15friars-01-zvpb/15friars-01-zvpb-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8fd57afe26f59515704cee10d922b01c9d1aaa8257abf811490d7fdef48d1e73

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 14:03:25 GMT
date: Mon, 15 May 2023 17:45:13 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 13308
x-guploader-uploadid: ADPycdsKdhkyGaVXNlPx8_TWP_gklpqRtITwKCnC_8_KdTPqNK2RWn46qBUqzATia733SQxeUDzPo4vBLG4-rthRHC-41g
x-cache: HIT, HIT
fastly-io-info: ifsz=58196 idim=600x400 ifmt=jpeg ofsz=28020 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 28020
x-served-by: cache-iad-kiad7000088-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172713.496550,VS0,VE0
etag: "zLSutaEg7LOPioqy12EcF2ZuADfKRVR/MV4cP4UuFb4"
vary: Accept
x-goog-generation: 1684159208058553
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=vXe1Qg==, md5=sna7XdICa0MV3yzBcN3/SA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 58196
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 37, 4

GET
H2 200 11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/ 68 KB
69 KB 22ms
22ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/11/multimedia/11rackets-future-05-clpt/11rackets-future-05-clpt-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5af3756336be117aeae1865f764ab57d5fd8384ec55be872fd9862b71047311f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 11 May 2023 14:02:48 GMT
date: Mon, 15 May 2023 17:45:13 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 358945
x-guploader-uploadid: ADPycds3IJiaxkBzqJ5VTcjfQTGianmgPdkgTCvSGu8d907FNYdMHYf2LX5EZ5SDK6WGkcaEiao-1zZo53zTdQtcjH07HA
x-cache: HIT, HIT
fastly-io-info: ifsz=126323 idim=600x400 ifmt=jpeg ofsz=69842 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 69842
x-served-by: cache-iad-kjyo7100082-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172714.527515,VS0,VE1
etag: "HpOrjgklDZPyIY+tBN++vannKxDEhastw8795X2ynto"
vary: Accept
x-goog-generation: 1683813610590802
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=h72b8w==, md5=zIXwAVlosHSMTh/cMiKBCA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 126323
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 37, 38

GET
H2 200 12xp-shark-01-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/ 9 KB
9 KB 20ms
19ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/multimedia/12xp-shark-01/12xp-shark-01-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

4d1fa762c4ceaff06454053eb6b793bb211ef208329085b9073ecdffc90ccd31

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Fri, 12 May 2023 10:37:59 GMT
date: Mon, 15 May 2023 17:45:13 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 284834
x-guploader-uploadid: ADPycdvmG54jO3g7BrAh6piCQ5vgP3ipBqbl-lRZXgCptDizkELuhSXttN5gu7_28Y8JNsJMY88PTaz8elohZ5eHiEAMBg
x-cache: HIT, HIT
fastly-io-info: ifsz=31223 idim=600x401 ifmt=jpeg ofsz=8948 odim=600x401 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 8948
x-served-by: cache-iad-kcgs7200083-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172714.567646,VS0,VE0
etag: "zb5NLricPNuu23pF3Ka0EAFlQaleZgG3MNFZHiN2h0Y"
vary: Accept
x-goog-generation: 1683887404987381
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=+Vy6Cw==, md5=bEE6TPSYv/aoTAYTe/3LiQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 31223
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 11, 38

GET
H3 200 vendor-b261f5b50fd0c857de07.js Show response
login5.demonyins.top/vi-assets/static-assets/ 173 KB
50 KB 2038ms
2038ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/vendor-b261f5b50fd0c857de07.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5d4f80afc66fb8d60756e7daaf477e986ca9cd0f25325420e28baadd15c0e87

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdvvM3qJhPs3K9OO8vMI9HU0GiqfZNkdQ-YYPpgeGmLxJJzjZEBRgMiHDr-MtGtJaDgbI_CMgX-uOm7hKVe-XFptauX8Z11-
x-goog-stored-content-encoding: identity
x-origin-time: 2023-03-28 18:40:27 UTC
x-served-by: cache-sna10745-LGB
x-timer: S1684172715.022403,VS0,VE1
etag: W/"0e1f964af1f8b128478e4eda19557589"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1680028418821973
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendor-b261f5b50fd0c857de07.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 13802
expires: Wed, 27 Mar 2024 18:39:41 GMT
date: Mon, 15 May 2023 17:45:15 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 28 Mar 2023 18:33:38 GMT
server: cloudflare
x-goog-hash: crc32c=RBkcUw==, md5=Dh+WSvH4sShHjk7aGVV1iQ==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cHHylidfUNjZ8xVP8Ghb%2F3c5wwOPdjdZFCml1cNmrqTZHfrkHtnFzNZlr1KqG76YqaJYsJPVm8inbvOrws2PVib3fpGVjRyDHakJRBL8EHD5LXO0gOkwgz3Tm4eAN%2FSonBub93%2FohhlSRWQFT7offgfH7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 177285
cf-ray: 7c7d3183ee249bf5-FRA

GET
H3 200 home-eec6ea674dcf0eaf7d99.js Show response
login5.demonyins.top/vi-assets/static-assets/ 126 KB
38 KB 1661ms
1661ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/home-eec6ea674dcf0eaf7d99.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75233efd627abe6467968bc77764815e4039bd6f8391196716d8b0e16274df8b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsUixxI06ubQPi5neC8O39XDYiTrVwmut96QQOBerZ6-h04cKvKdZZ30d3VJYUyZFi8pgbwChna4Rd_vDV4hlwDk0a8Ewd0
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-15 15:36:12 UTC
x-served-by: cache-sna10727-LGB
x-timer: S1684172716.562882,VS0,VE1
etag: W/"0a29421703521881f558d8447f92a666"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1684164958533057
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/home-eec6ea674dcf0eaf7d99.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 359
expires: Tue, 14 May 2024 15:36:12 GMT
date: Mon, 15 May 2023 17:45:16 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 15 May 2023 15:35:58 GMT
server: cloudflare
x-goog-hash: crc32c=Ct1gRw==, md5=CilCFwNSGIH1WNhEf5KmZg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EWGKqNqphDXWqFF15HVKHfz8ZJMfbL%2B4ZfTSWHkTKsFcin0ieRtOWa503s649ioFGgjuRqykcfEMxx2o3Lmzqvn71EU2ZCVfzzO7pQE9kDFTbI7tx45jwqIwv%2BjBD76S9BpkjVPImvDs3Za7Owx7riB3%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 129273
cf-ray: 7c7d3189bfb09bf5-FRA

GET
H3 200 main-1ad4ce4767d07fda924f.js Show response
login5.demonyins.top/vi-assets/static-assets/ 1 MB
397 KB 1634ms
1633ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecd6da8a31f4ac7a6e09220679d1ff16e9e808522935a0b26c8d0cfe3dd6d5ea

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycds7Y0JFQ3SYUirErJM8-bSP0FQLnaJIyi8kW1DkeGopdkvKdUX4QLPpER_OjlA-Ufbld2CokzZarSpVbF3VMhq13w
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-15 15:36:05 UTC
x-served-by: cache-sna10731-LGB
x-timer: S1684172716.553801,VS0,VE1
etag: W/"e6a18ada99f396749121cb58a7b0480a"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1684164901170648
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 5
expires: Tue, 14 May 2024 15:36:05 GMT
date: Mon, 15 May 2023 17:45:16 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 15 May 2023 15:35:01 GMT
server: cloudflare
x-goog-hash: crc32c=KPr/9g==, md5=5qGK2pnzlnSRIctYp7BICg==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FoFVaTW1wvLHoDaqOFojN0loPz2Ej5cGt75%2F6QL0nUbVFi%2BsgP3dZI9bAbCeOdWk%2F5Z6Zaswm5ct9%2BlPT8N6A7Y%2Bc%2BDCrf%2F2o5GuS8NY92UrcxW3%2BEcVNAECEasaORcylDrTtlfWAuSea7GsmRIZy4xDFw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 1454644
cf-ray: 7c7d3189dfd09bf5-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 406 KB
110 KB 120ms
63ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8f0b0d6cbfd354da43c3fd1d9d2a25f35dff4b20792d60a13c486a7a0629d685

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112457
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
vary: *
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 193ms
127ms Preflight 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login5.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 0
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:45:14 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 15
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: MISS
x-nyt-meridiem: PM
x-nyt-region: NW
x-samizdat-query-exe-id: 9b3a01632edc4390
x-samizdat-query-field-errors: 0
x-served-by: cache-fra-etou8220030-FRA
x-timer: S1684172715.592707,VS0,VE106

POST
H2 200 track
a.et.nytimes.com/ 0
0 377ms
126ms Ping
text/plain 52.3.42.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.3.42.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-42-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET als
als-svc.nytimes.com/ 0
0

GET
H2 200 grumi-ip.js Show response
rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/ 14 KB
6 KB 105ms
23ms Script
application/javascript 2600:9000:2491:cc00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:cc00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f62c6457ddefdfd96ebc104603ccc8368e73afb6085b7b8018674cf5d3974ebe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:25:35 GMT
x-amz-version-id: ZeZbQXIiZ8B7xRijiw8G.q9OnSDyuFAm
content-encoding: br
last-modified: Mon, 27 Mar 2023 06:19:38 GMT
server: AmazonS3
via: 1.1 93efd892a8e99dc59164afbee331cd56.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
etag: W/"22b4da07003fc88ea067e3f866ea9c5a"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=14400, stale-while-revalidate=14400, immutable
age: 1180
x-amz-cf-id: xWKh4-N7zlWhAqchQlrUQmRlj75xfKF9Oe5ln3kS1oj6AbK425DuDA==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 230 KB
57 KB 80ms
27ms Script
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bf5de2a37e1b850ca9cc3b1a55bccd36def2be3524d0c5acb67b61f26aac8a96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:42:08 GMT
content-encoding: gzip
via: 1.1 633b37c269943f0b3472e0abe1a07b2c.cloudfront.net (CloudFront), 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
last-modified: Wed, 10 May 2023 21:23:06 GMT
server: AmazonS3
x-amz-cf-pop: ZRH55-P1, FRA56-P3
age: 187
x-amz-server-side-encryption: AES256
etag: W/"e6af4658ab1a6fdde1f0066b27d5372e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: wXq4qQZCUGoWbMP1tlG6qHFingFi7tQ6FLJqePt-qfp1p8Sc4EEUaQ==

GET
H2 200 prebid7.43.0b.js Show response
www.nytimes.com/ads/ 248 KB
80 KB 61ms
21ms Script
text/javascript 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nytimes.com/ads/prebid7.43.0b.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5a463100955fc30302bbd7079dcf03e75d66a0b148a56ee0f9578d05cc96a418

Security Headers

Name

Value

Content-Security-Policy

upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;

Strict-Transport-Security

max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: gzip
age: 551792
x-guploader-uploadid: ADPycdsuljV5IlCKdnf4odvcNt93Xu1fmnoEpY7z2jNgQvhvuLSvvIb2HDEZsnAPHmlUBXU5r90JMTGCpUtTEMnKtX_fmQ
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-25 08:28:41 UTC
x-served-by: cache-fra-etou8220070-FRA
x-timer: S1684172715.572884,VS0,VE1
etag: "b1c0bb337eb2ca2772e3f66ea859162e"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1680615397749795
content-type: text/javascript
access-control-allow-origin: *
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/ads/prebid7.43.0b.js
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-nyt-app-webview: 0
x-nyt-route: ads-static-assets
x-nyt-edge-cache: HIT
x-cache-hits: 5499
expires: Tue, 25 Apr 2023 08:28:40 GMT
date: Mon, 15 May 2023 17:45:14 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
content-length: 80465
last-modified: Tue, 04 Apr 2023 13:36:37 GMT
server: UploadServer
x-goog-hash: crc32c=J7VdOQ==, md5=scC7M36yyidy4/ZuqFkWLg==
x-gdpr: 1
x-goog-stored-content-length: 253681
accept-ranges: bytes

GET
DATA 200
OK truncated
/ 148 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73bd4d0f8a3ec1a6b0ec41f111a2b46ba4c242d4dc7bdf0817c4af97a6dfa48e

Request headers

Referer
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 franklin-normal-700.91eaf6b5642463af4091160b4bbfdfcb.woff2
g1.nyt.com/fonts/family/franklin/ 20 KB
20 KB 67ms
20ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-700.91eaf6b5642463af4091160b4bbfdfcb.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

b5221e0636a97505ae38720d4ef182d35be5fb47d2628428db4fc918ab7ee30e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Sat, 21 Oct 2023 06:23:17 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 17839318
x-guploader-uploadid: ADPycduMMv-8etBF_QLtnaI0Y5YNVqBbkrVTdfH9RKMz8tHhvF73vnZXdkMZmGe8IsVibeYizebgUyzDVX5zx-V8xXLjJAX92dbf
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 20276
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 03 May 2022 17:15:51 GMT
server: UploadServer
x-timer: S1684172715.597415,VS0,VE0
etag: "91eaf6b5642463af4091160b4bbfdfcb"
x-goog-generation: 1651598151054057
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=teZvhg==, md5=ker2tWQkY69AkRYLS7/fyw==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 20276
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 18708

GET
H2 200 franklin-normal-500.0f4aea3d462cdb64748629efcbbf36bc.woff2
g1.nyt.com/fonts/family/franklin/ 19 KB
20 KB 67ms
21ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-500.0f4aea3d462cdb64748629efcbbf36bc.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

0b904723c5938b523c9ae329ba2b763681cb1de225c8f202d11012cbfd533f1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Sat, 21 Oct 2023 06:23:14 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 17839319
x-guploader-uploadid: ADPycdsQTVOzJvstvw9XibUb4r2EavGRoaYpno293g3PdRfhg_D53G9hTMPATQ5aSm7lUd2THAv77APBGIg9DF3ycFI57g
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 19816
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 03 May 2022 17:15:51 GMT
server: UploadServer
x-timer: S1684172715.597440,VS0,VE0
etag: "0f4aea3d462cdb64748629efcbbf36bc"
x-goog-generation: 1651598151017654
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=bdL0Mw==, md5=D0rqPUYs22R0hinvy782vA==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 19816
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 18820

GET
H2 200 cheltenham-normal-700.530cfb72378419eedb60da7e266ad5f1.woff2
g1.nyt.com/fonts/family/cheltenham/ 28 KB
28 KB 107ms
60ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-700.530cfb72378419eedb60da7e266ad5f1.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

564385e5dd8a1058fd759445c33b2c554d409528496b9d91533eeb079f6415de

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Sat, 21 Oct 2023 06:23:14 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 17839319
x-guploader-uploadid: ADPycdsd36fGJZTLSQtxa1LwTDIyVyefSgjAqkWjk5eM43gSsqZ00q5udZG8PMr2eVyiHayJkhxqa6WKkMdfawRADHJVb-9gB8jP
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 28276
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 03 May 2022 17:15:49 GMT
server: UploadServer
x-timer: S1684172715.598236,VS0,VE0
etag: "530cfb72378419eedb60da7e266ad5f1"
x-goog-generation: 1651598149856995
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=O9qQIA==, md5=Uwz7cjeEGe7bYNp+JmrV8Q==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 28276
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 10329

GET
H2 200 imperial-normal-400.6131cd77b6e216c7693ed925f4309ffc.woff2
g1.nyt.com/fonts/family/imperial/ 26 KB
26 KB 112ms
66ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/imperial/imperial-normal-400.6131cd77b6e216c7693ed925f4309ffc.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

b32e3879c83af441e675efa49587cb894bdd3c10420475f79879fbfb7a69766b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 25 Jan 2024 00:32:20 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 9565974
x-guploader-uploadid: ADPycdu8EQpQm3V7zdMFkJ8XgnencwVnT2B2YUBtaf-sewkAiBh8gRLsetmgM9V27ohK7R6xXMuURFc3DzPNRarYrc9Kgw
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26504
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172715.598450,VS0,VE0
etag: "6131cd77b6e216c7693ed925f4309ffc"
x-goog-generation: 1673991776736810
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=ZzOuxA==, md5=YTHNd7biFsdpPtkl9DCf/A==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26504
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 18436

GET
H2 200 cheltenham-normal-300.7ea91ebd036309e1fe756ee3aab272da.woff2
g1.nyt.com/fonts/family/cheltenham/ 27 KB
27 KB 112ms
65ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-300.7ea91ebd036309e1fe756ee3aab272da.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e444fdaa833e612d239cf21a335b8322ad8cb7c7ba697ec978bdb454f5059519

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 25 Jan 2024 00:37:40 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 9565655
x-guploader-uploadid: ADPycdt38TCVFQs07sap3a_qPNNQhOB-oNJNkUm_5NonsSEFt4KS8xlMhMrghM6zQ_O5kimI_tkdWYmaGFdi_deDSjYNLGG5VM4c
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 27260
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172715.598406,VS0,VE0
etag: "7ea91ebd036309e1fe756ee3aab272da"
x-goog-generation: 1673991775007595
x-goog-hash: crc32c=rNQ9pA==, md5=fqkevQNjCeH+dW7jqrJy2g==
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 27260
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 2999

GET
H2 200 cheltenham-small-normal-700.1a0b316424cdebd18086b8dbbc768eef.woff2
g1.nyt.com/fonts/family/cheltenham-small/ 23 KB
23 KB 88ms
41ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-small/cheltenham-small-normal-700.1a0b316424cdebd18086b8dbbc768eef.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

9a43ab8056183a8efcf0e882990c2601381a735e02bba004439e010055c55d47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 20 Mar 2024 01:08:13 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 4811821
x-guploader-uploadid: ADPycdv5FLzvZAHLoSkzzAwtki4oKIrljUG2a0tdTaMAqDXtUeMPAEYq4plbBshmD1RTuNVB0Q8e5iZi8i1rn80UdubSJv7o4XQ2
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 23704
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172715.598087,VS0,VE0
etag: "1a0b316424cdebd18086b8dbbc768eef"
x-goog-generation: 1673991775396405
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=FTq84Q==, md5=GgsxZCTN69GAhrjbvHaO7w==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 23704
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 54

GET
H2 200 cheltenham-text-cond-normal-700.7e78f9e7e6c2e02d82592c4466929fa3.woff2
g1.nyt.com/fonts/family/cheltenham-text-cond/ 28 KB
29 KB 87ms
41ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-text-cond/cheltenham-text-cond-normal-700.7e78f9e7e6c2e02d82592c4466929fa3.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1ecb1f9522433be3adfad377816095c7d5b27d02c1efbbbb793e341b829d83d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 24 Apr 2024 03:07:37 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1780657
x-guploader-uploadid: ADPycdsuHnCngxuV92uCr6KfwhXTgp0bNy4NESzb5fDKO57AkWLb6s1nij7tl1k_fl96eXP9E06pV1Pyyvp2xNCCh8ryKQ
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 28868
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172715.598078,VS0,VE0
etag: "7e78f9e7e6c2e02d82592c4466929fa3"
x-goog-generation: 1673991775506403
x-goog-hash: crc32c=UQFt6w==, md5=fnj55+bC4C2CWSxEZpKfow==
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 28868
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 13

GET
H2 200 cheltenham-small-italic-400.cdfa0ec29cca8c2d2f54c79d898e15c1.woff2
g1.nyt.com/fonts/family/cheltenham-small/ 23 KB
24 KB 115ms
69ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham-small/cheltenham-small-italic-400.cdfa0ec29cca8c2d2f54c79d898e15c1.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

7dcbc19c68e87e4b23f85027e02ac7f3c89fa259973ec92bbe27e49ad002bf47

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 01 May 2024 08:32:20 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1156374
x-guploader-uploadid: ADPycdvAlCgOiB-jUhxKme68l7ujmMr995gDVbm1cT5XNnNIt1ZGg9IG8XG-x-qu0KNPpUbVFx-mkPjhuY1Mt8sVJeEy
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 24028
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172715.615743,VS0,VE0
etag: "cdfa0ec29cca8c2d2f54c79d898e15c1"
x-goog-generation: 1673991775386814
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=2JQyuQ==, md5=zfoOwpzKjC0vVMediY4VwQ==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 24028
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 14

GET
H2 200 cheltenham-normal-200.40ccfe2cc61a71e6617e56162d49b896.woff2
g1.nyt.com/fonts/family/cheltenham/ 26 KB
26 KB 87ms
42ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/cheltenham/cheltenham-normal-200.40ccfe2cc61a71e6617e56162d49b896.woff2

Requested by

Host: g1.nyt.com
URL: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

4f837869b80c34ed1a128362a6ed24ff5ebdae743dc55eb3c183ae9c8b5f4ca3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://g1.nyt.com/fonts/css/web-fonts.7705b21d4573b168a8aaebc4ff17d395d2458dca.css
Origin: https://login5.demonyins.top
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 30 Apr 2024 23:46:34 GMT
date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 1187919
x-guploader-uploadid: ADPycdsieML4XuwXFGqb9edZuCzrTUFlXDh-P9aDq6_mj1SAPBD_xFNAu5ycd1rrBhr_13xBo5niJr93aODWEUAWKo5O
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26448
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:55 GMT
server: UploadServer
x-timer: S1684172715.598011,VS0,VE0
etag: "40ccfe2cc61a71e6617e56162d49b896"
x-goog-generation: 1673991775015704
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=kUZRqw==, md5=QMz+LMYaceZhflYWLUm4lg==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26448
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 3074

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 74 KB
25 KB 171ms
109ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/vi-assets/static-assets/adslot-6cfc3a3f6d8b97c7ed5d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f100b686086f9e625644ea31ab265146d21773b86d9daf2baf8483f9205f4929

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25246
x-xss-protection: 0
server: cafe
etag: 357 / 19492 / m202305090101 / config-hash: 6508097778422352816
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 15 May 2023 17:45:14 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 53 B
866 B 86ms
22ms XHR
application/json 37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 17:45:14 GMT
AN-X-Request-Uuid: c5f85851-2f80-4970-802b-e54ab8ba211b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://login5.demonyins.top
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 217.114.218.22; 217.114.218.22; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 53
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 428 B
991 B 137ms
29ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088370&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rf=https%3A%2F%2Flogin5.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login5.demonyins.top&tg_i.page=https%3A%2F%2Flogin5.demonyins.top%2F&tg_i.invCode=nyt_home_top&tg_i.pbadslot=dfp-ad-top&tk_flint=pbjs_lite_v7.43.0&x_source.tid=6bab65f1-fde4-4f5a-a715-c8708855af0c&l_pb_bid_id=8c3174479c681c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.844938277064498
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: fdb3f43256b8f711041c97bc6f871a497bd0e9e75fc54d5c06c124b6974b13db

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login5.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 428
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
763 B 137ms
30ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin5.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login5.demonyins.top&tg_i.page=https%3A%2F%2Flogin5.demonyins.top%2F&tg_i.invCode=nyt_home_mid1&tg_i.pbadslot=dfp-ad-mid1&tk_flint=pbjs_lite_v7.43.0&x_source.tid=526ab0b6-9999-40a2-8517-b266d98cefc5&l_pb_bid_id=9ec30de364b599&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7786846235823766
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 1b21615e48553f20ba4b828d0c9753e058d95a88a91f4bba9e5d180fb01d3f08

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login5.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
763 B 137ms
30ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin5.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login5.demonyins.top&tg_i.page=https%3A%2F%2Flogin5.demonyins.top%2F&tg_i.invCode=nyt_home_mid2&tg_i.pbadslot=dfp-ad-mid2&tk_flint=pbjs_lite_v7.43.0&x_source.tid=cad2fffa-0b90-4477-bcda-f0bee813d93a&l_pb_bid_id=10c2f843dbbf9c7&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8308675045437606
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 189f77dfa715f7e5b84743b9d59479fdf0d7871c02fecf98f0135ee955129c5c

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login5.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 430 B
764 B 138ms
31ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088372&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin5.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login5.demonyins.top&tg_i.page=https%3A%2F%2Flogin5.demonyins.top%2F&tg_i.invCode=nyt_home_mid3&tg_i.pbadslot=dfp-ad-mid3&tk_flint=pbjs_lite_v7.43.0&x_source.tid=fcd0e6f7-1402-430c-9fe4-56f2261abebb&l_pb_bid_id=1117d3ce7236899&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7423808192415404
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f0e14e50e487d8929f2eaf86e7143b01e4d1d36a8f6e82183a76e66eebb9cfc0

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login5.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 430
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 434 B
769 B 138ms
31ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12330&site_id=378266&zone_id=2088374&size_id=2&alt_size_ids=55%2C57&p_pos=btf&rf=https%3A%2F%2Flogin5.demonyins.top%2F&kw=news%2Cliveupdates%2Clatestnews%2Cbreakingnews%2Clocalnews%2Ccurrentevents%2Ctopstories%2Clivestream%2Clivevideo%2Cworldnews%2Cusnews&tg_i.domain=login5.demonyins.top&tg_i.page=https%3A%2F%2Flogin5.demonyins.top%2F&tg_i.invCode=nyt_home_bottom&tg_i.pbadslot=dfp-ad-bottom&tk_flint=pbjs_lite_v7.43.0&x_source.tid=8038d3ba-d21b-4bfb-ad54-2d3997a3a073&l_pb_bid_id=12e4e01a6397fab&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.994963476453965
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 58daca1634c2cbbf89e4da037e059af163cfc23a4170d59ea140baa30ebaf5e6

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://login5.demonyins.top
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 434
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 338 B
606 B 256ms
177ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU4WQK98
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: fd6aaf56b4766934af5c59ba328e2875d69a2dddcea545cb31d2d98d4d77c7dd

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Mon, 15 May 2023 17:45:14 GMT

GET
H2 200 arj Show response
nytimes-d.openx.net/w/1.0/ 73 B
381 B 106ms
41ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://nytimes-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Flogin5.demonyins.top%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=6bab65f1-fde4-4f5a-a715-c8708855af0c%2C526ab0b6-9999-40a2-8517-b266d98cefc5%2Ccad2fffa-0b90-4477-bcda-f0bee813d93a%2Cfcd0e6f7-1402-430c-9fe4-56f2261abebb%2C8038d3ba-d21b-4bfb-ad54-2d3997a3a073&nocache=1684172714669&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250&divids=dfp-ad-top%2Cdfp-ad-mid1%2Cdfp-ad-mid2%2Cdfp-ad-mid3%2Cdfp-ad-bottom&aucs=dfp-ad-top%2Cdfp-ad-mid1%2Cdfp-ad-mid2%2Cdfp-ad-mid3%2Cdfp-ad-bottom&auid=544112060%2C544112063%2C544112063%2C544112063%2C544112062&tps=aW52Y29kZT1ueXRfaG9tZV90b3A%3D%2CaW52Y29kZT1ueXRfaG9tZV9taWQx%2CaW52Y29kZT1ueXRfaG9tZV9taWQy%2CaW52Y29kZT1ueXRfaG9tZV9taWQz%2CaW52Y29kZT1ueXRfaG9tZV9ib3R0b20%3D
Requested by: Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 586215e0b31b301661910b86f13a882b26ca03e23beb98d7f3b3cab1dc1dbb61

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://login5.demonyins.top
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
585 B 102ms
22ms XHR
application/json 3.72.132.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.43.0&referrer=https%3A%2F%2Flogin5.demonyins.top%2F&tmax=10000

Requested by

Host: www.nytimes.com
URL: https://www.nytimes.com/ads/prebid7.43.0b.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.72.132.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-72-132-166.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:14 GMT
accept-ch: sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory
x-auction-status: 3, 3, 3, 3, 3
content-type: application/json; charset=utf-8
access-control-allow-origin: https://login5.demonyins.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
305 B 123ms
122ms XHR
text/plain 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3030&u=https%3A%2F%2Flogin5.demonyins.top
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:14 GMT
via: 1.1 6851af5c4f6d355fa4ec39cc8cc0c358.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-cache: Miss from cloudfront
access-control-allow-origin: https://login5.demonyins.top
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-id: 7fAKm6uQKMz24m9v48wmurfytlnQo3NOe3Nbj1Rh4DRNk2a6MNMdgw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 64 B
508 B 162ms
60ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin5.demonyins.top%2F&pid=WsZ6hFNH7yvSx&cb=0&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-top_hp_web%22%7D%2C%7B%22sd%22%3A%22top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22top_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:14 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: 2GGY92QB4AB4ACF65C6Y
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 64
x-amz-cf-id: LJapwIEz8OwFHeDQhzJdZGJSqbTmE4VSTg5OT0q6xzDvWK6RwUTxtQ==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 449ms
404ms XHR
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:16 GMT
x-amz-version-id: yHpogsakS7iCluwAmUa6Y9ccBYm32d5h
content-encoding: gzip
via: 1.1 29f7132906866b79866659848b3a3b68.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
last-modified: Thu, 11 May 2023 21:16:48 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: 5Z31dv5IRehlsqkfXOBJCxj2YA2AsOx9Xae68Fa32bkwUq7VTA0LHQ==

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/ 368 KB
110 KB 25ms
24ms Script
text/javascript 2600:9000:2491:cc00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi.js
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:cc00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f63504a15a3289297bad1f9a745f4b832949f3156e76b36888defd7948b532eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:25:34 GMT
x-amz-version-id: K_BiY69MkQWIGXQ0IJYllFiclR8cuOtm
content-encoding: br
last-modified: Mon, 15 May 2023 17:06:25 GMT
server: AmazonS3
via: 1.1 93efd892a8e99dc59164afbee331cd56.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
etag: W/"2ef186073651e0fd07f0cae2fa5d9d1f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
age: 1181
x-amz-cf-id: Mmk50C7t-duF2I56f_R2pBe5F78UraBb9inO_g08hbw4KJ2-Q8t07w==

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/ 402 KB
124 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4dc80fcaf6db01fa29ced797dbb0947bb3bb95b1a88f893f389cf17144166075

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:00:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2695
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127184
x-xss-protection: 0
server: cafe
etag: 3263738860219486170
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 14 May 2024 17:00:19 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 42 B
70 B 103ms
57ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=login5.demonyins.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24090f47a163db652b99faa86e9a5832ff11da883120ffdc98b2b573dab974ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
x-xss-protection: 0
expires: Mon, 15 May 2023 17:45:14 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 60ms
60ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin5.demonyins.top%2F&pid=WsZ6hFNH7yvSx&cb=1&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-top%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-top_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:14 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: WXZQGR7YKWWNPS1HETN1
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 6GIlY-XusfITwZoLozk7tsJATpQtKP_AyMp1cdIZWqamo3t28cL4Kw==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 220ms
29ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=login5.demonyins.top

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 222ms
31ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=login5.demonyins.top

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 64 KB
18 KB 214ms
214ms XHR
text/plain 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2147242025988008&correlator=1541308962736087&eid=31072019%2C31074538&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=29390238%2Cnyt%2Chomepage&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C970x90%7C970x250%7C1605x300&fluid=height&ifi=1&adks=2496155832&sfv=1-0-40&prev_scp=div%3Ddfp-ad-top%26pos%3Dtop%26amznbid%3D1%26amznp%3D1%26request_time%3D3090&cust_params=als_test_clientside%3Dempty_empty_empty_20230515174514%26edn%3Dus%26test%3Dprojectvi%26ver%3Dvi%26typ%3Dhp%26prop%3Dnyt%26plat%3Dweb%26abra_dfp%3D%26sov%3D2%26page_view_id%3DwjvFlpZ3Hk5Jo7ys2GahEWZn%26purr%3Dfull%26vp%3Dlarge%26uap%3Dbrowser&sc=1&cookie_enabled=1&abxe=1&dt=1684172714916&lmt=1684172474&dlt=1684172711819&idt=3054&adxs=0&adys=15&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Flogin5.demonyins.top%2F&frm=20&vis=1&psz=1600x0&msz=1600x0&fws=4&ohw=1600&ga_vid=807152879.1684172715&ga_sid=1684172715&ga_hid=1614227928&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

33214b5241d7d2719b36f35a46358a940de5071403c3bd19a8ac7666ae0a388d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18772
x-xss-protection: 0
google-lineitem-id: 6294579579
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432197696
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3F9C 6 KB
3 KB 101ms
29ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login5.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:45:15 GMT
expires: Tue, 14 May 2024 17:45:15 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8A27 6 KB
3 KB 27ms
27ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login5.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:45:15 GMT
expires: Tue, 14 May 2024 17:45:15 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 8A27 7 KB
1 KB 84ms
35ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b3fbd953664215264e3a7fb2c2c68a3826fe96c5801ffe3d79ad431cfb37b78a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 17:14:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 17:45:15 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 8A27 24 KB
7 KB 78ms
20ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 14:52:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 269580
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 11 May 2024 14:52:15 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8A27 7 KB
805 B 90ms
42ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700&lang=de

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

97b9ca613f6d6854860aaf524d0dae463f58162d0e2db845d78713993c2b3370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 15 May 2023 16:53:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 15 May 2023 17:45:15 GMT

GET
H2 200 Baymax-1.2.2.js Show response
static01.nytimes.com/ads/adplatforms/cdn/ Frame 8A27 34 KB
7 KB 43ms
32ms Script
text/javascript 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://static01.nytimes.com/ads/adplatforms/cdn/Baymax-1.2.2.js

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

2cc6cfc6f07bc4cef11c2dee27ca861146085b4aeb618527bef97c9e2a1c54ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 27 Mar 2023 16:45:29 GMT
date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 3585
x-guploader-uploadid: ADPycdtdiymtVdGicu6IXU3d7KB2wYgsFYyl2XDUyIiNcpm1fQt2-rW7us7a7O9HQqIlOqPfod6mfQacSOdHni8H_L2oT1RW0Mv2
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 6236
x-served-by: cache-iad-kjyo7100023-IAD, cache-fra-etou8220070-FRA
last-modified: Mon, 27 Mar 2023 16:44:38 GMT
server: UploadServer
x-timer: S1684172715.243559,VS0,VE0
etag: "6b65754b2f2b9a52ececc373672351d1"
vary: Accept-Encoding
x-goog-generation: 1679935478565176
content-type: text/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=1vjgAg==, md5=a2V1Sy8rmlLs7MNzZyNR0Q==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 34872
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 8133, 15

GET
H2 200 14831738072326492778
tpc.googlesyndication.com/simgad/ Frame 8A27 3 KB
3 KB 79ms
22ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14831738072326492778?

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00cbd77067ec5e17df26c2bab2bb050ab6e0518598826993f80f5c68b67de24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 17:43:19 GMT
x-content-type-options: nosniff
age: 259316
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3039
x-xss-protection: 0
last-modified: Tue, 26 Jul 2022 15:46:46 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 11 May 2024 17:43:19 GMT

GET
H2 200 16186348496096825922
tpc.googlesyndication.com/simgad/ Frame 8A27 9 KB
9 KB 80ms
23ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16186348496096825922?

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b9e7c9899fda37a0b55a539279040246a30e742e4a5a57fbb7617f4eafd4e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 13 May 2023 19:19:43 GMT
x-content-type-options: nosniff
age: 167132
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9297
x-xss-protection: 0
last-modified: Mon, 25 Jul 2022 17:17:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 12 May 2024 19:19:43 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8A27 186 KB
59 KB 121ms
64ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2980e0459d7b74afe625123bccfa2d3034baa08f39f71bd47399594057a661d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59705
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 May 2023 17:45:15 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8A27 0
0 59ms
59ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst8eirg8eeuDpTDiKYSfTaiiKziOqcPlarSdTv_Ic7ZZU4pSKTuXiLYGly310dTFtNKOn9mGEhBAoJ4vxDvQSKV4hf06Mp3VPYwsNbkuIh9ZrXTXWdUp4kUkZ4VW0MJxqII1ivYle5GgkdOGsrPvNgJrDpuoybcWISidUy_DNBh0wAWzOV9HUjoPvio-1db9cgoQFP58v8ET85-KJl_gjSpYZDES_11cjV0-kML7N2V9D-CuvIna7oGwV7P1rP4qD-BSlyruLe2HyjIaP3NC_s4QmTUC_OGGtevpfwf4l0xD7ofzk-b7Zy0Y0zxGdantgTds9gXbKFEvhJzfdkkGh4wUXWQ7ldQ8kd2igALyACN2d0-stbOZsE&sai=AMfl-YR_DSb5cCrOzFMD2WfH3l2ApvO1BtafNEvwaDyAZqBdI94mXBwe0T9TuhAfsOFkXHu-WmBr-DEqXexI_U20fsWekSMwy1wJgYPEPdYpeA7gB9P4Y80izh-UJeOxgtfzTNk0xpYB3oL92hP7zSM&sig=Cg0ArKJSzEz2jls5W5eFEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 17:45:15 GMT

GET
H2 200 audio-on.svg
static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/ Frame 8A27 1 KB
1 KB 25ms
23ms Image
image/svg+xml 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/audio-on.svg

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e44027ee643a87c2b6ee2cbd3e738302be02274940dede3f3aa13d0bd15aae57

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 18 Apr 2023 11:17:59 GMT
date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 541635
x-guploader-uploadid: ADPycdsPEqv5-voVSXrPELecYWU4ol87yvGxTi0a0-zeNnMayKs9Y9nXcRArl3joVsbUL_PhM5HBv08HxJdgD_Ok8inqRw
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 591
x-served-by: cache-iad-kjyo7100023-IAD, cache-fra-etou8220070-FRA
last-modified: Wed, 11 Mar 2020 20:20:42 GMT
server: UploadServer
x-timer: S1684172715.335707,VS0,VE2
etag: "346f9807dd0b6feb5e3b3dcb6313c24b"
vary: Accept-Encoding
x-goog-generation: 1583958042954520
content-type: image/svg+xml
access-control-allow-origin: *
x-goog-hash: crc32c=2lfk7A==, md5=NG+YB90Lb+teOz3LYxPCSw==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 1046
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 9778, 364

GET
H2 200 audio-off.svg
static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/ Frame 8A27 880 B
943 B 21ms
19ms Image
image/svg+xml 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/audio-off.svg

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

19195533133b2d5cf2cc8fc1d489120e453dd814075b3a95a09db6c339c6d1d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 24 Apr 2023 04:58:04 GMT
date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 46031
x-guploader-uploadid: ADPycdsbG3UY0YAIcX0C36-uZnnCxFWUObADl-_276ZFLJ3IL-aRxZNasqca61PnMu-HcdX8aH-gqP-Ab7Sdj6dj6g4DtyVLhR8g
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 520
x-served-by: cache-iad-kiad7000111-IAD, cache-fra-etou8220070-FRA
last-modified: Wed, 11 Mar 2020 20:20:43 GMT
server: UploadServer
x-timer: S1684172715.334560,VS0,VE0
etag: "61f5aa96fb4cd2d84623ea97b5ec005e"
vary: Accept-Encoding
x-goog-generation: 1583958043035944
content-type: image/svg+xml
access-control-allow-origin: *
x-goog-hash: crc32c=sSTh/w==, md5=YfWqlvtM0thGI+qXtewAXg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 880
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 8405, 436

GET
H2 200 pause.svg
static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/ Frame 8A27 702 B
856 B 22ms
20ms Image
image/svg+xml 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/pause.svg

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

c9fb083529541e219ad17a00cb201b3dba9dabcdcc01eae4eb9ac04b8cb72216

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 11 Apr 2023 09:27:58 GMT
date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 548235
x-guploader-uploadid: ADPycdslycHmK-Q5LXHGLtJG7hs3kRGRu1vUsvy9AW6dMZDy59SbW-QBHtnxn7pytkYC2V2pSVqaRY5M3VnoRj-6ZRlXfw
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 435
x-served-by: cache-iad-kjyo7100021-IAD, cache-fra-etou8220070-FRA
last-modified: Wed, 11 Mar 2020 20:20:42 GMT
server: UploadServer
x-timer: S1684172715.335458,VS0,VE0
etag: "67652da3a119c795c417355d9e1ac31a"
vary: Accept-Encoding
x-goog-generation: 1583958042997649
content-type: image/svg+xml
access-control-allow-origin: *
x-goog-hash: crc32c=GdvCsQ==, md5=Z2Uto6EZx5XEFzVdnhrDGg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 702
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 19862, 399

GET
H2 200 play.svg
static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/ Frame 8A27 681 B
943 B 22ms
20ms Image
image/svg+xml 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nytimes.com/ads/adplatforms/user-interface-elements/video-icons/play.svg

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8658fc44ca45cf40ee56d54bccb269e8cbca4ad85f1ea1bfbbc5faf127a7dec3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 14 Mar 2023 09:48:42 GMT
date: Mon, 15 May 2023 17:45:15 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 546991
x-guploader-uploadid: ADPycdsGMNtuXmQl2AOg3iJqXzX2hCY-cBYwKm6quptazfHa3qjuypYsADGN1239BYPxDMal2So2Mt0mmV8LPXl0K3y_agq02AHZ
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 440
x-served-by: cache-iad-kjyo7100077-IAD, cache-fra-etou8220070-FRA
last-modified: Wed, 11 Mar 2020 20:20:43 GMT
server: UploadServer
x-timer: S1684172715.335380,VS0,VE0
etag: "ac79f9cf6aa8bd6f20fc5bc3a629e040"
vary: Accept-Encoding
x-goog-generation: 1583958043497355
content-type: image/svg+xml
access-control-allow-origin: *
x-goog-hash: crc32c=9xm5Gw==, md5=rHn5z2qovW8g/FvDpingQA==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 681
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 19186, 420

GET
H2 404 ads
12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8A27 2 KB
2 KB 63ms
61ms Image
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/ads

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4591eed27abff378652a507923552094808684c88965a1f19a163b684b6616e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:15 GMT
x-content-type-options: nosniff
server: sffe
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1586
x-xss-protection: 0

GET
H2 200 franklin-normal-500.woff
g1.nyt.com/fonts/family/franklin/ Frame 8A27 26 KB
26 KB 22ms
22ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-500.woff

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

88011d782fa21da0ec301e49080fa9950973db277a33674d252f0fe1e333f61f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
Origin: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Tue, 07 May 2024 23:54:31 GMT
date: Mon, 15 May 2023 17:45:15 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 582644
x-guploader-uploadid: ADPycduSi5EpduZPXBK0UCikDm4M9B_rTDvaYx-wqeIBiG-aeT4jfO7F7R8N2lgbVDbRW_X0ZDpRzP5wpdQtHCVFlKrTBQtPfCj2
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 26600
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172715.335478,VS0,VE0
etag: "cb85480c30b6ca5f53f673993211036f"
x-goog-generation: 1673991776240638
content-type: application/octet-stream
access-control-allow-origin: *
x-goog-hash: crc32c=kksIKQ==, md5=y4VIDDC2yl9T9nOZMhEDbw==
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 26600
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 9

GET
H2 200 franklin-normal-800.woff
g1.nyt.com/fonts/family/franklin/ Frame 8A27 31 KB
31 KB 23ms
22ms Font
application/octet-stream 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://g1.nyt.com/fonts/family/franklin/franklin-normal-800.woff

Requested by

Host: 12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

7bf092f4cf7d479f28b7f4bc8e22d1a5bb6086945bca468c2d714c7d1328433f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
Origin: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 08 May 2024 06:42:55 GMT
date: Mon, 15 May 2023 17:45:15 GMT
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 558140
x-guploader-uploadid: ADPycduQKlRTwJUYBUkWhw-CvutTpHv4D3N964Mu8cjJedU5fByvtwZVoZ8cx1uR3Vn1ECBWQQUBmakdvI_jBo_gcLEUB7NZCuPN
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 31384
x-served-by: cache-fra-etou8220062-FRA
last-modified: Tue, 17 Jan 2023 21:42:56 GMT
server: UploadServer
x-timer: S1684172715.335828,VS0,VE0
etag: "932fec957ef6d36632bd5494d05ad13b"
x-goog-generation: 1673991776286678
x-goog-hash: crc32c=yaFDcQ==, md5=ky/slX7202YyvVSU0FrROw==
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=31536000,immutable
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 31384
accept-ranges: bytes
x-nyt-pagetype: web-font
timing-allow-origin: *
x-cache-hits: 7

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 8A27 13 KB
13 KB 70ms
21ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 17:12:56 GMT
x-content-type-options: nosniff
age: 347539
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 May 2024 17:12:56 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8A27 0
0 59ms
59ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsug4Gmy4UzbHRRn6ivgCENXCGtA07PX1hpgaYqojl1y1L-BQVPN-z_7qsVptXPkYXrn3v7Ep6yP6b9aaMgKKcUnrqSqmQDa9iiz2k3qWjFDujgoDohINqJhstashitIbC0BmigrMDEybwGRwJV05_-FwW1us-_sYFoLOjbBeDXbvciDBHJFZJ_KKPYkRR_TaslDOEPyHTcAsVtxNx3RudeyulcyUoOYDo6-AtjD0o0SFoTeATWW64ON011xB6fZxTsuMih_WnY0Uyd8ffpUs6XFkr3WY3viXlhaYxC9sKcMiUIP7V_cob64vJutJLtZ-AXPeqRsY4UUJfPtCp-3&sai=AMfl-YTiB-iYcqQxM-KSn1dRZ22d80y1NekLBR-hKd8KokOKh75Kay4v_ULzDJfWEjf9c4OBROyccWG1H769auP3RPxsYUcggm_uDC9WqKFyAVtVLwwYt4DblVkB6y5HH1TdoSHVlQuNwnV0MYQYQkI&sig=Cg0ArKJSzOmzEnWNLlQaEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 15 May 2023 17:45:15 GMT

GET
DATA 200
OK truncated
/ Frame 8A27 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1fa38bb7b6bfe71815c4560e649bc7e60d1d93e7d161cc94f6f8bffe16910de7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 206 101683_1_MKTG_Games_SpellingBeev2_2022_wg_360p.mp4
vp.nyt.com/video/2022/07/25/ Frame 8A27 2 MB
2 MB 38ms
22ms Media
video/mp4 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://vp.nyt.com/video/2022/07/25/101683_1_MKTG_Games_SpellingBeev2_2022_wg_360p.mp4

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e2afe2918359382ef85085d45f10bf0c29c86765bb2877dcc066e091b605d31e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Range: bytes=0-

Response headers

expires: Thu, 16 Mar 2023 09:21:04 GMT
date: Mon, 15 May 2023 17:45:15 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 67458
x-guploader-uploadid: ADPycdtMI3QYTWHbb5CPW_cUEmxPkLa3Y6cGd9tffXozikpq_4ZIPwNFVySw6ZtAhNasKF2hCUJ-XE_Ytgx5u_L1yPs62Q
x-cache: HIT, HIT
x-goog-storage-class: REGIONAL
Content-Range: bytes 0-1635823/1635824
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Content-Length: 1635824
x-served-by: cache-chi-kigq8000049-CHI, cache-fra-etou8220070-FRA
last-modified: Mon, 25 Jul 2022 16:38:24 GMT
server: UploadServer
x-timer: S1684172715.457387,VS0,VE2
etag: "dd7047f9d93a5d81bdc3cf317a5ba158"
x-goog-generation: 1658767104677021
content-type: video/mp4
access-control-allow-origin: *
x-goog-hash: crc32c=6Nm8Tg==, md5=3XBH+dk6XYG9w88xeluhWA==
cache-control: max-age=60, s-maxage=86400, stale-if-error=86400
access-control-allow-methods: GET, HEAD, OPTIONS
x-goog-stored-content-length: 1635824
accept-ranges: bytes
x-cache-hits: 0, 0

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8A27 42 B
404 B 174ms
125ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstvZUj0f8xaxOQB0g6pRHG6DLyorBw8uHmzjMLmJTjvGJrgtqj_VK1CRju7BB2LqLZPiT40WQg3coK2QLyLG48rqhRo40SYfZGuh6ha-cQB6dHysOjf&sig=Cg0ArKJSzAXNwuD6ncTUEAE&id=lidar2&mcvt=1000&p=31,0,301,1600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230510&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=7&adk=2496155832&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1684172715168&rpt=239&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js Show response
login5.demonyins.top/vi-assets/static-assets/ 45 KB
16 KB 574ms
573ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bf215be986357511cfca58e796434dbf348ee60f21d785a5ec54a1b2bf86aad

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdtCV-PKxiVphIO8DI9lDxPjrmytMOvu0OpHui-fUvU1cE8oD-DWNyyDkJTv4XVb6Q_kxW-HjCfklDLSlYsLKtMDVL8zWA3f
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-25 13:31:49 UTC
x-served-by: cache-sna10741-LGB
x-timer: S1684172718.866142,VS0,VE1
etag: W/"43c291b8f09c16e8d0f62d9520c31af0"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1682344117620870
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~audio~bestsellers~byline~capsule~collections~explainer~home~liveAsset~markets~paidpost~revie~edbcf66a-f8d17d18d5bf81a0c15b.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 14633
expires: Wed, 24 Apr 2024 13:31:49 GMT
date: Mon, 15 May 2023 17:45:17 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 24 Apr 2023 13:48:37 GMT
server: cloudflare
x-goog-hash: crc32c=TXHOfA==, md5=Q8KRuPCcFujQ9i2VIMMa8A==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=piiYPvfnE1YEihVp7uJFGGQ%2FxsSLxaCmbTmsolvXW4LWCNKc3wO1OlBRlt0mbAIgY%2BSBOh1S7bZ3HlzcXAv4cE0qzokLE50g9PMftpvA%2BoTkiQvgFxRYP4jTGLz8kimI4WqSHHjaF1rPQQ0U60UrNKz2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 46523
cf-ray: 7c7d319bdd929bf5-FRA

GET
H3 200 vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js Show response
login5.demonyins.top/vi-assets/static-assets/ 21 KB
6 KB 519ms
519ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdbc97a6eafca5758332d9df4182243e2cace6a3960898b1b603652c689a88da

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdsU-Y6dF4iuOdlbDzMiTUlyTvwtD2glVJVJ-H-l6sC7wVdNKyfgeH_EumbkZ9dbPhat7g224JVSJsLi4nMdDxTCnQ
x-goog-stored-content-encoding: identity
x-origin-time: 2023-04-19 16:29:35 UTC
x-served-by: cache-sna10746-LGB
x-timer: S1684172718.837942,VS0,VE1
etag: W/"1e07834fc5f5299ca69c83a2dfb0dded"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1681921580764142
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~audio~card~clientSideCapsule~home~paidpost~trending~video-c5c67010b5c1436d0743.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 20899
expires: Thu, 18 Apr 2024 16:29:35 GMT
date: Mon, 15 May 2023 17:45:17 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 19 Apr 2023 16:26:20 GMT
server: cloudflare
x-goog-hash: crc32c=blhS2g==, md5=HgeDT8X1KZymnIOi37Dd7Q==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1aBK72VZ83S4ZypBmVxnd3sM9G4lqvbLtESg16zVuSyAOK4Re7owD%2BFKM9l0xCOvy427a9oCQtfdcalP9gjnamApAfnh%2Bx4i0lXEtLLZ12uHk%2BuRlX%2BRCGqHptUcg8MfMqUcwlVRDMgOXuJuz7QMyHDcHw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 21721
cf-ray: 7c7d319bdd949bf5-FRA

GET
H3 200 vendors~home-7fa14ae6eded78270c01.js Show response
login5.demonyins.top/vi-assets/static-assets/ 535 KB
112 KB 715ms
715ms Script
application/javascript 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/vi-assets/static-assets/vendors~home-7fa14ae6eded78270c01.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

766e2c94d35a881dfa209017c895c44c47b20b6aa215f27f2f455a83d1a7304f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
x-guploader-uploadid: ADPycdvb3dt1AVtdeD8gjhBg0Qs9kq1uTWStqC5xgH3CQuxECnyWgFMwW0yv_oSUCnbFY-597CnnmqWPGQL5Dt9y2J6mptiL2ZIZ
x-goog-stored-content-encoding: identity
x-origin-time: 2023-05-11 14:43:50 UTC
x-served-by: cache-sna10725-LGB
x-timer: S1684172718.848423,VS0,VE1
etag: W/"d80eeecdbf266544f4fa8d236f58eb6f"
vary: Accept-Encoding, Fastly-SSL
x-goog-generation: 1683816008978436
content-type: application/javascript
x-frame-options: DENY
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/vi-assets/static-assets/vendors~home-7fa14ae6eded78270c01.js
cache-control: public,max-age=31536000
x-nyt-app-webview: 0
x-nyt-route: vi-assets
x-nyt-edge-cache: HIT
x-cache-hits: 5597
expires: Fri, 10 May 2024 14:43:50 GMT
date: Mon, 15 May 2023 17:45:18 GMT
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-X
x-cache: HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 11 May 2023 14:40:09 GMT
server: cloudflare
x-goog-hash: crc32c=FKch7g==, md5=2A7uzb8mZUT0+o0jb1jrbw==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J95riTlxmcDUbmEdH%2BUMeIE8jpHoaXSMAuV%2BdlrCW4bglybqg3r5%2F6o%2FAT6mtmCOEz3XFp1HRUuH932x5UIKZcvwFODmLzPsQ7gWWBjlKJncMEWZ%2FaA0P5j1p8Hw0siTie4YKqWTZDbCkPqRseDvTdwbrw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-gdpr: 0
x-goog-stored-content-length: 548235
cf-ray: 7c7d319bdd959bf5-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 122 KB
43 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N5P6T9S&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bd84db71c97403c42571bbf6e660bddb32d474e3aedad023b0d9d006669c9086

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44187
x-xss-protection: 0
last-modified: Mon, 15 May 2023 17:16:56 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 15 May 2023 17:45:17 GMT

GET
H2 200 tags.js Show response
dd.nytimes.com/ 266 KB
55 KB 173ms
25ms Script
text/javascript 143.204.215.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.nytimes.com/tags.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-54.fra53.r.cloudfront.net

Software

Apache /

Resource Hash

078b159fb8403c40be85c805a1ee088fec7f3e2ad5db26ac94d22ddfd00c50cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
via: 1.1 598a1f878f2efc16baaf47787ffe82d2.cloudfront.net (CloudFront), 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
date: Mon, 15 May 2023 17:25:41 GMT
x-amz-cf-pop: FRA60-P2, FRA53-C1
age: 1176
x-cache: Hit from cloudfront
content-length: 55493
last-modified: Fri, 05 May 2023 08:25:33 GMT
server: Apache
etag: "42845-5faee086486b0-gzip"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3600, public
accept-ranges: bytes
x-amz-cf-id: q30tX3nmQvY2W0OGsgjLz0eBsal8veNpzxM73sK44OnMS-fACOKwjQ==
expires: Mon, 15 May 2023 18:25:41 GMT

GET
H2 204 b
sb.scorecardresearch.com/ 0
226 B 79ms
22ms Image
text/plain 13.32.121.72
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=2&c2=3005403&ns__t=1684172717471&ns_c=UTF-8&c8=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&c7=https%3A%2F%2Flogin5.demonyins.top%2F&c9=
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-72.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:17 GMT
via: 1.1 9ef1b108656dc6d0707b168b862883dc.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P1
x-amz-cf-id: you19zNzK9_pUHQ-d5oUhizTtRRuzW_3JQ-kM0OTWhhXtyGqJeYdjQ==
x-cache: Miss from cloudfront

POST
H2 200 track
a.et.nytimes.com/ 0
0 127ms
126ms Ping
text/plain 52.3.42.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.3.42.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-42-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 / Show response
dd.nytimes.com/js/ 240 B
627 B 76ms
28ms XHR
application/json 143.204.215.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dd.nytimes.com/js/

Requested by

Host: dd.nytimes.com
URL: https://dd.nytimes.com/tags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-54.fra53.r.cloudfront.net

Software

DataDome /

Resource Hash

2739fb249dc30ac68b3dca4d603f4f4c60733afc5ad5dd16186152ecf77f664e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:17 GMT
via: 1.1 f2db75b601dc30df73b1beb29596a374.cloudfront.net (CloudFront)
strict-transport-security: max-age=63072000; includeSubDomains; preload
server: DataDome
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 240
x-amz-cf-id: Kq3946K5UbROrKCULM9GzSCbNcPvhBWJNHya4xsUiGCJHchIys0-Sw==
expires: 0

GET
H2 200 pd
u.openx.net/w/1.0/ 43 B
131 B 42ms
35ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:17 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK cksync.php
cs.media.net/ 60 B
426 B 101ms
33ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync.php?cs=8
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-228-23.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 15 May 2023 17:45:18 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 60
x-mnet-hl2: E
Expires: Mon, 15 May 2023 17:45:18 GMT

GET
H2 200 sync
eb2.3lift.com/ 37 B
140 B 82ms
22ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/sync?px=1&src=prebid&
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 21ms
21ms Preflight 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login5.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 4
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:45:18 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: HIT
x-cache-hits: 1
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 15
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: HIT
x-nyt-meridiem: PM
x-nyt-region: NW
x-samizdat-query-exe-id: 9402d431cd138a1d
x-samizdat-query-field-errors: 0
x-served-by: cache-fra-etou8220030-FRA
x-timer: S1684172719.663382,VS0,VE1

OPTIONS
H2 200 v2
samizdat-graphql.nytimes.com/graphql/ Frame 0
0 22ms
22ms Preflight 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://samizdat-graphql.nytimes.com/graphql/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
Access-Control-Request-Method: POST
Origin: https://login5.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: content-type,nyt-app-type,nyt-app-version,nyt-token,x-nyt-news-tenure,x-nyt-programming-abtest
access-control-allow-methods: GET,POST
access-control-expose-headers: x-nyt-audience-target-flat,x-nyt-continent,x-nyt-country,x-nyt-region,x-nyt-meridiem,x-nyt-gmt-offset
access-control-max-age: 300
age: 4
content-encoding: gzip
content-length: 20
date: Mon, 15 May 2023 17:45:18 GMT
server: envoy
strict-transport-security: max-age=63072000; preload; includeSubdomains
timing-allow-origin: *
vary: Origin, Access-Control-Request-Headers, Accept-Encoding, Access-Control-Request-Method
via: 1.1 google, 1.1 varnish
x-cache: HIT
x-cache-hits: 2
x-envoy-decorator-operation: graphql-v1.samizdat.nyti.nyt.net:443/*
x-envoy-upstream-service-time: 15
x-nyt-audience-target-flat: EU:PM
x-nyt-continent: EU
x-nyt-country: DE
x-nyt-edge-cache: HIT
x-nyt-meridiem: PM
x-nyt-region: NW
x-samizdat-query-exe-id: 8e2ad964feb9f479
x-samizdat-query-field-errors: 0
x-served-by: cache-fra-etou8220030-FRA
x-timer: S1684172719.920392,VS0,VE1

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET
H3 200 market Show response
login5.demonyins.top/api/ 517 B
1 KB 3289ms
3288ms XHR
application/json 2606:4700:3031::ac43:d8c7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://login5.demonyins.top/api/market

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/vi-assets/static-assets/main-1ad4ce4767d07fda924f.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:d8c7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3349461a6457af7c8fbee55ed16d18fa9e394123d01ed838c78b3841ff2f6885

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:22 GMT
content-security-policy: upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
content-encoding: br
strict-transport-security: max-age=63072000; preload; includeSubdomains
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-api-version: F-F-X
age: 53
x-cache: HIT, HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-origin-time: 2023-05-15 17:44:29 UTC
x-served-by: cache-lga21927-LGA, cache-sna10721-LGB
server: cloudflare
x-timer: S1684172722.929471,VS0,VE1
vary: Accept-Encoding, Fastly-SSL
x-frame-options: DENY
content-type: application/json; charset=utf-8
access-control-allow-origin: *
onion-location: https://www.nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/api/market
x-cloud-trace-context: d3e9806ed880cea46f12f3b60205e8c3/12146269097514670884;o=1
cache-control: s-maxage=60,(null)
x-nyt-route: market
x-nyt-app-webview: 0
x-gdpr: 0
x-nyt-edge-cache: HIT-HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7qyC9v6ieee6wVfZAoU%2BiEWvUWkEMkAfWHfG1b%2Bt2b2VXEA%2FhR0rGEU%2F6RmViySc7sqpfvu1z6uBwvgvyuKLWerAceO1I12Cc3naqO6qBq85BJC8GhMscsRBGj%2Bk5o26OD3gEskFW6XAjm39YGeEpsXpog%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 7c7d31a48ace9bf5-FRA
x-cache-hits: 18, 2

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
466 B 64ms
64ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin5.demonyins.top%2F&pid=WsZ6hFNH7yvSx&cb=2&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid1%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid1_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:18 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: V5NDWKNGRDHPK0R5SYQ6
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: n2ymjd8hOpUbUqXJD7duKdlGDnjDlNWj1SM7zgsvVYK06fyw_Qj5CQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 62ms
62ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin5.demonyins.top%2F&pid=WsZ6hFNH7yvSx&cb=3&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid2%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid2_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:18 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: J9K9Z2087DQME9G1QMPC
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: uqbochheQR3yNlVhB9_X_6Ut7vEWEacgwO3CT5K9w0O77eUY5qNJhw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 56ms
56ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin5.demonyins.top%2F&pid=WsZ6hFNH7yvSx&cb=4&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-mid3%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-mid3_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:18 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: 974P90Y0YCCBPQVSJKFE
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 7eKHHR7Ft9lKzh1ScNijIxva3alpjGiHgI8XngLC-ohFYPd82XEQrQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 61ms
61ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=3030&u=https%3A%2F%2Flogin5.demonyins.top%2F&pid=WsZ6hFNH7yvSx&cb=5&ws=1600x1200&v=23.505.1627&t=2000&slots=%5B%7B%22sd%22%3A%22dfp-ad-bottom%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22dfp-ad-bottom_hp_web%22%7D%5D&pj=%7B%22si_section%22%3A%22home%22%7D&sg=%7B%22ortb2%22%3A%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22browsers%22%3A%5B%5D%7D%7D%7D%7D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

111041158b9290ae7cc0c6da69d7c4f5600e8a73b4c7399d675df7f15ba7b063

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:18 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: H9G68FTRGMSQ6FVS30KH
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://login5.demonyins.top
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: A0Kkv3nikaAfqWQTDGRQHaopulbEPk_xBUmfcgbOJ0MY3e6lk8phUw==

GET purr-cache
purr.nytimes.com/v1/ 0
0

GET data-layer
a.nytimes.com/svc/nyt/ 0
0

POST v2
samizdat-graphql.nytimes.com/graphql/ 0
0

GET meter.js
meter-svc.nytimes.com/ 0
0

GET
H2 200 15turkey-analysis-mfqh-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15turkey-analysis-mfqh/ 42 KB
43 KB 21ms
18ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15turkey-analysis-mfqh/15turkey-analysis-mfqh-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

ea4d15a211ff965dccd52c1b45fba79f7137802c5c9eaedb8922ac39f43084b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:50:48 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 3271
x-guploader-uploadid: ADPycdt7tECLWNzUgQmhm7aJiAazNCgpAzASUrldbO7xItpk9zJG1d6Sd_sYdTKVpvhQzZLdk_qZT9wdS3zuJM0M1FH9m96TgkTK
x-cache: HIT, HIT
fastly-io-info: ifsz=84718 idim=600x400 ifmt=jpeg ofsz=43296 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 43296
x-served-by: cache-iad-kjyo7100050-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.191154,VS0,VE0
etag: "mFlQssjSaYGsDP6scpTKnUwwQj9tGr0hMknU2SVmwaQ"
vary: Accept
x-goog-generation: 1684168944776482
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=AVmsLw==, md5=wv06VVVo5l+mm2wQ3uuI+w==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 84718
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 23, 5

GET
H2 200 15ukraine-briefing-britain-hp-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15ukraine-briefing-britain-hp/ 52 KB
52 KB 23ms
19ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15ukraine-briefing-britain-hp/15ukraine-briefing-britain-hp-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a99a576eb367116330b5928f8aaf72581d35a07ac5d47a2cb60034eef61c3502

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:15:35 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30584
x-guploader-uploadid: ADPycdvOJo6J6Kg_uMjDSIklBuvK9ggwejxNEIcbg0RV7W80HRf3n_8ZEs_DzPHlSQtAc2mQFKg6UBpS6kxTt-O-iY3lRuWCgMte
x-cache: HIT, HIT
fastly-io-info: ifsz=81973 idim=600x400 ifmt=jpeg ofsz=53086 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 53086
x-served-by: cache-iad-kcgs7200048-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.192965,VS0,VE0
etag: "mjex0YFIaGMauq6Z27qq2hoxCwoLi6eRCHGqkYUC7N8"
vary: Accept
x-goog-generation: 1684141861821066
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=UoW/hQ==, md5=iuJG/usWsGY3yiQD7UipfA==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 81973
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 4

GET
H2 200 15sci-dna-ethics-A-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/ 68 KB
69 KB 24ms
21ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/16/science/15sci-dna-ethics-A/15sci-dna-ethics-A-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d9044bdd43082d9979c3f3b3fa873058af8bb15424484cc98cb1761c5012855e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 15:02:16 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 9783
x-guploader-uploadid: ADPycdsPgjMPw4l2gHOyIJp0hSvt1dtbrswC2WcTTqSEnSJXOBD44XL71UxQBd_8goBdqjwK-B6h-rgRuYCGA5FZ8kpbq7_I7Vxp
x-cache: HIT, HIT
fastly-io-info: ifsz=123269 idim=600x400 ifmt=jpeg ofsz=69756 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 69756
x-served-by: cache-iad-kcgs7200057-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.193625,VS0,VE0
etag: "pH2zxBFpvsIXrmS4qyQIN87EPO0lqzsbeOrH5wcVRSw"
vary: Accept
x-goog-generation: 1684162829216873
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=tNUH8g==, md5=zsrygEMi2fUGaOk0j76Tyw==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 123269
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 43, 3

GET
H2 200 07DEI-BELONGING-02-sub-qktb-threeByTwoSmallAt2X-v2.jpg
static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/ 19 KB
19 KB 24ms
21ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/14/multimedia/07DEI-BELONGING-02-sub-qktb/07DEI-BELONGING-02-sub-qktb-threeByTwoSmallAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8d3c17714229b3f3ea111cde31221a1be9ec66e102343645193ee596102e9a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 10:54:22 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 24656
x-guploader-uploadid: ADPycdvmDL8ZgCsRvIz_Ar8ksTCbZoSyfAI6BfUrnPRbOalF0rWge_fSoyUxn-sex58YMaUWRJeKmVImM_w78evSHPYjJzzTfUfm
x-cache: HIT, HIT
fastly-io-info: ifsz=56087 idim=600x400 ifmt=jpeg ofsz=19066 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 19066
x-served-by: cache-iad-kjyo7100114-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.193676,VS0,VE0
etag: "KBtlA1V4WjHTNE5V50RLyY/u24LSmj+pPL5CLJTI+cI"
vary: Accept
x-goog-generation: 1684148059156533
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=2KTzAw==, md5=us+yx5g7w4NAonxxJSGi3Q==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 56087
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 4

GET
H2 200 00nat-nc-abortion-showdown-01-wtcq-threeByTwoSmallAt2X-v2.jpg
static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/ 29 KB
29 KB 26ms
23ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/13/multimedia/00nat-nc-abortion-showdown-01-wtcq/00nat-nc-abortion-showdown-01-wtcq-threeByTwoSmallAt2X-v2.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a363038e6f698ddb820a9011456e78e51f077fa178bd3c9392f18f9c7d94312f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 10:04:53 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 27626
x-guploader-uploadid: ADPycdtYIsWQJossjbhj4NE9a7V60nF5ZGVKOxUOLgPwuHwxvH4NtIWgiU9TtfIc046nakfEovrSMU6IYcZsdFp7WkfIliD-DEfk
x-cache: HIT, HIT
fastly-io-info: ifsz=71618 idim=600x400 ifmt=jpeg ofsz=29698 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 29698
x-served-by: cache-iad-kjyo7100022-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.195165,VS0,VE0
etag: "FDp0NuTD9QQyweOM80tqrF1pjtB1wa8AuYDWlC3Rb2E"
vary: Accept
x-goog-generation: 1684145091884843
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=Tesl+Q==, md5=658p2WygCMQ2Wh3b4dNgQQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 71618
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 29, 3

GET
H2 200 00ny-collapse46-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/ 35 KB
35 KB 25ms
22ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/nyregion/00ny-collapse46-newpromo/00ny-collapse46-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

e6365a9cb7358ac9859c94ef03b78b5a4326c485488d3d65e41bfc914ff48495

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:18:02 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30437
x-guploader-uploadid: ADPycdv-RjySkmz9WN3ne-kS8XkSmDpu2M6UEqxVZ_hJxTqgYl13bNrG7lzDqe5PHmrEAGdVI4IqhxJd8IDRqRC8IHkoCgh-wApL
x-cache: HIT, HIT
fastly-io-info: ifsz=72756 idim=600x400 ifmt=jpeg ofsz=35602 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 35602
x-served-by: cache-iad-kcgs7200126-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.195036,VS0,VE0
etag: "EBg/5enaCAm22vhecGWWQjzDtdp98AwlyJ4FV5HmEW4"
vary: Accept
x-goog-generation: 1684001402069039
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=oNOYjw==, md5=IXx5X5yvxYHyirVzj6vr4g==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 72756
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 3

GET
H2 200 00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg
static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/ 65 KB
66 KB 23ms
20ms Image
image/jpeg 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/12/business/00eu-microsoft-1/00eu-microsoft-1-threeByTwoSmallAt2X-v3.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

173bfe854ae5d662b3183aff18eb7732eb38d2033d6645555cfa193cf09c558e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 16:08:01 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 5838
x-guploader-uploadid: ADPycduBfbTdVYXd6ddT6eiTJ_AVwsZNHY4v0irQzoriYOQehL066LQ6kZ5fnvAkH9hv9Gfp1dd_lHyQ1jIN2LbePPEs0IPcBaxO
x-cache: MISS, HIT
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-length: 66716
x-served-by: cache-iad-kcgs7200049-IAD, cache-fra-etou8220070-FRA
last-modified: Mon, 15 May 2023 16:07:38 GMT
server: UploadServer
x-timer: S1684172719.216523,VS0,VE0
etag: "a68953e9f5a95550f641efdcb12f727e"
vary: Accept
x-goog-generation: 1684166858419715
content-type: image/jpeg
access-control-allow-origin: *
x-goog-hash: crc32c=0DccLQ==, md5=polT6fWpVVD2Qe/csS9yfg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 66716
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 4

GET
H2 200 15ruck2-zqvw-threeByTwoSmallAt2X.jpg
static01.nyt.com/images/2023/05/15/multimedia/15ruck2-zqvw/ 10 KB
10 KB 23ms
20ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15ruck2-zqvw/15ruck2-zqvw-threeByTwoSmallAt2X.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

d60b320665b3e96d51b567aa07b4f548ada837085bf31ada92cd951901225fe3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:18:32 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 30407
x-guploader-uploadid: ADPycdtT4oOtzqWtr1DYT7-hNJKPs3x3iguLUcEQO5FC0gS6QU9KAtqJpXpn6qzviAlIE8j5WHcOB4e3oJaUFry2X2P3gSDlY2dt
x-cache: HIT, HIT
fastly-io-info: ifsz=32537 idim=600x400 ifmt=jpeg ofsz=10262 odim=600x400 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 10262
x-served-by: cache-iad-kjyo7100030-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.216632,VS0,VE0
etag: "Nn9Fc+ga/54Cj2NJuIvHNU20MVEJoa6AvLbZOlLaocY"
vary: Accept
x-goog-generation: 1684141210191243
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=mMH/JA==, md5=xqnKhT2J+OYca+8khFn2Tg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 32537
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 32, 3

GET
H2 200 15gopnik-lead-square320.jpg
static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/ 6 KB
6 KB 22ms
21ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/opinion/15gopnik-lead/15gopnik-lead-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

ca532afa1a5a67ac9b9f209165c21b1bc6f24945cafbb85418c082bf32605e07

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 09:57:31 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 28069
x-guploader-uploadid: ADPycdt2bG3FXkzTWJAn1XUiCBR_hN6GrQXtPWZ1FVZEb1VXdMSMJitck006nQNw0EPt3LD2QVJZflcARRU9w1UaFXBOPw
x-cache: HIT, HIT
fastly-io-info: ifsz=20438 idim=320x320 ifmt=jpeg ofsz=5768 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 5768
x-served-by: cache-iad-kiad7000097-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.217291,VS0,VE0
etag: "+qddYcOpcEVbO/bCVPeXQafiajdnP1HWulXjJZSPyzI"
vary: Accept
x-goog-generation: 1684141211789042
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=/ljFcg==, md5=omJtgaEA0CKsZnwPOxCsMw==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 20438
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 7, 137

GET
H2 200 margaret-renkl-new-thumbLarge.png
static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/ 22 KB
23 KB 24ms
23ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/04/12/opinion/margaret-renkl-new/margaret-renkl-new-thumbLarge.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

5ea85610c6d6b5ed83d53797e88a907d53e2034b2df7f63bca6c7277976f96f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 17 Apr 2023 16:16:27 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 28536
x-guploader-uploadid: ADPycduGwLw3BtKYXYf5u2eLeovLTJN0fFHliYaiznNmnRWGXotf_VguSFAIrL2T6B8AVhqqU_fVz1ZAAugZ-M6h500q7Pq2i8Y5
x-cache: HIT, HIT
fastly-io-info: ifsz=36961 idim=150x150 ifmt=png ofsz=22640 odim=150x150 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 22640
x-served-by: cache-iad-kjyo7100130-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.218206,VS0,VE0
etag: "hoVlFIxH7rLt0KmY17hVz55a8Xab/9s6RZJLHlnaplo"
vary: Accept
x-goog-generation: 1681313959579894
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=XC9hiQ==, md5=d6vtrjCtKDtlp1puQ08jOQ==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 36961
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1140, 180

GET
H2 200 15villavicencio-ktlv-square320.jpg
static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/ 11 KB
12 KB 23ms
23ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/05/15/multimedia/15villavicencio-ktlv/15villavicencio-ktlv-square320.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

03e7fba5ecb056e71e259bcad78b6d080ab0ef90a9510ad8cbc57cd29b0befda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 15 May 2023 15:53:29 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 6710
x-guploader-uploadid: ADPycdvimGqnj-Y47l4DIQ2uo_xiQjY7fHmipyQWgGIyF5Ye0R5EzgJB0gsQeRpJdQRZ5UXEp2v2s_k1gRKmb0vbVfvxT4CsoZcQ
x-cache: HIT, HIT
fastly-io-info: ifsz=31329 idim=320x320 ifmt=jpeg ofsz=11388 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 11388
x-served-by: cache-iad-kjyo7100086-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.217835,VS0,VE0
etag: "bG9hTdIdRNlMs+IVIJs7SovdpEUwvvlclNd08GtoNYI"
vary: Accept
x-goog-generation: 1684141217907804
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=lmeGLQ==, md5=L2ogKVDcu2UBqSvV6azw6w==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 31329
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 74, 28

GET
H2 200 david-french-thumbLarge-v2.png
static01.nyt.com/images/2023/01/10/opinion/david-french/ 18 KB
19 KB 22ms
21ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2023/01/10/opinion/david-french/david-french-thumbLarge-v2.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

6d444d1e6f52bfe57c1180cf064cab58e6941684bf09bbe236e3578fd2e23e65

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 24 Apr 2023 04:30:50 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 47667
x-guploader-uploadid: ADPycdugQRaxhuy3NhKo7Gtk7Y8i7o7E2DfOvecUWSG15XqVk0Oenvgx82t992x0rGHgLJ5t2ZQnTEx4dMNIHUZw3sXdHzaAEzwS
x-cache: HIT, HIT
fastly-io-info: ifsz=29917 idim=150x150 ifmt=png ofsz=18472 odim=150x150 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 18472
x-served-by: cache-iad-kcgs7200099-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.217328,VS0,VE0
etag: "UHMslo9fQpXlqe4rzWoQP7xQ8lwHh2b+h+7eIbfguhw"
vary: Accept
x-goog-generation: 1679948948755521
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=Os64Sw==, md5=ik813eCgSskbkzQKQl7kCA==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 29917
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 174

GET
H2 200 the-daily-album-art-square320-v5.jpg
static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/ 4 KB
4 KB 23ms
21ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2017/01/29/podcasts/the-daily-album-art/the-daily-album-art-square320-v5.jpg?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

66debd0db62a3f53e72503a053f862b586a886e6a399fd8243b5e0180d304dec

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Mon, 24 Apr 2023 17:00:56 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 2662
x-guploader-uploadid: ADPycduyRA4n-gUc82OBqk5k7l2TJuAgrd2LOEcVdOy6HB_dBl0DkF2cr1KE4clXHXKs1t9xph_H8VMqD6aUpAo8kn9ufA0M3t0n
x-cache: HIT, HIT
fastly-io-info: ifsz=15986 idim=320x320 ifmt=jpeg ofsz=3614 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 3614
x-served-by: cache-iad-kcgs7200066-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.241622,VS0,VE0
etag: "HnnVz93O4bK0D9Smvlwnf0lv96YmNmLNlX7IWtdXh7Q"
vary: Accept
x-goog-generation: 1676481259772829
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=JiXB7Q==, md5=PfDXw6toN2ZQvpOKxIlHug==
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 15986
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 496, 9

GET
H2 200 the-morning-icon-square320.png
static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/ 18 KB
19 KB 21ms
20ms Image
image/webp 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static01.nyt.com/images/2022/03/15/multimedia/the-morning-icon/the-morning-icon-square320.png?format=pjpg&quality=75&auto=webp&disable=upscale

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

2e937efb936592a5daf1512eed7708ce749abc0025ce481edc94d01d4a719067

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 13 Apr 2023 07:16:16 GMT
date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 477493
x-guploader-uploadid: ADPycdsetZT2qsfezPZ6fhuIPsK8Jj91KHdz4FbF1nEA3yZt8R_SlNFNT_ElxmH1Lp1vTQkgDPDf56tfHU4M7OjKGd-Z
x-cache: HIT, HIT
fastly-io-info: ifsz=28435 idim=320x320 ifmt=png ofsz=18846 odim=320x320 ofmt=webp
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
fastly-stats: io=1
content-length: 18846
x-served-by: cache-iad-kiad7000149-IAD, cache-fra-etou8220070-FRA
server: UploadServer
x-timer: S1684172719.241767,VS0,VE0
etag: "fvmiwkoVSucPkCQm5zWXms48Wd/eA+b71aA/zw+i3+w"
vary: Accept
x-goog-generation: 1647343871193623
content-type: image/webp
access-control-allow-origin: *
x-goog-hash: crc32c=ySN2bw==, md5=zI0rsfov1F0wMhGvqBk3Qg==
cache-control: max-age=604800; stale-if-error=86400; stale-while-revalidate=30, public
x-goog-stored-content-length: 28435
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5065, 139

GET
H2 200 .status
a.et.nytimes.com// 0
0 126ms
125ms Fetch
text/plain 52.3.42.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com//.status
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.3.42.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-42-214.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept: */*
Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
content-type: text/plain;charset=UTF-8

Response headers

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 69ms
68ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202305090101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60076f16002b2d2ef5566055219f0658849b9dc31423d89f8db73c5458220787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11461
x-xss-protection: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 100ms
19ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 15 May 2023 16:35:39 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 4180
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 15 May 2023 18:35:39 GMT

GET
H2

200

activityi;dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~... Show response
5290727.fls.doubleclick.net/ Frame 58F6
Redirect Chain

https://5290727.fls.doubleclick.net/activityi;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=...
https://5290727.fls.doubleclick.net/activityi;dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%...

455 B
359 B

67ms
66ms

Document
text/html

142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5290727.fls.doubleclick.net/activityi;dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demonyins.top%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

db84675a699fe82530de408fc9c93447c51e13d24b67dfe2faf9e85d55ea9c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login5.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 249
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:45:19 GMT
expires: Mon, 15 May 2023 17:45:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:45:19 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5290727.fls.doubleclick.net/activityi;dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demonyins.top%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 chartbeat_video.js Show response
static.chartbeat.com/js/ 70 KB
24 KB 101ms
23ms Script
application/x-javascript 2600:9000:2057:1c00:18:1fcd:351:7bc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_video.js
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:1c00:18:1fcd:351:7bc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a4e403c7245b00375232364f36d09d16a96488154a2414d40ce211e4693ef8d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 03:24:56 GMT
content-encoding: gzip
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
last-modified: Thu, 08 Dec 2022 17:02:37 GMT
server: nginx
x-amz-cf-pop: FRA6-C1
age: 51623
etag: W/"639218ad-11856"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-amz-cf-id: RReQmTqC3CkHFkr2A_499dbShJsNs5suYyxWBvqq_kTvRIuragBAtw==
expires: Tue, 16 May 2023 03:24:56 GMT

GET
H2 200 show-ads.js Show response
a1.nyt.com/analytics/ 45 B
339 B 47ms
22ms Script
text/javascript 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.nyt.com/analytics/show-ads.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

8aa1e610b22079cb84a89491850b86860036e3f2c9750a367d839b9a6a63d306

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Thu, 13 Apr 2023 05:00:40 GMT
date: Mon, 15 May 2023 17:45:19 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 46560
x-guploader-uploadid: ADPycduQ4dVgD4_gc-w-jr1N4uVUC2C_toCIkWUbquDhGnrcLQLbqbybeWh__r_Wk_OAEQMPGpXD9_npxgFi-wf_YXFvWQ
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 65
x-served-by: cache-fra-etou8220070-FRA
last-modified: Wed, 22 Dec 2021 23:30:41 GMT
server: UploadServer
x-timer: S1684172719.389350,VS0,VE0
etag: "1d291da792456bd015b664ee1119a5e0"
vary: Accept-Encoding
x-goog-generation: 1640215841852360
x-goog-hash: crc32c=nM1/Pw==, md5=HSkdp5JFa9AVtmTuERml4A==
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=86400
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 45
accept-ranges: bytes
x-nyt-pagetype: nyt-dti-analytic
timing-allow-origin: *
x-cache-hits: 1521

GET
H2 200 comscore-streaming.js Show response
a1.nyt.com/analytics/ 103 KB
19 KB 47ms
22ms Script
text/javascript 151.101.1.164
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.nyt.com/analytics/comscore-streaming.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.164 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

fe8d5a6f12533884b6896dd290e422c830e86e0228d45dbe97ac03c6e86a5b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

expires: Wed, 03 May 2023 02:30:54 GMT
date: Mon, 15 May 2023 17:45:19 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=63072000; preload; includeSubdomains
age: 54834
x-guploader-uploadid: ADPycduqdaSryPFkcLL2Gf1G5WmWCD8B6rg-UWgLf6QrS4KUSExlNNhn8gaGfFCWtrmSDH8asVnlja9lKT166GqBRdREOVoggEnR
x-cache: HIT
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 18717
x-served-by: cache-fra-etou8220070-FRA
last-modified: Wed, 22 Dec 2021 23:30:41 GMT
server: UploadServer
x-timer: S1684172719.389350,VS0,VE0
etag: "04e0b9556a78ce5cedf86a34e5483036"
vary: Accept-Encoding
x-goog-generation: 1640215841902856
x-goog-hash: crc32c=XkdIyw==, md5=BOC5VWp4zlzt+Go05UgwNg==
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=86400
access-control-allow-methods: GET, OPTIONS
x-goog-stored-content-length: 105675
accept-ranges: bytes
x-nyt-pagetype: nyt-dti-analytic
timing-allow-origin: *
x-cache-hits: 1110

GET
H2 200 nyt.js Show response
cdn.brandmetrics.com/tag/85a1ebf79602421aa1c2c2f24d32cb6c/ 4 KB
2 KB 101ms
34ms Script
text/javascript 2606:4700:20::ac43:4842
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/tag/85a1ebf79602421aa1c2c2f24d32cb6c/nyt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P528B3&gtm_auth=tfAzqo1rYDLgYhmTnSjPqw&gtm_preview=env-130&gtm_cookies_win=x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4842 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c21a976bd2fa363568a31c73de29c8e071abac667139623ae743dce1bda9b14

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 15 May 2023 17:28:38 GMT
server: cloudflare
age: 1001
cf-polished: origSize=4725
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iZ8AT5VvpKFxJqpgBA04C6MpGa9VHVyzUaoQvJ8bQRxfrbaVHPB2Sax2CdFm%2FkWI1hfblRt%2F9Yk8f84k6hg0D%2FP7lL0zB4GnKpfgw8UefJroLb5pBZcXk1isHOs52rlP%2FxnVocLZce1hFue7JwRNIizG"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c7d31a86c262bea-FRA
request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937

GET
H2 200 loader.js Show response
platform.iteratehq.com/ 1 KB
1 KB 104ms
31ms Script
application/javascript 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.iteratehq.com/loader.js

Requested by

Host: login5.demonyins.top
URL: https://login5.demonyins.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8319c824c1f3f053803abef05170a1f96d506b6a6628e0d1016ea1b7e15de89

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
x-amz-version-id: sxbh0sX1Uu_9VWD90bhaukCR16JbmzF2
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains
x-amz-request-id: GKGD5SM5E5A1C1PZ
age: 140
x-amz-server-side-encryption: AES256
x-amz-id-2: jGHXn8MEYMobZjRwHtbmbfCseuv5oPETIpzVMn/kbMzri+eqSMDBTMP+EwTOysyrWm+wfRXL4xA=
last-modified: Wed, 10 May 2023 19:20:45 GMT
server: cloudflare
etag: W/"8c061118fbe1f3981a379fa8bf00aa91"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ywotF1XfJBTce0Ug7bJKa9lotztcCo8ZMwJ837D193iwzHOaSHVIFzr3yBnJiez5Ut6brnW80oG3vDjosiFZm3Zki%2B9sX6CtA%2Fcg7SWCdp6O1oPsNrlKk5%2FT7JvB8LDD%2FIUFUsIdlbnSIVDqD3lGEqyZ9rc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 7c7d31a889a96913-FRA

GET
H2

200

cs.js Show response
sb.scorecardresearch.com/internal-c2/3005403/
Redirect Chain

https://sb.scorecardresearch.com/c2/3005403/cs.js
https://sb.scorecardresearch.com/internal-c2/3005403/cs.js

0
358 B

24ms
23ms

Script
application/javascript

13.32.121.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-c2/3005403/cs.js
Protocol: H2
Server: 13.32.121.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-72.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:28:05 GMT
via: 1.1 9ef1b108656dc6d0707b168b862883dc.cloudfront.net (CloudFront)
last-modified: Mon, 01 Mar 2021 20:41:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 1034
x-amz-server-side-encryption: AES256
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 0
x-amz-cf-id: ohux35DPMFNoNn2iaFetYmE4gE66KSrszNA9W0tc-afTaSbxQ8QDRg==

Redirect headers

date: Mon, 15 May 2023 17:45:19 GMT
via: 1.1 9ef1b108656dc6d0707b168b862883dc.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P1
x-cache: Miss from cloudfront
location: /internal-c2/3005403/cs.js
content-length: 0
x-amz-cf-id: yVgOPJivi5-C-KlKSFuISqcH2FP8p8_GtKhoq2orYPD_azXHh8phbQ==

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 111ms
110ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 15 May 2023 17:45:19 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
211 B 28ms
27ms XHR
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&aip=1&a=1614227928&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nytimes.com%2F&dr=&ul=en-us&de=UTF-8&dt=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAEABAAAAACgBM~&jid=1257311480&gjid=1932835074&cid=807152879.1684172715&tid=UA-58630905-7&_gid=844244048.1684172719&_r=1&_slc=1&gtm=45He35a0n71P528B3&cg1=homepage&cg2=null&cg3=homepage&cg4=null&cd1=https%3A%2F%2Fwww.nytimes.com%2F&cd2=https%3A%2F%2Flogin5.demonyins.top%2F&cd3=&cd9=9&cd10=null&cd13=null&cd14=null&cd15=earned&cd16=referring_links&cd21=Homepage&cd26=null&cd27=null&cd28=null&cd29=null&cd30=null&cd36=&cd42=nyt-vi&cd48=null&cd49=&cd51=nyt-vi&cd52=&cd54=null&cd57=0&cd58=0&cd59=&cd60=&cd67=0&cd95=&cd122=&cd123=&cd124=&cd125=&cd126=&cd127=&cd129=NaN&cd135=&cd139=&cd141=&cd142=&cd162=&cd163=&cd172=desktop&cd173=desktop&z=159952720

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://login5.demonyins.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 65568.js Show response
cdn.brandmetrics.com/scripts/bundle/ 46 KB
15 KB 98ms
98ms Script
text/javascript 2606:4700:20::ac43:4842
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login5.demonyins.top
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4842 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 519b0247d3da7b20bd944e54ea565b097e37b91a644427e04539b86548ac3321

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 15 May 2023 17:45:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uPRcEcG98bxVY7kkpRInUTAuvI2gtEoarZXcddirIPBNUREAs7Y9lvPpG0wY%2B8wkUN1qLFJiCRHCxiTOs%2B5qk9DcWrOdtmQjRAqa2lE1%2BfT4fOgjYD99xzLOXl8cGG51qqFRwxeUzxCmV3fDHJI8m6R8"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c7d31a8bc7d2bea-FRA
request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937

GET
H2 200 ping
pnytimes.chartbeat.net/ 43 B
201 B 384ms
107ms Image
image/gif 54.172.179.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pnytimes.chartbeat.net/ping?h=nytimes.com&p=nytimes.com%2F&u=DoXIlOD7N6XwldAqF&d=login5.demonyins.top&g=16698&g0=Homepage&g1=No%20Author&n=1&f=00001&c=0&x=0&m=0&y=11688&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&PA=https%3A%2F%2Flogin5.demonyins.top%2F&b=8180&t=BBQV9hBocnMGvELLyWJLBxDL1bO2&V=139&i=The%20New%20York%20Times%20-%20Breaking%20News%2C%20US%20News%2C%20World%20News%20and%20Videos&tz=0&sn=1&sv=BBVeB3DLrXvXazaBV_e5SFBOMaxh&sd=1&im=06672fd3&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.172.179.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-172-179-242.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 15 May 2023 17:45:19 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-length: 43
expires: 0

GET
H2 200 match-prod-2ba9e5cdc9d92a535fcf.js Show response
platform.iteratehq.com/ 85 KB
30 KB 31ms
31ms Script
application/javascript 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe8914b592cfb54f22c6e9257dbd956efeeae4909f1328233dfe706be71c34d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
x-amz-version-id: b33MITr7SVI4DDhNP4LfAri2wMAOFhLe
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains
x-amz-request-id: K8H152JEH39AM7WD
age: 426227
x-amz-server-side-encryption: AES256
x-amz-id-2: FsXo6xZMtectTQuW2TdHqjFy1q5q3oTpnYH0hRp0ZjuKvRBupaOJ59GR5CH9zzu2Pc6hU4fMC5sUE2KUt5rCZo5QpVO5ylQqqyLoVgWZ+Mg=
last-modified: Wed, 10 May 2023 19:20:43 GMT
server: cloudflare
etag: W/"74caba77682b49745a5ab63f20fc5cde"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hEwUTGyurdnY1lFnk1qL6QPD7%2FRXxdZ6X14QOCale0jP4x5m1JKQPEFs%2BNh0iLiF33bA%2Bni7APfzXq9WNhq9VPHgDrb%2B9uMSrJD3OM%2BeE63Gc7hCG18iEMWXAmm4y8sKW8FCT8CEyOhT634XX4Db3YHjhxg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 7c7d31a8d9f76913-FRA

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3901 13 KB
5 KB 21ms
20ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login5.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11395
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 14:35:24 GMT
expires: Tue, 14 May 2024 14:35:24 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2C83 783 B
1 KB 81ms
30ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/b3960cc6-bfd2-4adc-910c-6e917e8a6a0e/grumi-ip.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e0697a9469bc55d5d43b5af186b23f587d7931fe1bc29ceadc0d3040bca55d9f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AxM9RYzWS8mUd_nrPCm44g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login5.demonyins.top/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-AxM9RYzWS8mUd_nrPCm44g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 15 May 2023 17:45:19 GMT
expires: Mon, 15 May 2023 17:45:19 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 200 embed Show response
iteratehq.com/api/v1/surveys/ 300 B
549 B 119ms
118ms Fetch
application/json 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16d339bd115cd3a3eb2e4f3367e07d8a6f7d282b039f283ec3bfbfccc5b5d933

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNTQ0MTI5MzQxfQ.UI13nEXGs0udbZxhjyFLruAEed42XwFO4fZlCqOgY1o
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
strict-transport-security: max-age=0; includeSubDomains
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=92qZbJ02kIgfUVBBTqzPKAv4M614DhOq29mqYLt9PbgvOqlEJAPp2unADjK4UXKkPO2Ypo12zif%2FGBI%2Bq0DrwTCKMJQavTU6ruVPRwPOHQN7y0yYsKQCxjMF1IzPuOrbiqxRL1Av%2ByJ1CP0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7c7d31aa4fbd1ca9-FRA

OPTIONS
H2 200 embed
iteratehq.com/api/v1/surveys/ Frame 0
0 178ms
124ms Preflight 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login5.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-ray: 7c7d31a98ed61ca9-FRA
content-length: 0
date: Mon, 15 May 2023 17:45:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e%2FrNdBYMbVo5s610gEhHEUK0mjXwI9cpZhvrV8Ee5zEro1C35jTFHoc0o4dNSWl%2FYnbr28UOmMWVNTkCfBvjtvRk1NV66hzSLbeWYi7%2FVgqO%2BbuuFBtO6A2k%2FehSoQDGTox6NelGm5rnUuI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H3 200 oKPwcP-deonJmdk-VuVCerVM0HYOOiEgue33yvnOnyk.js Show response
pagead2.googlesyndication.com/bg/ Frame 3901 37 KB
14 KB 65ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oKPwcP-deonJmdk-VuVCerVM0HYOOiEgue33yvnOnyk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0a3f070ff9d7a89c999d93e56e5427ab54cd0760e3a2120b9edf7caf9ce9f29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sun, 14 May 2023 13:14:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 102650
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14771
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 May 2024 13:14:29 GMT

POST
H2 200 track
a.et.nytimes.com/ 0
0 235ms
234ms Ping
text/plain 52.3.42.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.et.nytimes.com/track
Requested by: Host: login5.demonyins.top
URL: https://login5.demonyins.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.3.42.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-42-214.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 c.js Show response
collector.brandmetrics.com/ 0
143 B 179ms
30ms Script
text/javascript 20.50.2.28
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.brandmetrics.com/c.js?siteid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login5.demonyins.top&rnd=1794758
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=4486dfe2-780e-4dfa-a60a-2a948887658f&toploc=login5.demonyins.top
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.50.2.28 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

request-context: appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937
date: Mon, 15 May 2023 17:45:18 GMT
content-length: 0
content-type: text/javascript;charset=utf-8

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2C83 0
0 122ms
121ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202305090101&jk=2147242025988008&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H2 200 dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=*;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demo...
adservice.google.com/ddm/fls/z/ Frame 58F6 42 B
262 B 59ms
59ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=*;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demonyins.top%2F

Requested by

Host: 5290727.fls.doubleclick.net
URL: https://5290727.fls.doubleclick.net/activityi;dc_pre=CPbPwKXw9_4CFQfSmgodkW0EBQ;src=5290727;type=allpa0;cat=nyti-0;ord=1;num=3267094516106;gtm=45He35a0;auiddc=1372300703.1684172719;u17=https%3A%2F%2Flogin5.demonyins.top%2F;u5=;u18=;~oref=https%3A%2F%2Flogin5.demonyins.top%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5290727.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 15 May 2023 17:45:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3901 0
10 B 20ms
20ms Image
text/plain 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?VvqmKg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Mon, 15 May 2023 17:45:19 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

OPTIONS
H2 200 embed
iteratehq.com/api/v1/surveys/ Frame 0
0 119ms
118ms Preflight 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login5.demonyins.top
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-ray: 7c7d31ac4ab61ca9-FRA
content-length: 0
date: Mon, 15 May 2023 17:45:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ScJMS68%2Fk9tYC0gh1E0dxN%2By%2FjQzfQ4Oe1LGgnOalrp6hAQLkWBIAUCt0l%2BjvoCGNdYk43cx%2BRmJMh3U4SAr7qV10S7yxrgHjn2lM9yxJxU4TwePcNONps83TLass0n5JkFTpvJAWqfjNbc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 200 embed Show response
iteratehq.com/api/v1/surveys/ 64 B
345 B 121ms
120ms Fetch
application/json 2606:4700:20::681a:7e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://iteratehq.com/api/v1/surveys/embed

Requested by

Host: platform.iteratehq.com
URL: https://platform.iteratehq.com/match-prod-2ba9e5cdc9d92a535fcf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:7e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea939bd13d79a17cc436d4c3e102d4060cb7ebf0e8e61918f3d034580dff02b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains

Request headers

Referer: https://login5.demonyins.top/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiI2NDYyNmZhZjM1Zjg1ODAwMDEwNjIyNGQiLCJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNjg0MTcyNzE5fQ.RBqVAw4sVa8WLR9HFPDQG93clrLNjXWKhySM1fiO6z8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 May 2023 17:45:20 GMT
strict-transport-security: max-age=0; includeSubDomains
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L1pFi7H8E%2BXI%2FnLaeA%2Bc6sd3bev6gU2uQltxTgYG5FCLUfqqD0fza8DdvMF8YKqu7HoiiCsuQWuUg3a1H06rcqrgP67tQ%2FgQlLW6f%2FkFT2PVSluvZdTRmNMCIYb2ksx93us3kbiNBL5phX0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 7c7d31ad0b9b1ca9-FRA

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 133ms
132ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202305090101&jk=2147242025988008&bg=!eHuley_NAAYldGN0BXQ7ADkAdvg8WhHxdmUYXZJYxPZtCVAbhgGbVIZHjzbxWg0r5s3URoQgiPz8zF_ApseBhgv1da0LSpAIfJUCAAAAbVIAAAACaAEHCgDAT5MOo_ljqL4DLBsol3n7xirJWJAD7MVzhZpL1sqvUso09fJjjXJbKyCVidv9H6iMN3XchYOZAolAtTum8FqHpG9WBtGg_Pi3p-kaptNqzfralfCrAXD4gRVjS7tcD9G8a8wBRUStoywiNPQ4SrqMN5tPIZRTDCbu013XPhnVUlJJ_X8UIKU0tfcj4Dn3Jp-ZVFb-i3_65R4edfqNjlkvdeLKxGnlDOrc0BFeBFv8TffXyYh-ctCv3SzsXYC3VUbZmQKe6IGhRgxdH-5LjCy_qiaN8EGh9nTdMhVk3BKzxlsVZMQPcA0Sgm23zj52GBuwOwPSWitFA3ruNBcSLTryPwI9t5H6-G-XV7CDUGGe5NoCyKDpLrNfkmxNUfyUO1_PdVnHVthGTkEgJtmvOJu529OOGlOOCTG9IQcOypQgsjSi3HYkNwUgfxn9Z_SXUvpjv5fiQvrOh3P6hTUo5MwPgWxo86eB7Z1ttG5nx2ihkBZ9a8dMcaLxeiKv_u21PKNfK6kobrSpLxWvT-t5mA0nqgQm_bt5vpLf0Wi2VR1s0SarBYBmeVhWbMkYGmP1IeURkGParu_8svXd5lQdLREtt6Sf70OJ8NjdEtgEAyQLfpOCje_2WI6C7HvN2z8KaylghOkUC3BpzOBVJZCl4CEHJd85Va63Z5W66GwCbKM9CIB9AwGRc3FfOgPJwVfayMI9A7q21M4UM0iZkXP6dNRyhCNYODbq0lF9xrvQF_VDl5vu93s4fdMG_UjxSJjj9zMKiYTchTU8X7UN6kWLpUxJ_yPavfQimieUa7MlGejjjHGwwA4IWdlMdiOS7s3_GYxNeKG3ppFkPwmDgWcTYIi0MiCAqpimLMR3KhCw2M0TaT_El0HFwBgWLY7bpIIwxCWrjMao8ySlnNztRJnkhQYNh2BooHmB2_3YbeuQ2fqt2-tY2_256dRKzTt0tpwv5JpJO8SdeihLifOedFPkHe3tZWDnSfp5L10TBkwUg0yZeB3eyqjV-L9GEx0Go32ekKcDKkpViX35x5J15nhqr32i4h2PRWOEGiGqV3seD22R8LqVEK2g1FHyEc4nbrueMvVSO6NHcpeVGMzF7oPdlogr6P3te6X3lI_nPw9jFztSH9mJq-d1L86uP42QxPPObrXKYw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login5.demonyins.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: als-svc.nytimes.com
URL: https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: purr.nytimes.com
URL: https://purr.nytimes.com/v1/purr-cache

Domain: a.nytimes.com
URL: https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172718819&referrer=&sourceApp=nyt-vi

Domain: samizdat-graphql.nytimes.com
URL: https://samizdat-graphql.nytimes.com/graphql/v2

Domain: meter-svc.nytimes.com
URL: https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin5.demonyins.top%2F&referer=https%3A%2F%2Flogin5.demonyins.top%2F&pageviewID=wjvFlpZ3Hk5Jo7ys2GahEWZn

Verdicts & Comments Add Verdict or Comment

134 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rubiconproject.com/	1970-01-20 20:35:08	Name: khaos Value: LHP4Y7MN-1U-IIXQ
.rubiconproject.com/	1970-01-20 20:35:08	Name: audit Value: 1\|SDziDG3X/EimWln8W3TDi7U1ZxogGjlwOA+xFj1I9sdpdF/86rQGb7z3ivQgIBpwx0dz0IWOFX1tRKIJ8DqxoBDO8P6WoNZe2jL6aH0a0w6VOlHV8UEF7g==
.nytimes.com/	1970-01-20 20:35:08	Name: nyt-a Value: H5t-_JCZ72ojvXRs8IyOUVQT
.et.nytimes.com/	1970-01-20 11:49:34	Name: sessionActive Value: true
.et.nytimes.com/	1970-01-20 20:35:08	Name: sessionIndex Value: 1\|1684172714831\|H5t-_JCZ72ojvXRs8IyOUVQT\|1684172714831
.et.nytimes.com/	1970-01-20 11:50:59	Name: et-ppvid Value: https://login5.demonyins.top/=wjvFlpZ3Hk5Jo7ys2GahEWZn
.demonyins.top/	1970-01-20 21:11:08	Name: __gads Value: ID=36062e74e87d58d9:T=1684172714:S=ALNI_MYZvmtmyygARyZHn61B6DvI-RK_9Q
.demonyins.top/	1970-01-20 21:11:08	Name: __gpi Value: UID=00000c17a717831e:T=1684172714:RT=1684172714:S=ALNI_MZJB5M3iSQnQ1_IR8Qmcj0T9PTVBg
.doubleclick.net/	1970-01-20 21:11:08	Name: IDE Value: AHWqTUmzancOn1nYuC1Kd2kh1TbSBKgX0kj8N6ho8Vwd5Kqpij2mFaGR0HPue3eLyhE
.login5.demonyins.top/	1970-01-20 20:35:08	Name: datadome Value: 0pLLEgWpoTILYtQbG-hLE3TYjxptrEq9Sxerdop0mf~sB3SyU431tHPt_c7FE8_f8ZqlfwEc9Cat5Z5baE4jO5tbXDoKitoA28FJId7nGz3E1THWV7WCYKwkuPSDOJzE
.demonyins.top/	1970-01-20 13:59:08	Name: _gcl_au Value: 1.1.1372300703.1684172719
.demonyins.top/	1970-01-20 21:25:32	Name: walley Value: GA1.2.807152879.1684172715
.demonyins.top/	1970-01-20 11:50:59	Name: walley_gid Value: GA1.2.844244048.1684172719
.demonyins.top/	1970-01-20 11:49:32	Name: _gat_UA-58630905-7 Value: 1
.demonyins.top/	1970-01-20 21:18:20	Name: _cb Value: DoXIlOD7N6XwldAqF
.demonyins.top/	1970-01-20 21:18:20	Name: _chartbeat2 Value: .1684172719473.1684172719473.1.BBVeB3DLrXvXazaBV_e5SFBOMaxh.1
.demonyins.top/	1970-01-20 11:49:34	Name: _cb_svref Value: null
.demonyins.top/	1970-01-20 21:25:32	Name: iter_id Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiI2NDYyNmZhZjM1Zjg1ODAwMDEwNjIyNGQiLCJjb21wYW55X2lkIjoiNWMwOThiM2QxNjU0YzEwMDAxMmM2OGY5IiwiaWF0IjoxNjg0MTcyNzE5fQ.RBqVAw4sVa8WLR9HFPDQG93clrLNjXWKhySM1fiO6z8

18 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://login5.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login5.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login5.demonyins.top/ Message: Access to XMLHttpRequest at 'https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web' from origin 'https://login5.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://als-svc.nytimes.com/als?uri=https%3A%2F%2Fwww.nytimes.com%2Fpages%2Findex.html&typ=&prop=nyt&plat=web Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/ads Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html(Line 144) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.nytimes.com') does not match the recipient window's origin ('https://login5.demonyins.top').
security	error	URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html(Line 144) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.nytimes.com') does not match the recipient window's origin ('https://login5.demonyins.top').
javascript	error	URL: https://login5.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login5.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login5.demonyins.top/ Message: Access to XMLHttpRequest at 'https://samizdat-graphql.nytimes.com/graphql/v2' from origin 'https://login5.demonyins.top' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://samizdat-graphql.nytimes.com/graphql/v2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login5.demonyins.top/ Message: Access to XMLHttpRequest at 'https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172718819&referrer=&sourceApp=nyt-vi' from origin 'https://login5.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://a.nytimes.com/svc/nyt/data-layer?assetUrl=https%3A%2F%2Fwww.nytimes.com%2F&caller_id=nyt-vi&jkcb=1684172718819&referrer=&sourceApp=nyt-vi Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login5.demonyins.top/ Message: Access to fetch at 'https://purr.nytimes.com/v1/purr-cache' from origin 'https://login5.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://purr.nytimes.com/v1/purr-cache Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://login5.demonyins.top/ Message: Access to XMLHttpRequest at 'https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin5.demonyins.top%2F&referer=https%3A%2F%2Flogin5.demonyins.top%2F&pageviewID=wjvFlpZ3Hk5Jo7ys2GahEWZn' from origin 'https://login5.demonyins.top' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://meter-svc.nytimes.com/meter.js?sourceApp=vi&url=https%3A%2F%2Flogin5.demonyins.top%2F&referer=https%3A%2F%2Flogin5.demonyins.top%2F&pageviewID=wjvFlpZ3Hk5Jo7ys2GahEWZn Message: Failed to load resource: net::ERR_FAILED
security	error	URL: https://12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html(Line 144) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.nytimes.com') does not match the recipient window's origin ('https://login5.demonyins.top').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src data: 'unsafe-inline' https:; img-src data: https: blob: android-webview-video-poster:; font-src data: https:; connect-src https: wss: blob:; media-src data: https: blob:; object-src https:; child-src https: data: blob:; form-action https:; report-uri https://csp.nytimes.com/report;
Strict-Transport-Security	max-age=63072000; preload; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

12fe36bb577f22f73a174afb879dc810.safeframe.googlesyndication.com
5290727.fls.doubleclick.net
a.et.nytimes.com
a.nytimes.com
a1.nyt.com
aax.amazon-adsystem.com
adservice.google.com
adservice.google.de
als-svc.nytimes.com
c.amazon-adsystem.com
cdn.brandmetrics.com
collector.brandmetrics.com
cs.media.net
dd.nytimes.com
eb2.3lift.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g1.nyt.com
ib.adnxs.com
iteratehq.com
login5.demonyins.top
meter-svc.nytimes.com
nytimes-d.openx.net
pagead2.googlesyndication.com
platform.iteratehq.com
pnytimes.chartbeat.net
prebid.media.net
purr.nytimes.com
rumcdn.geoedge.be
samizdat-graphql.nytimes.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
static.chartbeat.com
static01.nyt.com
static01.nytimes.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
vp.nyt.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.nytimes.com
a.nytimes.com
als-svc.nytimes.com
meter-svc.nytimes.com
purr.nytimes.com
samizdat-graphql.nytimes.com
13.248.245.213
13.32.121.72
142.250.186.166
143.204.215.54
151.101.1.164
20.50.2.28
23.35.228.23
2600:9000:2057:1c00:18:1fcd:351:7bc1
2600:9000:2491:cc00:4:b37b:9440:93a1
2602:803:c003:200::21
2606:4700:20::681a:7e5
2606:4700:20::ac43:4842
2606:4700:3031::ac43:d8c7
2a00:1450:4001:801::2002
2a00:1450:4001:809::2008
2a00:1450:4001:80b::2001
2a00:1450:4001:80b::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:812::2002
2a00:1450:4001:812::200e
2a00:1450:4001:813::2001
2a00:1450:4001:827::2002
2a00:1450:4001:827::2004
2a00:1450:4001:829::2002
2a00:1450:4001:829::200a
3.72.132.166
34.107.148.139
35.244.159.8
37.252.171.149
52.222.208.154
52.222.209.4
52.3.42.214
54.172.179.242
03e7fba5ecb056e71e259bcad78b6d080ab0ef90a9510ad8cbc57cd29b0befda
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
078b159fb8403c40be85c805a1ee088fec7f3e2ad5db26ac94d22ddfd00c50cf
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
09bff184ea094a06e46d7f26512fd7b245304078a27f1ba8084488cbcf7704de
0b904723c5938b523c9ae329ba2b763681cb1de225c8f202d11012cbfd533f1f
0c34dc4de2a524e93b1315788f03ba101b99e22ff50082945e84a00368d73e16
111041158b9290ae7cc0c6da69d7c4f5600e8a73b4c7399d675df7f15ba7b063
16d339bd115cd3a3eb2e4f3367e07d8a6f7d282b039f283ec3bfbfccc5b5d933
173bfe854ae5d662b3183aff18eb7732eb38d2033d6645555cfa193cf09c558e
189f77dfa715f7e5b84743b9d59479fdf0d7871c02fecf98f0135ee955129c5c
19195533133b2d5cf2cc8fc1d489120e453dd814075b3a95a09db6c339c6d1d3
1b21615e48553f20ba4b828d0c9753e058d95a88a91f4bba9e5d180fb01d3f08
1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1ecb1f9522433be3adfad377816095c7d5b27d02c1efbbbb793e341b829d83d9
1fa38bb7b6bfe71815c4560e649bc7e60d1d93e7d161cc94f6f8bffe16910de7
24090f47a163db652b99faa86e9a5832ff11da883120ffdc98b2b573dab974ed
2739fb249dc30ac68b3dca4d603f4f4c60733afc5ad5dd16186152ecf77f664e
2980e0459d7b74afe625123bccfa2d3034baa08f39f71bd47399594057a661d3
2cc6cfc6f07bc4cef11c2dee27ca861146085b4aeb618527bef97c9e2a1c54ce
2e937efb936592a5daf1512eed7708ce749abc0025ce481edc94d01d4a719067
33214b5241d7d2719b36f35a46358a940de5071403c3bd19a8ac7666ae0a388d
3349461a6457af7c8fbee55ed16d18fa9e394123d01ed838c78b3841ff2f6885
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4b9e7c9899fda37a0b55a539279040246a30e742e4a5a57fbb7617f4eafd4e20
4d1fa762c4ceaff06454053eb6b793bb211ef208329085b9073ecdffc90ccd31
4dc80fcaf6db01fa29ced797dbb0947bb3bb95b1a88f893f389cf17144166075
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f837869b80c34ed1a128362a6ed24ff5ebdae743dc55eb3c183ae9c8b5f4ca3
519b0247d3da7b20bd944e54ea565b097e37b91a644427e04539b86548ac3321
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
564385e5dd8a1058fd759445c33b2c554d409528496b9d91533eeb079f6415de
57bc281be64ff5ec8e3c2258640df6097a32f08ac5a2c346f214300eb430f176
586215e0b31b301661910b86f13a882b26ca03e23beb98d7f3b3cab1dc1dbb61
58daca1634c2cbbf89e4da037e059af163cfc23a4170d59ea140baa30ebaf5e6
5a463100955fc30302bbd7079dcf03e75d66a0b148a56ee0f9578d05cc96a418
5af3756336be117aeae1865f764ab57d5fd8384ec55be872fd9862b71047311f
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
5ea85610c6d6b5ed83d53797e88a907d53e2034b2df7f63bca6c7277976f96f0
60076f16002b2d2ef5566055219f0658849b9dc31423d89f8db73c5458220787
6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
66debd0db62a3f53e72503a053f862b586a886e6a399fd8243b5e0180d304dec
6d444d1e6f52bfe57c1180cf064cab58e6941684bf09bbe236e3578fd2e23e65
73bd4d0f8a3ec1a6b0ec41f111a2b46ba4c242d4dc7bdf0817c4af97a6dfa48e
75233efd627abe6467968bc77764815e4039bd6f8391196716d8b0e16274df8b
766e2c94d35a881dfa209017c895c44c47b20b6aa215f27f2f455a83d1a7304f
7bf092f4cf7d479f28b7f4bc8e22d1a5bb6086945bca468c2d714c7d1328433f
7c21a976bd2fa363568a31c73de29c8e071abac667139623ae743dce1bda9b14
7dcbc19c68e87e4b23f85027e02ac7f3c89fa259973ec92bbe27e49ad002bf47
8658fc44ca45cf40ee56d54bccb269e8cbca4ad85f1ea1bfbbc5faf127a7dec3
88011d782fa21da0ec301e49080fa9950973db277a33674d252f0fe1e333f61f
88c02f49ec94fda86796bb949e3674af90a3b642839f424a4c13e510259a49b4
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8aa1e610b22079cb84a89491850b86860036e3f2c9750a367d839b9a6a63d306
8bf215be986357511cfca58e796434dbf348ee60f21d785a5ec54a1b2bf86aad
8d3c17714229b3f3ea111cde31221a1be9ec66e102343645193ee596102e9a48
8f0b0d6cbfd354da43c3fd1d9d2a25f35dff4b20792d60a13c486a7a0629d685
8fd57afe26f59515704cee10d922b01c9d1aaa8257abf811490d7fdef48d1e73
97b9ca613f6d6854860aaf524d0dae463f58162d0e2db845d78713993c2b3370
9a43ab8056183a8efcf0e882990c2601381a735e02bba004439e010055c55d47
a0a3f070ff9d7a89c999d93e56e5427ab54cd0760e3a2120b9edf7caf9ce9f29
a363038e6f698ddb820a9011456e78e51f077fa178bd3c9392f18f9c7d94312f
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4e403c7245b00375232364f36d09d16a96488154a2414d40ce211e4693ef8d4
a68a70f7be9281f3f7148b38d7f5971f1dc946d3034a40e55021d0fb6fb78d73
a99a576eb367116330b5928f8aaf72581d35a07ac5d47a2cb60034eef61c3502
b32e3879c83af441e675efa49587cb894bdd3c10420475f79879fbfb7a69766b
b3fbd953664215264e3a7fb2c2c68a3826fe96c5801ffe3d79ad431cfb37b78a
b5221e0636a97505ae38720d4ef182d35be5fb47d2628428db4fc918ab7ee30e
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd84db71c97403c42571bbf6e660bddb32d474e3aedad023b0d9d006669c9086
bf5de2a37e1b850ca9cc3b1a55bccd36def2be3524d0c5acb67b61f26aac8a96
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c4591eed27abff378652a507923552094808684c88965a1f19a163b684b6616e
c9fb083529541e219ad17a00cb201b3dba9dabcdcc01eae4eb9ac04b8cb72216
ca532afa1a5a67ac9b9f209165c21b1bc6f24945cafbb85418c082bf32605e07
cdbc97a6eafca5758332d9df4182243e2cace6a3960898b1b603652c689a88da
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d00cbd77067ec5e17df26c2bab2bb050ab6e0518598826993f80f5c68b67de24
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d4c5b9f51bf43056dacc9054f4a0ca873b8b9ef2afb9eb445a62d5cc6c426dd4
d60b320665b3e96d51b567aa07b4f548ada837085bf31ada92cd951901225fe3
d8319c824c1f3f053803abef05170a1f96d506b6a6628e0d1016ea1b7e15de89
d9044bdd43082d9979c3f3b3fa873058af8bb15424484cc98cb1761c5012855e
d9a59fc4834b4435f67f3d6d247c7cec68b50e18a9931084111ece2adec475a8
db84675a699fe82530de408fc9c93447c51e13d24b67dfe2faf9e85d55ea9c14
e0697a9469bc55d5d43b5af186b23f587d7931fe1bc29ceadc0d3040bca55d9f
e2afe2918359382ef85085d45f10bf0c29c86765bb2877dcc066e091b605d31e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e44027ee643a87c2b6ee2cbd3e738302be02274940dede3f3aa13d0bd15aae57
e444fdaa833e612d239cf21a335b8322ad8cb7c7ba697ec978bdb454f5059519
e6365a9cb7358ac9859c94ef03b78b5a4326c485488d3d65e41bfc914ff48495
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ea4d15a211ff965dccd52c1b45fba79f7137802c5c9eaedb8922ac39f43084b9
ea939bd13d79a17cc436d4c3e102d4060cb7ebf0e8e61918f3d034580dff02b9
ecd6da8a31f4ac7a6e09220679d1ff16e9e808522935a0b26c8d0cfe3dd6d5ea
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0e14e50e487d8929f2eaf86e7143b01e4d1d36a8f6e82183a76e66eebb9cfc0
f100b686086f9e625644ea31ab265146d21773b86d9daf2baf8483f9205f4929
f5d4f80afc66fb8d60756e7daaf477e986ca9cd0f25325420e28baadd15c0e87
f62c6457ddefdfd96ebc104603ccc8368e73afb6085b7b8018674cf5d3974ebe
f63504a15a3289297bad1f9a745f4b832949f3156e76b36888defd7948b532eb
fd6aaf56b4766934af5c59ba328e2875d69a2dddcea545cb31d2d98d4d77c7dd
fdb3f43256b8f711041c97bc6f871a497bd0e9e75fc54d5c06c124b6974b13db
fe8914b592cfb54f22c6e9257dbd956efeeae4909f1328233dfe706be71c34d3
fe8d5a6f12533884b6896dd290e422c830e86e0228d45dbe97ac03c6e86a5b5a

login5.demonyins.top Open in urlscan Pro 2606:4700:3031::ac43:d8c7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

134 Requests

94 %HTTPS

55 %IPv6

24 Domains

45 Subdomains

34 IPs

3 Countries

4045 kBTransfer

8278 kBSize

18 Cookies

80 Outgoing links

Redirected requests

134 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

login5.demonyins.top Open in urlscan Pro
2606:4700:3031::ac43:d8c7 Public Scan

Screenshot
Live screenshot

Full Image

134
Requests

94 %
HTTPS

55 %
IPv6

24
Domains

45
Subdomains

34
IPs

3
Countries

4045 kB
Transfer

8278 kB
Size

18
Cookies

134 HTTP transactions
2 data transactions