www.spokesman.com Open in urlscan Pro
2600:9000:2156:e800:0:b5fb:e6c0:93a1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Effective URL:
https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Submission: On December 16 via api (December 16th 2021, 12:51:07 pm UTC) from US — Scanned from DE

Summary HTTP 178 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 52 IPs in 8 countries across 39 domains to perform 178 HTTP transactions. The main IP is 2600:9000:2156:e800:0:b5fb:e6c0:93a1, located in United States and belongs to AMAZON-02, US. The main domain is www.spokesman.com.
TLS certificate: Issued by Amazon on August 19th 2021. Valid for: a year.

This is the only time www.spokesman.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2600:9000:215... 2600:9000:2156:e800:0:b5fb:e6c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:215... 2600:9000:2156:a00:2:4597:5e80:93a1	16509 (AMAZON-02) (AMAZON-02)
7	2600:9000:215... 2600:9000:2156:1e00:1e:dc88:cb00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.143.76.118 52.143.76.118	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
17	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1 2	107.178.250.234 107.178.250.234	15169 (GOOGLE) (GOOGLE)
11	34.195.91.69 34.195.91.69	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400c:c06::9d	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
11	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
13	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
1	143.204.98.43 143.204.98.43	16509 (AMAZON-02) (AMAZON-02)
1	143.204.98.34 143.204.98.34	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:215... 2600:9000:2156:1e00:14:c3e7:6780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	35.227.203.93 35.227.203.93	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	143.204.98.17 143.204.98.17	16509 (AMAZON-02) (AMAZON-02)
1	44.241.169.29 44.241.169.29	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f14:600... 2600:1f14:600:6e00:77cb:3957:e000:1f7f	16509 (AMAZON-02) (AMAZON-02)
1	34.208.153.184 34.208.153.184	16509 (AMAZON-02) (AMAZON-02)
1	34.96.74.203 34.96.74.203	15169 (GOOGLE) (GOOGLE)
25	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::282	54113 (FASTLY) (FASTLY)
1	104.26.4.15 104.26.4.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	2600:1f14:600... 2600:1f14:600:6e00:30b0:ae3e:5fa8:bc2c	16509 (AMAZON-02) (AMAZON-02)
2	143.204.101.221 143.204.101.221	16509 (AMAZON-02) (AMAZON-02)
2	54.231.192.105 54.231.192.105	16509 (AMAZON-02) (AMAZON-02)
1	35.87.123.161 35.87.123.161	16509 (AMAZON-02) (AMAZON-02)
2	52.236.186.217 52.236.186.217	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	185.167.164.51 185.167.164.51	198622 (ADFORM) (ADFORM)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
3 4	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
2 4	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	185.33.220.145 185.33.220.145	29990 (ASN-APPNEX) (ASN-APPNEX)
4	78.46.90.238 78.46.90.238	24940 (HETZNER-AS) (HETZNER-AS)
3	37.157.6.236 37.157.6.236	198622 (ADFORM) (ADFORM)
1 4	138.201.63.157 138.201.63.157	24940 (HETZNER-AS) (HETZNER-AS)
2 2	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
1	88.198.250.30 88.198.250.30	24940 (HETZNER-AS) (HETZNER-AS)
2	46.236.13.147 46.236.13.147	12703 (PULSANT-AS) (PULSANT-AS)
1 1	94.23.99.218 94.23.99.218	16276 (OVH) (OVH)
1	54.76.176.197 54.76.176.197	16509 (AMAZON-02) (AMAZON-02)
1	104.111.239.217 104.111.239.217	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
1	143.204.98.5 143.204.98.5	16509 (AMAZON-02) (AMAZON-02)
2	54.72.0.164 54.72.0.164	16509 (AMAZON-02) (AMAZON-02)
2	13.85.16.224 13.85.16.224	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
178	52

2 2600:9000:2156:e800:0:b5fb:e6c0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

www.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2156:a00:2:4597:5e80:93a1 (United States)

ASN16509 (AMAZON-02, US)

thumb.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:2156:1e00:1e:dc88:cb00:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.143.76.118 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

h.cloudengage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 34.195.91.69 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-195-91-69.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

loader-cdn.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.sbgsodufuosmmvsdf.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fp-cdn.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
g2insights-cdn.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ayc0zsm69431gfebd.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.czx5eyk0exbhwp43ya.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-43.fra50.r.cloudfront.net

api.circularhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-34.fra50.r.cloudfront.net

d31qbv1cthcecs.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:1e00:14:c3e7:6780:93a1 (United States)

ASN16509 (AMAZON-02, US)

aamcftag.aamsitecertifier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.203.93 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 93.203.227.35.bc.googleusercontent.com

pymx5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-17.fra50.r.cloudfront.net

certify.alexametrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.241.169.29 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-241-169-29.us-west-2.compute.amazonaws.com

redirect.prod.experiment.routing.cloudfront.aws.a2z.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f14:600:6e00:77cb:3957:e000:1f7f (Boardman, United States)

ASN16509 (AMAZON-02, US)

aamapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.208.153.184 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-208-153-184.us-west-2.compute.amazonaws.com

aamcf.aamsitecertifier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.74.203 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 203.74.96.34.bc.googleusercontent.com

api.pymx5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::282 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.4.15 (United States)

ASN13335 (CLOUDFLARENET, US)

api-mg2.db-ip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f14:600:6e00:30b0:ae3e:5fa8:bc2c (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)

api-35-87-123-161.aamapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.101.221 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-101-221.fra50.r.cloudfront.net

d1wa9546y9kg0n.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.231.192.105 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

paywall-ad-bucket.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.87.123.161 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-87-123-161.us-west-2.compute.amazonaws.com

api-35-87-123-161.aamapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.236.186.217 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.167.164.51 (Denmark)

ASN198622 (ADFORM, DK)

a2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.130 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.234.21 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.220.145 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 78.46.90.238 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.238.90.46.78.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.157.6.236 (Denmark)

ASN198622 (ADFORM, DK)

s1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.157 (Hockenheim, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.157.63.201.138.clients.your-server.de

hal90007.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 145.239.193.130 (France) 2 redirects

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.198.250.30 (Mannheim, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88-198-250-30.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.236.13.147 (United Kingdom)

ASN12703 (PULSANT-AS, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.23.99.218 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip218.ip-94-23-99.eu

medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.176.197 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com

ad-server.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.239.217 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-217.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.5 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-5.fra50.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.72.0.164 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-0-164.eu-west-1.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prod-spokesman-proxy-connext.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	googlesyndication.com pagead2.googlesyndication.com 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com tpc.googlesyndication.com	750 KB
24	doubleclick.net 3 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	202 KB
14	google-analytics.com www.google-analytics.com	40 KB
13	matheranalytics.com 1 redirects js.matheranalytics.com www.i.matheranalytics.com	45 KB
11	spokesman.com 1 redirects www.spokesman.com thumb.spokesman.com static.spokesman.com	518 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net hal90007.redintelligence.net	57 KB
8	googletagservices.com www.googletagservices.com	293 KB
7	adform.net a2.adform.net s1.adform.net	99 KB
6	google.com www.google.com adservice.google.com	2 KB
5	aamapi.com 1 redirects aamapi.com api-35-87-123-161.aamapi.com	7 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com	4 KB
3	webgains.io analytics.webgains.io api.webgains.io	51 KB
3	medialead.de 3 redirects pv.medialead.de medialead.de	2 KB
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	ayc0zsm69431gfebd.xyz cdn.ayc0zsm69431gfebd.xyz	1 MB
3	cloudfront.net d31qbv1cthcecs.cloudfront.net d1wa9546y9kg0n.cloudfront.net	16 KB
3	azureedge.net loader-cdn.azureedge.net fp-cdn.azureedge.net g2insights-cdn.azureedge.net	108 KB
3	googletagmanager.com www.googletagmanager.com	149 KB
2	czx5eyk0exbhwp43ya.biz cdn.czx5eyk0exbhwp43ya.biz	42 KB
2	azurewebsites.net prod-spokesman-proxy-connext.azurewebsites.net	979 B
2	webgains.com track.webgains.com	3 KB
2	visualstudio.com dc.services.visualstudio.com	408 B
2	amazonaws.com paywall-ad-bucket.s3.amazonaws.com	2 KB
2	msecnd.net az416426.vo.msecnd.net	44 KB
2	pymx5.com pymx5.com api.pymx5.com	10 KB
2	aamsitecertifier.com aamcftag.aamsitecertifier.com aamcf.aamsitecertifier.com	26 KB
2	google.de www.google.de adservice.google.de	1 KB
1	googleapis.com fonts.googleapis.com	921 B
1	awin1.com www.awin1.com	704 B
1	ad-server.eu ad-server.eu	312 B
1	media01.eu pb.media01.eu	628 B
1	db-ip.com api-mg2.db-ip.com	909 B
1	sbgsodufuosmmvsdf.info cdn.sbgsodufuosmmvsdf.info	2 KB
1	polyfill.io polyfill.io	558 B
1	a2z.com redirect.prod.experiment.routing.cloudfront.aws.a2z.com	48 B
1	alexametrics.com certify.alexametrics.com	552 B
1	facebook.com www.facebook.com	295 B
1	circularhub.com api.circularhub.com	558 B
1	cloudengage.com h.cloudengage.com	377 B
178	39

	Domain	Requested by
25	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com googleads.g.doubleclick.net
17	securepubads.g.doubleclick.net	www.spokesman.com securepubads.g.doubleclick.net 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com www.googletagservices.com
14	www.google-analytics.com	www.googletagmanager.com www.spokesman.com az416426.vo.msecnd.net
13	pagead2.googlesyndication.com	www.spokesman.com securepubads.g.doubleclick.net tpc.googlesyndication.com 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
11	www.i.matheranalytics.com	www.spokesman.com
8	www.googletagservices.com	securepubads.g.doubleclick.net 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
7	static.spokesman.com	www.spokesman.com static.spokesman.com
5	www.google.com	www.spokesman.com tpc.googlesyndication.com securepubads.g.doubleclick.net 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
4	hal90007.redintelligence.net	1 redirects 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com hal90007.redintelligence.net
4	hal9000.redintelligence.net	6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com hal90007.redintelligence.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
4	a2.adform.net	6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com s1.adform.net
4	api-35-87-123-161.aamapi.com	1 redirects www.spokesman.com
3	s1.adform.net	a2.adform.net s1.adform.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	cdn.ayc0zsm69431gfebd.xyz	loader-cdn.azureedge.net cdn.ayc0zsm69431gfebd.xyz
3	6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	www.googletagmanager.com	www.spokesman.com www.googletagmanager.com g2insights-cdn.azureedge.net
2	cdn.czx5eyk0exbhwp43ya.biz	cdn.ayc0zsm69431gfebd.xyz
2	prod-spokesman-proxy-connext.azurewebsites.net	cdn.ayc0zsm69431gfebd.xyz
2	api.webgains.io	analytics.webgains.io
2	track.webgains.com	www.spokesman.com 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
2	pv.medialead.de	2 redirects
2	googleads.g.doubleclick.net	6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com www.spokesman.com
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	paywall-ad-bucket.s3.amazonaws.com	cdn.ayc0zsm69431gfebd.xyz
2	d1wa9546y9kg0n.cloudfront.net	cdn.ayc0zsm69431gfebd.xyz
2	az416426.vo.msecnd.net	loader-cdn.azureedge.net cdn.ayc0zsm69431gfebd.xyz
2	js.matheranalytics.com	1 redirects www.spokesman.com
2	thumb.spokesman.com	www.spokesman.com
2	www.spokesman.com	1 redirects
1	analytics.webgains.io	track.webgains.com
1	fonts.googleapis.com	hal90007.redintelligence.net
1	www.awin1.com	6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
1	ad-server.eu	6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
1	medialead.de	1 redirects
1	pb.media01.eu	hal90007.redintelligence.net
1	api-mg2.db-ip.com	fp-cdn.azureedge.net
1	g2insights-cdn.azureedge.net	loader-cdn.azureedge.net
1	fp-cdn.azureedge.net	loader-cdn.azureedge.net
1	cdn.sbgsodufuosmmvsdf.info	loader-cdn.azureedge.net
1	polyfill.io	loader-cdn.azureedge.net
1	api.pymx5.com	pymx5.com
1	aamcf.aamsitecertifier.com
1	aamapi.com	aamcftag.aamsitecertifier.com
1	redirect.prod.experiment.routing.cloudfront.aws.a2z.com
1	certify.alexametrics.com
1	www.facebook.com
1	pymx5.com	www.googletagmanager.com
1	aamcftag.aamsitecertifier.com	www.spokesman.com
1	d31qbv1cthcecs.cloudfront.net	www.spokesman.com
1	api.circularhub.com	www.spokesman.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	loader-cdn.azureedge.net	static.spokesman.com
1	www.google.de	www.spokesman.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	h.cloudengage.com	www.spokesman.com
178	59

This site contains links to these domains. Also see Links.

Domain
checkout.spokesman.com
myaccount.spokesman.com
twitter.com
www.facebook.com
www.reddit.com
triple9digital.com
www.legacy.com
pics.spokesman.com

Subject Issuer	Validity	Valid
spokesman.com Amazon	`2021-08-19` - `2022-09-17`	a year	crt.sh
*.cloudengage.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-27` - `2022-06-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
www.i.matheranalytics.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-28` - `2022-01-27`	2 years	crt.sh
www.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
sni22a5dgl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-08` - `2022-10-09`	a year	crt.sh
*.google.de GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
editorials.circularhub.com Amazon	`2021-08-07` - `2022-09-05`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.aamsitecertifier.com Amazon	`2021-06-28` - `2022-07-27`	a year	crt.sh
*.pymx5.com Go Daddy Secure Certificate Authority - G2	`2021-09-12` - `2022-09-10`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-25` - `2021-12-24`	3 months	crt.sh
certify.alexametrics.com Amazon	`2021-06-14` - `2022-07-13`	a year	crt.sh
*.prod.experiment.routing.cloudfront.aws.a2z.com Amazon	`2021-10-13` - `2022-11-11`	a year	crt.sh
aamapi.com Amazon	`2021-04-23` - `2022-05-22`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2020	`2021-06-04` - `2022-07-06`	a year	crt.sh
sni22a5egl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-08` - `2022-10-09`	a year	crt.sh
sni1e6ffgl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
sni1ad09gl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-01` - `2022-11-01`	a year	crt.sh
sni1ad03gl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-01` - `2022-11-01`	a year	crt.sh
sni9642gl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-02-20` - `2022-03-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-17` - `2022-06-16`	a year	crt.sh
*.aamapi.com R3	`2021-11-29` - `2022-02-27`	3 months	crt.sh
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-01-11` - `2022-02-11`	a year	crt.sh
in.applicationinsights.azure.com Microsoft RSA TLS CA 01	`2021-07-22` - `2022-07-22`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
redintelligence.net R3	`2021-10-21` - `2022-01-19`	3 months	crt.sh
*.media01.eu RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-05-27` - `2022-05-27`	a year	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-20` - `2022-06-20`	a year	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2021-06-11` - `2022-06-16`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.webgains.io Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh
*.azurewebsites.net Microsoft RSA TLS CA 02	`2021-07-07` - `2022-07-07`	a year	crt.sh
snibe7egl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-03-01` - `2022-03-31`	a year	crt.sh

This page contains 16 frames:

Primary Page: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Frame ID: 6EB3DEDA48F7EA9C1381D18B39256FEC
Requests: 84 HTTP requests in this frame

Frame: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E25A6788B3C88BE9245875FF5F89BC80
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 32250A5387A9FF72DFC54C0A3ACFFDBF
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 735D3AF65CFEE1FB9F63DE456DE1E310
Requests: 2 HTTP requests in this frame

Frame: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: CB3AF29E458FFF2A1F01FD43D7358BAC
Requests: 14 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvOGUBfIGFA-TD-WHwgupS3YQb8tRmiJ_P_OZoqsn91rUVuAGOWpTr9kSuvu2Zhxo6MZfEOgbO1yqsnrOnMXnFUcNicte2t4yHwyZi0wlhZ4cUimTFBbEEdTRBhD9a3YHXS0zto-9Ms2Os9AHzML5M3YtcRbIXQMN5jaVEPdiJjOM9p4tngcMgqjAXWQTmqgYZS7rCo3efTo9FtD1tzizRHgcl_TGIjqiJ1NlZGastvtsyMeZWPG3kWtyXN2-KzsBsDsbm-OcyH3Bsrooz-38w6Mmxi83YYABRmz19Q5WTsaEI8tMYR0BzwTcd5DJ1J5_ifaXeDHytVzk3BqbK6K7F4&sai=AMfl-YQolRFuZ8OY_YS7MYdKpSmTgMnHWTOdstA_UzgAu6D6aFu1ALDoJubdsvl8CYcS-L8L3svUQIs_kIkvLCOCg2HO3371V7e9YozfXxoYnwHunJagm5BWHDSWyvyZ9q0&sig=Cg0ArKJSzE3gu6HokU7MEAE&uach_m=[UACH]&adurl=
Frame ID: 9B71AA11E33ADDAD6117FAB0F1CD0A1E
Requests: 8 HTTP requests in this frame

Frame: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: AD43339890B2D8A7AA6A56DA1F2BFDAC
Requests: 18 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss1qul0npnSvxtS406yV10bbr6kR-_-Qg72oe04zgKa9FzVS2Lmmb6uBXV90jKIFAXf4gdfXZ7UUiTBgFTnFvRbZrsK3QLYSLV-P55Txan10Bz5he3hM5FSg_VMTmozoO2zmyMdnN7sSkghJpsll1CzXv9pr0sRk4mufaAcghqOl9M98uYGV7lVBD_o7YtP9gNuyTOwnLvTHHSJf90WyLVssJ-CvR-Fb8rxWBZyCZme2nRWLJLF9r0a0dVEPEHim0YHLCo8SnZgUcFshdsnUiRn7xmvfNNBUhr7PGL6L8_6DIPxJKDk4TCmgvwoLAdalj_aN81G5j4EVVQ&sai=AMfl-YRF911xbJAMcr0VpwhY98oOYjhU6UsulmkpSySh_MZtsBgPgsU2W_8PUq48w_kqwTJJfZSp7R6y4pyr8qa-vjTJlCKQEjufar2knmlBAnZXY6P8eZ1YWzMNAAZtNsw&sig=Cg0ArKJSzInsqWa8mts_EAE&uach_m=[UACH]&adurl=
Frame ID: FD7B396999A5435310860FDAF2F0067D
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuD7c_LuTbKlJclVXxD7f0jwfmTXtOWjRm8MxlCbJPLthiAk-igh2TF2-7Va-rvOaM8RAOPZD6ccJnb_J5F1w2FcKgQETDk9ZoOJb__mKKWVaxninky3-u-uj659MccumcO2Fq5kp2H4_-2o_Q4dfZXxa5y2pk7lz6-4oZoNO7K5yWPv0HopvdUmXLqHtXTveLO7q3AgWrwhOQc05OrG2tCOUDrBW6B497d6JN8O6SDmClKXzd21fUmRLTYEIFTov5eEsxJOs1DmzplYIYfZUVjfCkcaiGrY0o8jg2gOkIXYcQPcGcpX6_Aitpv_o2GGxs_k-8P40IL7ahw4QEwr5g&sai=AMfl-YSgnl6XjAPLT-ibwn0bj6LweSLgRpUWwzl4HqtjUrhb3eL_xCcrXK9YPVNvZed9zxKJ-LiZ3zGUuBx7pAPX4KNd-eTikjnFpH0I-sdvXr60warlfDVtla5sW-QHJc8&sig=Cg0ArKJSzLJu6V1_FdyKEAE&uach_m=[UACH]&adurl=
Frame ID: 6FE90571BFE24FE76FA1058ED4DB0234
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv2crjiyiWZSVebmLYk146QfKukG-MrNpJC9nHnU9jsqrRUYEkH9-GvpQ3rMf87JnPrCiRqp0axZsjfx2NNmBC0beRuFa6K_cMQbC8wLMRWJJk9zszGozV-Rf-yUnQ_cm2XxVAAfAJeVaCVmtdKeA6tKvVVH7jd4_C3Qu4aX0A0Q_4YDVUQsnMHhLLxjqD8ILRZDo0nSQbrMHvPJ6UU6Q72LQYgL5SfemoKTaoVlsRwmtCk1R0W9BV_DbEKqr4MBJOQq79vMDyik-MfePwysgIS8ngTQfjZ_uvAejSgRvHXvawkv8zBC2Ijf0e1RtMaK3uoRaypI5Q0jyF1jGvVSpyEMfoXlmk&sai=AMfl-YQwCmmoBzbykwmWjIBcr3HfnnbpJn9EjP48M9wmoENNYsrU3iVIglqa52-x5XAoSLLvSlesa0Zczbwj4VrCe7z3oMlY1-8AAaaarv2z6Lz91deUva1dbFCs29Fuu9g&sig=Cg0ArKJSzBrTG4o2LMeDEAE&uach_m=[UACH]&adurl=
Frame ID: 8BB3CDB04C794ECF20728DA934CF9695
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvI8fDWQZlYEmfi2QoD4_OvgZIF9WkN4NlGdSqOwWH3jia_aUne06Y2VQo7CahbYnvH8cQ_YiwwaLgCLsOxTY4nyHPH4KEKyze1Fd9hRFx9xWzqJiKQ_TS0_1wHTftBDcz5IwCNW8loZ282A7R5Z7Cw6RM6Aw99NKERN_Y4jwjt5TV3N6enBAddqVY9ZNEqIyKpcBCZH2osfz8MorE1UBcIHYxF72juej2diypji-R51I1GEUTVqFx5-4mMVEpXXF0-sLMtvWu1P6RsTg0DQA2NX27QYzy-j_Z6UmTIEGMJwd6J6hi7CilENfWVQcDlW20AKt2faAFEvml7vqqpsQemYFw&sai=AMfl-YTcj17qxm-HyR6suXxUQ-swTMLQjTjFRRPmc7nRa4OjcFjhAop8XABYF7TfHMF33Dd0xrchNLUC6XcUxDNt3oCN4RKtbvZCZmJlRxbMhR-_TJ9zpGLArIaRCwqvH6Y&sig=Cg0ArKJSzMfxZQXBGpjyEAE&uach_m=[UACH]&adurl=
Frame ID: 800A9B61D4C5B276839A268F41556995
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvIFUcHF0-9YgGbiik1MnZ6-JF3mOpvF0rPze1aOnXX_ZS5vVKBEFIQ3o2m4yTqKHuqSb_34fQRO-sAHyB9f4JMfBj-NGFHOh95luOPCfbbDIfKw7W2L_vwdbT1dovSNM-RdaKTtr_2bHRWsgX4HXm783BFfb823IjSENEt0JitK2K_SAPjl3ZVazqDXD2Bmbz1JpuqY54CTDPeJ1gzTy9LvK088KHU9xTJK8wWP3fQTvSb_gG9ZWRPvKtN2bhx_LbEvYTYK3tFkd9MpnUwIiQbmei-7NPy9lIjIw6LLMU6XIIWY-wdIsZ8Hvn-xB2SPGH14QsUBaMF5TcC_GIeJQ&sai=AMfl-YQWD85PxjmQ9HP62FF2AqqLo1qgO0-vIDSRY1R_Ui-5FumOQNW3qYdrAhMF3P7C7C80p6snCSQ_ZdZo-bmXY668yslicNBpVnkA1Cf1-XCMRle3oAJ5HKGEXVjNYtQ&sig=Cg0ArKJSzNsLqLLxW1UgEAE&uach_m=[UACH]&adurl=
Frame ID: EB1505DBB23C641B74D5ECBDA69F48CB
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNW-QZw4Tz33LCoZgR33B3Fi_bqXGLgGaZ5gQkAJGTQaLUzKuS_BP21ygep68mRwu6rjg9HXOyGlrBbBxN_dKHifbcHgMeVFl5PGhcsU2dvCG9agGqRyIPwJfTWORz7_af27hLTUpcFqbbOWw_b_SPZ_Lr23_M6bi4dXAih4ZKtZbis6pyQ
Frame ID: 048155DF7BB6E6F64428952127E50BE7
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: FD960E1807EB3FDAD6F633A7A3B5C5E7
Requests: 3 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22880800092894300710580011810007&actionid=879111&produktid=ratenkredit&dt_url=
Frame ID: 15BAD1D2898EE933C38B3588AE072676
Requests: 1 HTTP requests in this frame

Frame: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1
Frame ID: 2A30B9B7E9128443D15C24719BD44E2C
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Will Bunch: Nothing is more important than Team Trump's January PowerPoint urging a full-blown coup | The Spokesman-ReviewArrow-rightCameraThe Spokesman-Review NewspaperThe Spokesman-Review NewspaperThe Spokesman-ReviewThe Spokesman-Review NewspaperCloseClose

Page URL History Show full URLs

http://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/ HTTP 301
https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

178
Requests

96 %
HTTPS

40 %
IPv6

39
Domains

59
Subdomains

52
IPs

8
Countries

3783 kB
Transfer

8376 kB
Size

38
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=header
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/Home?SiteCode=SR
Title: My account

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/
Title: Log in

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=default
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/
Title: Subscribe now

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup&url=https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/dialog/share?href=https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/&app_id=316254480466&redirect_uri=https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/&caption=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/&title=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup
Title: Reddit

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/DigitalOnly?ofrgp_id=670&zipcode=00000&g2i_or_o=Internet&g2i_or_p=5175&g2i_source=InlineIM&g2i_medium=FTVB&g2i_campaign=Engage&G2I_ActionId=101218&returnUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F%3FclearUserState%3Dtrue
Title: Subscribe now

Search URL Search Domain Scan URL

URL: https://www.facebook.com/spokesmanreview/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/SpokesmanReview
Title: Twitter

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?stateInfo=&source=external
Title: Print edition home delivery

Search URL Search Domain Scan URL

URL: https://triple9digital.com/
Title: Triple-Nine Digital

Search URL Search Domain Scan URL

URL: https://www.legacy.com/obituaries/spokesman/
Title: Obituaries

Search URL Search Domain Scan URL

URL: https://pics.spokesman.com/
Title: Buy photo reprints

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/DigitalOnly?ofrgp_id=670&zipcode=00000&g2i_or_o=Internet&g2i_or_p=5175&g2i_source=1stArticleBannerIM&g2i_medium=FTVB&g2i_campaign=Engage&G2I_ActionId=101219&returnUrl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F%3FclearUserState%3Dtrue
Title: Subscribe for access

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/ HTTP 301
https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1581 HTTP 301
https://js.matheranalytics.com/static/ltm/ma20153/575681700/18/ml.br.js

Request Chain 61

https://api-35-87-123-161.aamapi.com/api/x?BPBqHdYu4haAQDAd$dXJsJDAkaHR0cHM6Ly93d3cuc3Bva2VzbWFuLmNvbS9zdG9yaWVzLzIwMjEvZGVjLzE2L3dpbGwtYnVuY2gtbm90aGluZy1pcy1tb3JlLWltcG9ydGFudC10aGFuLXRlYW0tdHJ1LyIsInJlZmVycmVyJDAkIiwiYW5jZXN0b3JPcmlnaW5zJDAkIiwidmlkZW8kMCQxNjAweDEyMDB4MjQiLCJmcmFtZSQwJDAiLCJoaWRkZW4kMCQwIiwidmlzaWJpbGl0eVN0YXRlJDAkdmlzaWJsZSIsImhhc0ZvY3VzJDAkMSIsIndpbmRvdyQwJDE2MDB4MTIwMCIsImlubmVyJDAkMTYwMHgxMjAwIiwib3V0ZXIkMCQxNjAweDEyMDAiLCJsb2NhbFN0b3JhZ2UkMCQxIiwic2Vzc2lvblN0b3JhZ2UkMCQxIiwiYXBwQ29kZU5hbWUkMCRNb3ppbGxhIiwiYXBwTmFtZSQwJE5ldHNjYXBlIiwiYXBwVmVyc2lvbiQwJDUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTYuMC40NjY0LjkzIFNhZmFyaS81MzcuMzYiLCJjb29raWVFbmFibGVkJDEkdHJ1ZSIsImRvTm90VHJhY2skMSQiLCJoYXJkd2FyZUNvbmN1cnJlbmN5JDEkNCIsImxhbmd1YWdlJDEkZW4tVVMiLCJwbGF0Zm9ybSQxJExpbnV4IHg4Nl82NCIsInByb2R1Y3QkMSRHZWNrbyIsInByb2R1Y3RTdWIkMSQyMDAzMDEwNyIsInNlbmRCZWFjb24kMSQxIiwidXNlckFnZW50JDEkTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk2LjAuNDY2NC45MyBTYWZhcmkvNTM3LjM2IiwidmVuZG9yJDEkR29vZ2xlIEluYy4iLCJ2ZW5kb3JTdWIkMSQiLCJmb250cmVuZGVyJDEkMSIsIndlYmdsJDUkMSIsInRpbWUkNSQxNjM5NjU5MDYxNjE4IiwidGltZXpvbmUkNSQwIiwicGx1Z2lucy10aW1lJDYkMC4xIiwicGx1Z2lucyQ2JGI2ZDA1NTU4IiwibWVtLXRvdGFsSlNIZWFwU2l6ZSQ2JDEwIiwibWVtLXVzZWRKU0hlYXBTaXplJDYkMTAiLCJtZW0tanNIZWFwU2l6ZUxpbWl0JDYkMzc2MCIsInRpbWUtZmlyc3RQYWludCQ2JDQyMyIsInRpbWUtZmV0Y2hTdGFydCQ2JDI2IiwidGltZS1kb21haW5Mb29rdXBTdGFydCQ2JDI2IiwidGltZS1kb21haW5Mb29rdXBFbmQkNiQyNiIsInRpbWUtY29ubmVjdFN0YXJ0JDYkMjYiLCJ0aW1lLWNvbm5lY3RFbmQkNiQ0OSIsInRpbWUtc2VjdXJlQ29ubmVjdGlvblN0YXJ0JDYkMzMiLCJ0aW1lLXJlcXVlc3RTdGFydCQ2JDQ5IiwidGltZS1yZXNwb25zZVN0YXJ0JDYkMjIzIiwidGltZS1yZXNwb25zZUVuZCQ2JDIyOSIsInRpbWUtZG9tTG9hZGluZyQ2JDIyNiIsInRpbWUtZG9tSW50ZXJhY3RpdmUkNiQ0NTQiLCJ0aW1lLWRvbUNvbnRlbnRMb2FkZWRFdmVudFN0YXJ0JDYkODU0IiwidGltZS1kb21Db250ZW50TG9hZGVkRXZlbnRFbmQkNiQ4NTQiLCJ0aW1lLWRvbUNvbXBsZXRlJDYkMTI5NyIsInRpbWUtbG9hZEV2ZW50U3RhcnQkNiQxMjk3IiwidGltZS1sb2FkRXZlbnRFbmQkNiQxMjk4IiwibmF2aWdhdGlvbi1yZWRpcmVjdENvdW50JDYkMCIsIm5hdmlnYXRpb24tdHlwZSQ2JG5hdmlnYXRlIiwiZ2xvYmFscy10aW1lJDE2JDAuMyIsImdsb2JhbHMkMTYkNDBlYTA2ODciLCJkb2N1bWVudC10aW1lJDIyJDAuNSIsImRvY3VtZW50JDIyJDU2MGZmNDE0IiwiY29ubmVjdGlvbiQyMiQiLCJkb3dubGlua01heCQyMiQiLCJnZXRVc2VyTWVkaWEkMjIkMiIsImNsb2NrJDI2JDU4MzYiLCJiYXR0ZXJ5JDI5JDEgMSAwIEluZmluaXR5IiwiaW50ZXJzZWN0aW9uLXNpemUkMzEkMTYwMHgxMjAwIiwiaW50ZXJzZWN0aW9uJDMxJDI3IiwiYXVkaW9jb250ZXh0JDMyJGY3ZTcxMmQ5Iiwic29ydCQ2MCQxMS42IiwiZnJhbWVyYXRlJDE2MSQ3MA HTTP 302
https://api-35-87-123-161.aamapi.com:444/api/4?BPBqHdYu4haAQDAd

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1

Request Chain 123

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Ybs2NpTxL6NV280fo-f2kgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1

Request Chain 124

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEBFQ6QAr-X0V-qW4DkScK5o&google_cver=1

Request Chain 125

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc4ODQ0NjQ1MjcxODQ5NjQ1MQ%3D%3D

Request Chain 140

https://hal90007.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLUf-NDa7YcfHNrK5lQf5vbfgAo_g-IZT_bGLpMoM8C4QASDDoPwBYJXikIKgB8gBCakCLN9BhWL7sj6oAwGqBJkCT9CAEItFPl71b8BMMPVXTYsnmnfJXTfG-Zi2lDCZTLY-itQKhJLIoTEKRFMWxc5fwxMsbI387VIWH3IeBRM4hlDanmxHWyBeadj2sUDDwaRtYhF0UGS37yYSsKqeHMEsOCw5s1CRrMUoxjPaXM_O9DzglqgPJtpBfjcGfaRKbDbcx5x0h1_LBSl7QHnIcHwDSsppw0IxQUrbOO_qrO0GzA6vVOPJZz2j8LrIskJzPy8JHSVF0ginqaIUI1R2lDgtPW0J0ylPWG9LNIJgIaCg-TKciW_3QcWO0UhrWJlaIMddOvm4fdaaBmu-R1I3750aZsweJOP-c6HQwhfxt92PyKJaeIOymv7oBmQP3862gH2UtRgZfhPtxX7ABLvxqMDPAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA%26sig%3DAOD64_10H-l_OckTO2Oyv6rSY0sXDbgWzQ%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-Aizz2NA6wlG4dPrrp6WJqAeaXIZ4uet3VFLIGZiVgsKHeBaR-y-v8Zu0PEGurT64blRfCJyVXi1eeWR5Z6Wdl-4RgoZ64uTcSJNcjHMc4qn457quZTbyFhxQy_T-FlO7tU5M-OQIrk3C2qg9S3hgfHzS9RCA%26cry%3D1%26dbm_d%3DAKAmf-CXrExPXgC5MLHg2PfXFHJtAPhYg0ZSvisgwcrrnxZZRauUn7HzkNBsshuPXNbOU3BexkwV7_1uV1-Iz5tCaa2d-kgO2bXN7xND1_zF-LWDAhklxTkyJgy1N-l1fhQDbfrKHOlmN5B2HckDhKGNjJZ2R5v5pYR2381F3ox3s7jALx5GGAy6-grLAIaLBONz0Ok8dBcTZ1Igra99SEBlg7WpRYHO2OJrLnuIsfv68M_nkEgQV6n8VIdJjYEREIZsWu3k258b36xmuHw5eBW7VSfLbMcAc-d9iJURDeUbYAvk9am3GSeWRPnxnRf-PqeI3-JRwFSdHWJ_N0ZuqVUqA1Mib2TEy5f9xk9hwssg3L0OoSXFtJHyS19cHGIW-0LH2ay9MIQdYS55JtZqnDOXMpowzuksoSfqfQrKi1fHUCXMzHav1-Vqr15rxAwSqN8cDFSVBUkjc1ZXRY3UJKklmicnyp9dqEuarEpGI_2tgxocRoeRUsDwJIMh6ovxScQoY_jwoaqzBhepFL0yx0A-x9JR15y1jb1w64gzUunn67JvLwV6W6o%26adurl%3D&documentReferer=https%3A%2F%2Fwww.spokesman.com%2F&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=381556123018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90007.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLUf-NDa7YcfHNrK5lQf5vbfgAo_g-IZT_bGLpMoM8C4QASDDoPwBYJXikIKgB8gBCakCLN9BhWL7sj6oAwGqBJkCT9CAEItFPl71b8BMMPVXTYsnmnfJXTfG-Zi2lDCZTLY-itQKhJLIoTEKRFMWxc5fwxMsbI387VIWH3IeBRM4hlDanmxHWyBeadj2sUDDwaRtYhF0UGS37yYSsKqeHMEsOCw5s1CRrMUoxjPaXM_O9DzglqgPJtpBfjcGfaRKbDbcx5x0h1_LBSl7QHnIcHwDSsppw0IxQUrbOO_qrO0GzA6vVOPJZz2j8LrIskJzPy8JHSVF0ginqaIUI1R2lDgtPW0J0ylPWG9LNIJgIaCg-TKciW_3QcWO0UhrWJlaIMddOvm4fdaaBmu-R1I3750aZsweJOP-c6HQwhfxt92PyKJaeIOymv7oBmQP3862gH2UtRgZfhPtxX7ABLvxqMDPAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA%26sig%3DAOD64_10H-l_OckTO2Oyv6rSY0sXDbgWzQ%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-Aizz2NA6wlG4dPrrp6WJqAeaXIZ4uet3VFLIGZiVgsKHeBaR-y-v8Zu0PEGurT64blRfCJyVXi1eeWR5Z6Wdl-4RgoZ64uTcSJNcjHMc4qn457quZTbyFhxQy_T-FlO7tU5M-OQIrk3C2qg9S3hgfHzS9RCA%26cry%3D1%26dbm_d%3DAKAmf-CXrExPXgC5MLHg2PfXFHJtAPhYg0ZSvisgwcrrnxZZRauUn7HzkNBsshuPXNbOU3BexkwV7_1uV1-Iz5tCaa2d-kgO2bXN7xND1_zF-LWDAhklxTkyJgy1N-l1fhQDbfrKHOlmN5B2HckDhKGNjJZ2R5v5pYR2381F3ox3s7jALx5GGAy6-grLAIaLBONz0Ok8dBcTZ1Igra99SEBlg7WpRYHO2OJrLnuIsfv68M_nkEgQV6n8VIdJjYEREIZsWu3k258b36xmuHw5eBW7VSfLbMcAc-d9iJURDeUbYAvk9am3GSeWRPnxnRf-PqeI3-JRwFSdHWJ_N0ZuqVUqA1Mib2TEy5f9xk9hwssg3L0OoSXFtJHyS19cHGIW-0LH2ay9MIQdYS55JtZqnDOXMpowzuksoSfqfQrKi1fHUCXMzHav1-Vqr15rxAwSqN8cDFSVBUkjc1ZXRY3UJKklmicnyp9dqEuarEpGI_2tgxocRoeRUsDwJIMh6ovxScQoY_jwoaqzBhepFL0yx0A-x9JR15y1jb1w64gzUunn67JvLwV6W6o%26adurl%3D&documentReferer=https%3A%2F%2Fwww.spokesman.com%2F&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=381556123018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 145

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=22880800092894300710580011810007&t=htlp HTTP 301
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22880800092894300710580011810007&actionid=879111&produktid=ratenkredit&dt_url=

Request Chain 148

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22880800092894300710580011810007 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22880800092894300710580011810007 HTTP 301
https://ad-server.eu/wm/pb/native.png

178 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Redirect Chain

http://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

114 KB
37 KB

197ms
174ms

Document
text/html

2600:9000:2156:e800:0:b5fb:e6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:e800:0:b5fb:e6c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx/1.20.2 /

Resource Hash

11a0443fb3a3eccb14c0325c8aa4d86e72f3855007bb5055f23012f956e65c20

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

content-type: text/html; charset=utf-8
date: Thu, 16 Dec 2021 12:48:15 GMT
server: nginx/1.20.2
cache-control: max-age=900
x-frame-options: SAMEORIGIN
x-amzn-trace-id: Root=1-61bb358f-4464af694a16143c3b1074a7
content-encoding: gzip
vary: Accept-Encoding,Cookie
x-cache: Miss from cloudfront
via: 1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 1nqzK_LTg4-hDjDKtal7zYYXglR2rz8blXo03HOM_kXF0vYKkn2ucg==
age: 164

Redirect headers

Server: CloudFront
Date: Thu, 16 Dec 2021 12:50:59 GMT
Content-Type: text/html
Content-Length: 183
Connection: keep-alive
Location: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
X-Cache: Redirect from cloudfront
Via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA50-C1
X-Amz-Cf-Id: 9ddyBCXKXaT-0YdpdwQ7gbz3reJLBmVWYv7Yxds5iSGCpXaADNxLdg==

GET
H2 200 sr-loader.png
thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/ 11 KB
12 KB 68ms
11ms Image
image/webp 2600:9000:2156:a00:2:4597:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/sr-loader.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a00:2:4597:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Thumbor/6.7.5 /
Resource Hash: ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 11:20:36 GMT
via: 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront)
server: Thumbor/6.7.5
age: 5446
etag: "7b6592542ec6d8d4377eb143251c2f5b7d76aad9"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31104000,public
x-amz-cf-pop: FRA50-C1
content-length: 11662
x-amz-cf-id: Y4pZ7J-k0sFU-hICH66ekgFtMB1BdflRfQfxOLWAIZ2XJJk0aIPF7w==
expires: Sun, 11 Dec 2022 11:20:13 GMT

GET
H2 200 style.min.c8faad9a2adf.css
static.spokesman.com/sv3/css/ 183 KB
33 KB 73ms
12ms Stylesheet
text/css 2600:9000:2156:1e00:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/sv3/css/style.min.c8faad9a2adf.css
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ce42122da81bb58d308f8023f9594aada0107c8fe7e35666e8aee7671263f130

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 15 Dec 2021 18:18:37 GMT
content-encoding: gzip
last-modified: Wed, 15 Dec 2021 18:13:18 GMT
server: AmazonS3
age: 66744
etag: W/"c8faad9a2adfe97d2fafe8b2a5b30df7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control: max-age=31536000,public
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 4LWKMT4j82A4_iYdnUdng8LCRCAxFMCQmE9Rex5F6uBwz8GJvuqeBg==

GET
H2 200 jquery.min.12b69d0ae6c6.js Show response
static.spokesman.com/js/ 87 KB
31 KB 12ms
12ms Script
application/javascript 2600:9000:2156:1e00:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/js/jquery.min.12b69d0ae6c6.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 07:27:44 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 04:43:01 GMT
server: AmazonS3
age: 19397
etag: W/"12b69d0ae6c6f0c42942ae6da2896e84"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control: max-age=31536000,public
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: d0icBasWp91HjUZ_QCm9p_LXgCeqbT5a262RZj9goHwESrhaXxZRmw==

GET
H2 200 critical.min.7f719ef7842f.js Show response
static.spokesman.com/sv3/js/ 21 KB
7 KB 9ms
9ms Script
application/javascript 2600:9000:2156:1e00:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/sv3/js/critical.min.7f719ef7842f.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5ba65148259568967389d182b434f97e0da7b6cd83abf926a602433a340ca9d0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 00:51:45 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 22:59:27 GMT
server: AmazonS3
age: 43156
etag: W/"7f719ef7842f474e36e669c95955f7b0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control: max-age=31536000,public
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: SvvbDysHFaLWsZllwSqFJ93vqErw_edKiXjIhC_uwyHmWvaEll0WEA==

GET
H/1.1 200
OK get-ce.min.js Show response
h.cloudengage.com/ 8 B
377 B 514ms
160ms Script
application/javascript 52.143.76.118
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.cloudengage.com/get-ce.min.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.143.76.118 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: d80d605ac45ef2fe7e5520d71cce9d00137b1e7b5a874951f10c5760bf2a8f97

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:50:59 GMT
Last-Modified: Mon, 08 Feb 2021 23:12:19 GMT
Server: nginx
ETag: "6021c553-8"
Content-Type: application/javascript; charset=utf-8
Expires: Thu, 16 Dec 2021 12:50:58 GMT
Cache-Control: no-cache, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8
X-UA-Compatible: IE=Edge

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 151ms
65ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

1907478e8fa62801a1db26be87cab0755288131c9c8e80320582e560825df3cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1072 / 644 of 1000 / last-modified: 1639397097"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26912
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 16 Dec 2021 12:51:00 GMT

GET
H2 200 base_ads.70805c56199e.js Show response
static.spokesman.com/ads/spokesman/ 9 KB
3 KB 10ms
9ms Script
application/javascript 2600:9000:2156:1e00:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/ads/spokesman/base_ads.70805c56199e.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: df6bea60b20cec5c038b730e3f0e6fd8bfa345641320b65e4efeeefc86071a91

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 07:27:45 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 04:41:33 GMT
server: AmazonS3
age: 19396
etag: W/"70805c56199eab23817d0a71b94a7e46"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control: max-age=31536000,public
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: LLpAcPxXm8yknmqQTLSCEO79q8XQIXSYHY1MXid2SiLqKDOu-iJdeQ==

GET
H2 200 0-fog.35922d3150bc.png
static.spokesman.com/sv3/img/weather/header-icons/ 12 KB
12 KB 11ms
10ms Image
image/png 2600:9000:2156:1e00:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.spokesman.com/sv3/img/weather/header-icons/0-fog.35922d3150bc.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6f2a4c20e0c0ecea553428a17fa567ad691d9f490fa3469da05631d48e2f4e43

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 15 Dec 2021 20:44:45 GMT
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
last-modified: Sat, 11 Dec 2021 00:48:06 GMT
server: AmazonS3
age: 57976
etag: "35922d3150bc8f0ab9620a168162f8fd"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000,public
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 11873
x-amz-cf-id: 1wr2SZYYJp2wtUQgUsFM2NzRDwY-XtnsNlowxctNrqmZ5ym57SVh_Q==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 116 KB
43 KB 146ms
60ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

50cbf3c9c403a5aea1e1c68a552c71f1e68b280a23e745cd9062f28ca44961c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:00 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43401
x-xss-protection: 0
last-modified: Thu, 16 Dec 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 16 Dec 2021 12:51:00 GMT

GET
H2 200 Dani_Rice_and_son.jpg
thumb.spokesman.com/lbLIjuDYFQB9c7h_0wgeE-tBEEE=/300x169/smart/media.spokesman.com/photos/2021/12/14/ 18 KB
18 KB 12ms
12ms Image
image/webp 2600:9000:2156:a00:2:4597:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.spokesman.com/lbLIjuDYFQB9c7h_0wgeE-tBEEE=/300x169/smart/media.spokesman.com/photos/2021/12/14/Dani_Rice_and_son.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:a00:2:4597:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Thumbor/6.7.5 /
Resource Hash: fa2561995f678d73840c1a264d6a697fda76e56f75cd53e5d73615e2196172dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 15 Dec 2021 22:44:14 GMT
via: 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront)
server: Thumbor/6.7.5
age: 51636
etag: "7e39fb205b9d1cd28bdb4b0334baf8d1ef57506b"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31104000,public
x-amz-cf-pop: FRA50-C1
content-length: 18402
x-amz-cf-id: Qx4poo3JIuCZg5sbtFbIm9hUXLrebUvFGz_3Q01Y8OE8zWmWwi1n1g==
expires: Sat, 10 Dec 2022 22:30:24 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 167 KB
61 KB 56ms
56ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ba390adb5583a9ead715ce663f3bc825ab927b3764d8bd18dceec2361aa35d8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:00 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62431
x-xss-protection: 0
expires: Thu, 16 Dec 2021 12:51:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 126ms
39ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4566
date: Thu, 16 Dec 2021 11:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 16 Dec 2021 13:34:54 GMT

GET
H2

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma20153/575681700/18/
Redirect Chain

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1581
https://js.matheranalytics.com/static/ltm/ma20153/575681700/18/ml.br.js

144 KB
42 KB

16ms
15ms

Script
application/x-javascript

107.178.250.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma20153/575681700/18/ml.br.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Server: 107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: c6b85e7d83cf8c2916b4f7c92240774ee63487975ab6fd96e56d9356fe92d2fa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 11:31:40 GMT
content-encoding: br
last-modified: Mon, 06 Dec 2021 03:34:26 GMT
server: nginx
age: 4760
etag: "5857578e6afc636b2cf9ae7757e586f9"
vary: Accept-Encoding
x-cache: HIT Mon, 06 Dec 2021 03:45:06 GMT
content-type: application/x-javascript
via: 1.1 google
cache-control: public,max-age=3600
alt-svc: clear
content-length: 42938

Redirect headers

date: Thu, 16 Dec 2021 12:51:00 GMT
via: 1.1 google
server: nginx
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/ltm/ma20153/575681700/18/ml.br.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 4-gc-euw1-10923

POST
H2 204 collect
www.google-analytics.com/g/ 0
173 B 46ms
46ms Ping
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=2oec10&_p=1102132370&sr=1600x1200&ul=en-us&cid=1238470572.1639659060&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup&sid=1639659060&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&ep.author=Will%20Bunch&ep.primary_category=syndicated-columns&ep.publish_datetime=2021-12-16&epn.object_id=986067&ep.content_type=story
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.spokesman.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 430ms
101ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&artid=986067&artpubt=1639641600&artsrc=Philadelphia%20Inquirer&arttype=metered&artupt=1639622365&auth=Will%20Bunch&hier=Opinion%7CSyndicated%20columns&ptype=story&prem=metered&pubname=The%20Spokesman-Review&sec=Opinion&wrdcnt=1244&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=24e1fdd6-188b-4526-9a83-a62efee62f7f&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659060382&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4471&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTYzOTY1OTA1OTcxMCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxMG1iIiwiaGVhcFQiOiIxMG1iIiwiZnN0UGFpbnQiOiI0MjMiLCJmZXRjaFMiOiIyNiIsImRvbWFpblMiOiIyNiIsImRvbWFpbkUiOiIyNiIsImNvbm5TIjoiMjYiLCJjb25uRSI6IjQ5Iiwic3NsUyI6IjMzIiwicmVxdVMiOiI0OSIsInJlc3BTIjoiMjIzIiwicmVzcEUiOiIyMjkiLCJkb21Mb2FkIjoiMjI2IiwiZG9tSW50ZXIiOiI0NTQifSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiIxMjM4NDcwNTcyIiwicmVmVGltZSI6IjE2Mzk2NTkwNjAzODEifV0sImNhdGVnb3J5Ijp7ImNhdGVnb3JpZXMiOltbIlN5bmRpY2F0ZWQgY29sdW1ucyJdXX19
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:00 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
444 B 56ms
18ms XHR
text/plain 2a00:1450:400c:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-230256-14&cid=1238470572.1639659060&jid=1904534492&gjid=845232442&_gid=1344418452.1639659060&_u=YCDAiEABBAAAAE~&z=948383734

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.spokesman.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 16 Dec 2021 12:51:00 GMT
content-type: text/plain
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 85ms
39ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABB~&jid=1904534492&gjid=845232442&cid=1238470572.1639659060&tid=UA-230256-14&_gid=1344418452.1639659060&gtm=2wgc105P9SH6&cd1=Will%20Bunch&cd2=syndicated-columns&cd5=2021-12-16&cd7=Opinion&cd8=986067&cd9=story&z=52556976

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22073
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 155ms
70ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-230256-14&cid=1238470572.1639659060&jid=1904534492&_u=YCDAiEABBAAAAE~&z=341854269

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 154ms
72ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-230256-14&cid=1238470572.1639659060&jid=1904534492&_u=YCDAiEABBAAAAE~&z=341854269

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_2021120601.js Show response
securepubads.g.doubleclick.net/gpt/ 348 KB
117 KB 102ms
54ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119476
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 09:34:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 16 Dec 2021 12:51:00 GMT

GET
H2 200 noncritical.min.fd4903f5fe80.js Show response
static.spokesman.com/sv3/js/ 1017 KB
363 KB 9ms
9ms Script
application/javascript 2600:9000:2156:1e00:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/sv3/js/noncritical.min.fd4903f5fe80.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4e7151e825c0212319858a5b8c145ffdc1ad5900186e8551b4c673b91e48dbf4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 06:09:59 GMT
content-encoding: gzip
last-modified: Tue, 14 Dec 2021 04:44:05 GMT
server: AmazonS3
age: 24062
etag: W/"fd4903f5fe8078ac472d6298815c7ef5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control: max-age=31536000,public
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: RQEdo0Z3Sg8SxQNXouB_L3oTJLzFzcM4pVB_4QBMPO_fBe00NoX8SQ==

GET
H2 200 loader.min.js Show response
loader-cdn.azureedge.net/prod/spokesman/ 42 KB
12 KB 65ms
9ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/sv3/js/noncritical.min.fd4903f5fe80.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F10) /
Resource Hash: 9938ce63ddec630645e903bede29aacb1541c88fa2179097ae2513502cd0c8a1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:00 GMT
content-encoding: gzip
content-md5: NLGw43qr7RAjJbL7IjQ5SQ==
age: 12806
x-cache: HIT
content-length: 11867
x-ms-lease-status: unlocked
last-modified: Tue, 07 Dec 2021 09:14:53 GMT
server: ECAcc (frc/8F10)
etag: 0x8D9B96207AD07FC
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 39f1d8d7-301e-0021-215d-f24b4e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 ros.json Show response
static.spokesman.com/ads/spokesman/ 3 KB
1 KB 32ms
10ms XHR
application/json 2600:9000:2156:1e00:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/ads/spokesman/ros.json
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/ads/spokesman/base_ads.70805c56199e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a2d874e8985a0ffde7abfe1926fed77ea6e11356ff45782d305e976721eb94b0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 04:39:41 GMT
content-encoding: gzip
vary: Origin
age: 29480
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.spokesman.com
last-modified: Mon, 13 Dec 2021 20:56:48 GMT
server: AmazonS3
etag: W/"7d12f3c013736986f185e50468eb7d4d"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/json
via: 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
cache-control: max-age=31536000,public
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: -aSbXlXLZeKoS58sqWO0-AOabqlndByQAxpRK24UELJJhsIrNGLgKA==

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
442 B 175ms
89ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_not_reserved&pvsid=834795588956593&vrg=2021120601&nw_id=1009641&nslots=8&eid=31060838%2C31063378%2C31063914&pub_url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&inViewport=true&depth=1

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 134ms
46ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.spokesman.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 133ms
47ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.spokesman.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 306 KB
42 KB 1394ms
1394ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=834795588956593&correlator=2955456392520439&output=ldjh&impl=fifs&eid=31060838%2C31063378%2C31063914&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211216&iu_parts=1009641%2CSpokesmanDesktop_News_Top_728x90%2CSpokesmanDesktop_ROS_Catfish_728x90%2CSpokesmanDesktop_News_Footer_728x90%2CSpokesmanDesktop_InStory_728x90%2CSpokesmanDesktop_News_Top_300x250%2CSpokesmanDesktop_News_Dashboard_300x250%2CSpokesmanDesktop_News_Middle_300x250%2CSpokesmanDesktop_SideRail_100x525&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8&prev_iu_szs=728x90%2C728x90%2C728x90%2C728x90%2C300x600%7C300x250%2C300x250%2C300x250%2C100x525&cookie_enabled=1&bc=31&abxe=1&lmt=1639659060&dt=1639659060822&dlt=1639659059936&idt=820&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C436%2C436%2C254%2C1236%2C1236%2C1236%2C1500&adys=173%2C1110%2C3788%2C1659%2C306%2C724%2C724%2C338&adks=2750535117%2C2822441466%2C1015336334%2C2593656626%2C1616198098%2C1063954904%2C52041067%2C2731099659&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x101%7C1600x-1%7C1472x0%7C1108x0%7C300x0%7C300x0%7C300x0%7C100x-1&msz=1600x0%7C1600x-1%7C1472x0%7C1108x0%7C300x0%7C300x0%7C300x0%7C100x-1&ga_vid=1238470572.1639659060&ga_sid=1639659061&ga_hid=1102132370&ga_fc=true&fws=4%2C516%2C4%2C4%2C4%2C4%2C4%2C516&ohw=1600%2C1600%2C1600%2C1108%2C1600%2C1600%2C1600%2C1600&btvi=0%7C0%7C1%7C2%7C0%7C0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

5b021ee6283cde5010ffda78c227f7fb3c7a8831f9978e3616468a2c576d0d7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43009
x-xss-protection: 0
google-lineitem-id: 5813739345,5608088591,-1,5581822979,5850467494,5850267737,5581822979,5239133665
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138375040381,138374794160,-1,138339100962,138367758965,138375424228,138339031673,138370529227
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E25A 6 KB
4 KB 167ms
65ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 16 Dec 2021 12:51:00 GMT
expires: Fri, 16 Dec 2022 12:51:00 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 flyertown_module.js Show response
api.circularhub.com/2871/48979fe04f6431c3/ 31 B
558 B 243ms
201ms Script
text/javascript 143.204.98.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.circularhub.com/2871/48979fe04f6431c3/flyertown_module.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-43.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 64cf82f7e450115ea6cc0724a1c15acc7886ef4741395c4b8eeff68650f42809

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
p3p: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL"
status: 200 OK
content-length: 51
x-request-id: 526def2365c3240eae0c9a1b143f9128
x-ua-compatible: IE=Edge,chrome=1
x-runtime: 0.002835
access-control-allow-origin: *
server: nginx
etag: W/"0d87775e6f6df076757d4affce1d4168"
content-type: text/javascript; charset=utf-8
via: 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront)
cache-control: max-age=0, private, must-revalidate
x-amz-cf-id: 2lwNJCYaUeXmjolyTotxp-dK9c9TVLWVbVB-t8MVgnJnaacxZQEuDw==
x-rack-cache: miss

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 101ms
53ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021120601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a04635015a3fbcd058149ed73a7cc6ae74c533b537e8cfd55cfcc566edd15a20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8515
x-xss-protection: 0

GET
H/1.1 200
OK atrk.js Show response
d31qbv1cthcecs.cloudfront.net/ 4 KB
2 KB 37ms
7ms Script
application/javascript 143.204.98.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-34.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 27 Apr 2021 18:07:27 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Tue, 27 Apr 2021 18:03:54 GMT
Server: AmazonS3
Age: 20112215
ETag: W/"d89453438fbf10dcf4c13265c40d5160"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
Cache-Control: max-age=26920000
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA50-C1
X-Amz-Cf-Id: y0V896zXxMT7t_sUwrpM-9woWNuC3O847fU6wBDI9fdkoC6DEJEIYQ==

GET
H2 200 aam.js Show response
aamcftag.aamsitecertifier.com/ 74 KB
25 KB 43ms
8ms Script
application/javascript 2600:9000:2156:1e00:14:c3e7:6780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aamcftag.aamsitecertifier.com/aam.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:14:c3e7:6780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c1a476b3442043756f97fc98c480c06c65c74207e12ae6ba150eee21d7eed067

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 05:30:56 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 19:46:45 GMT
server: AmazonS3
age: 27688
etag: "d01602293dda6546ca8f8ededd0e44e8"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 bee9d99ac2913ec4167e166e6bdb691e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 25648
x-amz-cf-id: xBphHhQaPsxr0LjJzkBjO1DTzP3RtrJA6fYDGhA9_Kd2Pcm_XlPgjw==
x-amz-meta-s3b-last-modified: 20210201T194158Z

GET
H2 200 load_tags.js Show response
pymx5.com/scripts/ 9 KB
9 KB 63ms
16ms Script
application/javascript 35.227.203.93
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pymx5.com/scripts/load_tags.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.203.93 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 93.203.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:27:49 GMT
age: 1392
x-guploader-uploadid: ADPycdv3zyacVz3U5GlsAQyVRi3DlWPrPGriSQbjx6RToasvnIlgXpUEzLFXbljfAqKyYE3NxZ7NXeSnvt0LCWAK_2k
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 8946
last-modified: Thu, 25 Nov 2021 07:55:00 GMT
server: UploadServer
etag: "f6b06694767e707999eecbe9538b403a"
x-goog-hash: crc32c=xz4nKQ==, md5=9rBmlHZ+cHmZ7svpU4tAOg==
x-goog-generation: 1632835430711886
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 8946
accept-ranges: bytes
content-type: application/javascript
expires: Thu, 16 Dec 2021 13:27:49 GMT

GET
H2 200 tr
www.facebook.com/ 44 B
295 B 24ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=260139058256176&ev=PageView

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:01 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Thu, 16 Dec 2021 12:51:01 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
38ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&el=10%25&_u=aCDAiEABBAAAAE~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-14&_gid=1344418452.1639659060&gtm=2wgc105P9SH6&cd1=Will%20Bunch&cd2=syndicated-columns&cd5=2021-12-16&cd7=Opinion&cd8=986067&cd9=story&z=2123064427

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22074
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&el=25%25&_u=aCDAiEABBAAAAE~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-14&_gid=1344418452.1639659060&gtm=2wgc105P9SH6&cd1=Will%20Bunch&cd2=syndicated-columns&cd5=2021-12-16&cd7=Opinion&cd8=986067&cd9=story&z=1705154962

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22074
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK atrk.gif
certify.alexametrics.com/ 43 B
552 B 36ms
7ms Image
image/gif 143.204.98.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&time=1639659061050&time_zone_offset=0&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=&host_url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&random_number=7065963583&sess_cookie=db97810617dc34bbf392bc38273&sess_cookie_flag=1&user_cookie=db97810617dc34bbf392bc38273&user_cookie_flag=1&dynamic=true&domain=spokesman.com&account=TEMji1aUCm00qs&jsv=20130128&user_lang=en-US
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-17.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 04:15:12 GMT
Via: 1.1 9eb0e845437929074828e0cf53f179af.cloudfront.net (CloudFront)
Last-Modified: Mon, 17 Jan 2011 20:41:40 GMT
Server: AmazonS3
Age: 30950
ETag: "221d8352905f2c38b3cb2bd191d630b0"
X-Cache: Hit from cloudfront
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
X-Amz-Cf-Pop: FRA50-C1
x-amz-meta-alexa-last-modified: 20110117123941
Content-Length: 43
X-Amz-Cf-Id: K-_tyECEGMF6UywAvRlXFEWBCrKaXPaq_kLb_NBrgreETznIet929Q==

GET
H2 204 x.png
redirect.prod.experiment.routing.cloudfront.aws.a2z.com/ 0
48 B 558ms
175ms Image
text/plain 44.241.169.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redirect.prod.experiment.routing.cloudfront.aws.a2z.com/x.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.241.169.29 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-241-169-29.us-west-2.compute.amazonaws.com
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:01 GMT
server: Server

GET
H2 200 init-5499fsal6gpaz5tx8ut.js Show response
aamapi.com/api/ 12 KB
5 KB 522ms
171ms Script
text/javascript 2600:1f14:600:6e00:77cb:3957:e000:1f7f
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aamapi.com/api/init-5499fsal6gpaz5tx8ut.js
Requested by: Host: aamcftag.aamsitecertifier.com
URL: https://aamcftag.aamsitecertifier.com/aam.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:600:6e00:77cb:3957:e000:1f7f Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 933e6b902576f1f6615df407f8ceebb87e7b91d605a1699ec169e6753e75ab7c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:01 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript
server: openresty
content-encoding: gzip
expires: -1

GET
H/1.1 200 i
aamcf.aamsitecertifier.com/ 43 B
461 B 1405ms
571ms Image
image/gif 34.208.153.184
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aamcf.aamsitecertifier.com/i?stm=1639659061089&e=pv&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&page=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&tv=js-2.9.2-SNAPSHOT&tna=cf&aid=210&p=web&tz=UTC&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&f_inpriv=0&f_abd=0&res=1600x1200&cd=24&cookie=1&eid=d8fb2416-993f-448a-8990-1fd6d4273b86&dtm=1639659061086&vp=1600x1200&ds=1600x4396&vid=1&sid=cfd9b059-78e9-496f-846e-bfbd09242dbf&duid=d939ada1-61d1-4c78-b23f-fcc6352aaafb&fp=558905127&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoiaWdsdTpjb20uZ29vZ2xlLmFuYWx5dGljcy9jb29raWVzL2pzb25zY2hlbWEvMS0wLTAiLCJkYXRhIjp7Il9nYSI6IkdBMS4yLjEyMzg0NzA1NzIuMTYzOTY1OTA2MCJ9fV19
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.208.153.184 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-208-153-184.us-west-2.compute.amazonaws.com
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:01 GMT
Server: Apache/2.4.51 () OpenSSL/1.0.2k-fips
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43

GET
H2 200 load_optional_tags Show response
api.pymx5.com/v1/sites/ 0
713 B 169ms
121ms Script
text/html 34.96.74.203
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pymx5.com/v1/sites/load_optional_tags

Requested by

Host: pymx5.com
URL: https://pymx5.com/scripts/load_tags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.74.203 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

203.74.96.34.bc.googleusercontent.com

Software

nginx/1.13.7 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:01 GMT
via: 1.1 google
server: nginx/1.13.7
x-frame-options: SAMEORIGIN
allow: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
alt-svc: clear
content-length: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 138ms
52ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
expires: Thu, 16 Dec 2021 12:51:01 GMT

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 101 B
558 B 30ms
7ms Script
text/javascript 2a04:4e42:200::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2CString.prototype.endsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL

Requested by

Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dd1b5e04d54c4420fe3e8e6abe2875fc7f13a3cd6384b6c2afc1a35e302dd846

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.spokesman.com/
Origin: https://www.spokesman.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 2707157
detected-user-agent: Chrome Mobile/96.0.4664
server-timing: HIT, fastly;desc="Edge time";dur=1, HIT, fastly;desc="Edge time";dur=1
content-length: 101
referrer-policy: origin-when-cross-origin
last-modified: Sun, 14 Nov 2021 16:39:57 GMT
date: Thu, 16 Dec 2021 12:51:01 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/96.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 loader-config.json Show response
cdn.sbgsodufuosmmvsdf.info/prod/spokesman/ 4 KB
2 KB 47ms
8ms Fetch
application/json 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.sbgsodufuosmmvsdf.info/prod/spokesman/loader-config.json
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FB6) /
Resource Hash: 9c05f3e7a99522d6cba125b8dd46ce8ed64068a1d08dcec309c56a58ec85cf3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
content-md5: M5nFg6NY90vziLv0N+HY4Q==
age: 12806
x-cache: HIT
content-length: 1259
x-ms-lease-status: unlocked
last-modified: Tue, 07 Dec 2021 09:18:33 GMT
server: ECAcc (frc/8FB6)
etag: 0x8D9B9628AA68761
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 60f4b376-f01e-011a-375d-f24f45000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 52ms
11ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FA5) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 1403
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/8FA5)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 86f70830-501e-0077-2a78-f23de1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Thu, 16 Dec 2021 13:21:01 GMT

GET
H2 200 fp.min.js Show response
fp-cdn.azureedge.net/prod/spokesman/ 63 KB
21 KB 76ms
8ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://fp-cdn.azureedge.net/prod/spokesman/fp.min.js
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FF6) /
Resource Hash: af44b91aee646d43b9687c2f00450dd0ade50f4b8c7a78e6b99257f1d5e8984c

Request headers

Referer: https://www.spokesman.com/
Origin: https://www.spokesman.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
content-md5: lgzPoyz75nle9SCu4zir4w==
age: 6857
x-cache: HIT
content-length: 21083
x-ms-lease-status: unlocked
last-modified: Tue, 07 Dec 2021 09:14:15 GMT
server: ECAcc (frc/8FF6)
etag: 0x8D9B961F0D7C8FB
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 59d409ef-601e-0010-316b-f21099000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 g2i.min.js Show response
g2insights-cdn.azureedge.net/prod/spokesman/ 527 KB
75 KB 71ms
9ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://g2insights-cdn.azureedge.net/prod/spokesman/g2i.min.js
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FC6) /
Resource Hash: 9437490e4f56c98a9918b0e8f8f077f9e83f27ee69c1547ac1f229fcb4470fae

Request headers

Referer: https://www.spokesman.com/
Origin: https://www.spokesman.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
content-md5: hWVpf+tV9C2V7tkaq/lTzA==
age: 6857
x-cache: HIT
content-length: 75960
x-ms-lease-status: unlocked
last-modified: Tue, 07 Dec 2021 09:14:45 GMT
server: ECAcc (frc/8FC6)
etag: 0x8D9B96202A01F05
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: ccd98561-401e-002e-6f6b-f2a6b8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 t8y9347t.min.js Show response
cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/ 853 KB
198 KB 80ms
12ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.js
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F94) /
Resource Hash: e9b88df7153280c5ff946c894cb57cc4634d2ed86d0e23a95143b8087a418d7d

Request headers

Referer: https://www.spokesman.com/
Origin: https://www.spokesman.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
content-md5: +qea2e+SNSs+8NarnodssQ==
age: 13804
x-cache: HIT
content-length: 202032
x-ms-lease-status: unlocked
last-modified: Tue, 07 Dec 2021 09:15:10 GMT
server: ECAcc (frc/8F94)
etag: 0x8D9B96211B660A9
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 9aaa1554-201e-0053-5b5b-f23a70000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 t8y9347t.min.css
cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/ 348 KB
35 KB 83ms
16ms Stylesheet
text/css 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.css
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F81) /
Resource Hash: c1577ba94752b8302f8a5518b1ccd8b21507a7da67cd613dc990e8fd10f8ab5e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
content-md5: HBagnSR9fGL2/9/2zSnVqw==
age: 14269
x-cache: HIT
content-length: 35356
x-ms-lease-status: unlocked
last-modified: Tue, 07 Dec 2021 09:15:10 GMT
server: ECAcc (frc/8F81)
etag: 0x8D9B96211AC9D6C
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 6ce52f8c-c01e-00bc-615a-f2310e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3225 13 KB
5 KB 86ms
38ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
date: Thu, 16 Dec 2021 11:14:09 GMT
expires: Fri, 16 Dec 2022 11:14:09 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 5812
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 735D 783 B
536 B 106ms
49ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6f863b76431fe0df437b6d1c1cc5d7d5a2b48081a13197d41a6719e6ee0e20f9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xZFJjn0QsbK+RGAtwS2kBQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 16 Dec 2021 12:51:01 GMT
date: Thu, 16 Dec 2021 12:51:01 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-xZFJjn0QsbK+RGAtwS2kBQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 self Show response
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 563 B
909 B 244ms
210ms XHR
application/json 104.26.4.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1639659061466
Requested by: Host: fp-cdn.azureedge.net
URL: https://fp-cdn.azureedge.net/prod/spokesman/fp.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.4.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a302ee9c6b8f81716ef6cb8da24e0dcc66f55a8173fa1ba39774018dc6f211a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 16 Dec 2021 12:51:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=poXpR6buN%2F5238rv2CQisAA0tkHAv%2FqrJkOWiAO%2BKBcSZRLrlx%2BqmmqiG41s5V8zDx%2FKhwnRzMvRuTikvtfS2p1X3fYVMfLd55hg%2FFNgINvRl1d%2FGW62x9BkEzstyX8Hzkum"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=1800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6be80a6e6927694c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 735D 0
0 125ms
78ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2021120601&jk=834795588956593&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js Show response
pagead2.googlesyndication.com/bg/ Frame 3225 35 KB
13 KB 82ms
36ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53f0cf5f2fef7e5a938d553f62eb56266d1ac4e244eb7dcd40630614485fdacd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 22:53:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 136664
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13577
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 22:53:17 GMT

GET
H/1.1 200
OK ad.gif
api-35-87-123-161.aamapi.com/api/ 43 B
233 B 580ms
174ms Image
image/gif 2600:1f14:600:6e00:30b0:ae3e:5fa8:bc2c
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api-35-87-123-161.aamapi.com/api/ad.gif
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:600:6e00:30b0:ae3e:5fa8:bc2c Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: openresty
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 78ms
78ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2021120601&jk=834795588956593&bg=!ycqlyo7NAAZKWFskSlg7ACkAdvg8WpATBaF9dxeJNHz3xNku16MMXdJp573vOgP-RuNAF83sIarqPQIAAABzUgAAAAtoAQcKAGQpmVG1sF7P2ugks5u64fv9N1--aF7Ffr2BvZQAA65cSzqqrNh18gb3e-a1iS_KxDrGX3JPCGW2FewLLIO-xfsEeZSLp3pWV9Du5jcEpv3kAubw5I8psA_Z2-LnX9-aIw79A464mQLA-qND11Ri8z9vQq37m69Rnl-t4qCs3QIMWx094IKh7moUhK3IqGAPtB3Fj6j2qzQO0QlnMFxsA3lWdZHOjCB64wcl6gEXjylgKGWNNtFPyvoQ8qm6DK6a7urSC4Pb8ln8aJi5S39fRB0Xb90DngIDpXy7u5YiHbKPdgihnr0D0_AqO5Y1dI1IrfzHqAcLpgJQMnNOv_auOLbOfhvNic6YlUCBQq6s1-qYhU5zVDrqnII0-zhBI7HpTXs27NbXoZLYm1VEpqs5AHxvgoLTzxLFChmKSUHcBkgr2JquDgUdzEbSMAA6LBbkN-4bm_9yOhJANAsmtHhC5tmLHBVwj-_1_wgovLRl5O9WCAoA7PX7UzCqfu-RePN__dEmE2KDKBwrLUUCzmFKZSLDvA2cQ0Tq0qphUIJRSzW5E_MtTWUbgTexCH5r_N3Y7o6MLTcIPcyIvUHlqcwUa1nAWUbgsA6Y4UfEsUPSHPspDD5vxT4szbkDR1MnsZkfbhNJTZ0SE6VAmCqGuOJ2hp72gREJLNgeUeKkvVQrEfMQ3DjeLdLCklOEnCrLO6LMVheH7Thce3GVH84TNhOUVPz2UZbXeMhSlyGWmKh3nO-rjBCLkSkg5cI1v7GvzfynMvvTDYgmAZFBEjP3TLNPVBN4spRgf7os647_6j-iXH5b3DN9Fh-9Cls62jmKNrBU48SduNmmRlIxSJTmKrppP7SX9SWbnIH9nX4_B5jZEWjQNwOYW3zOxmc4M_OsH22S3GnGvE3n936N9ef0a6gKeSAxLQj-7XfWIGCkXDfLN7Uqt97IJMM9RjSSMsT8ru34Pl4QPcv4yJoxQg3Dg3u4ODahSyUlDYdlKIMXr37-ryafUqA4mTCSPRPvAs5VaywYNpVZ4-ZrBs1qL8EUnQvXIGx91FY2bnogv46cYrSRJ6HeIXGMCTgvE1w

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 140 KB
45 KB 70ms
69ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WQTQTTW&l=MG2DL

Requested by

Host: g2insights-cdn.azureedge.net
URL: https://g2insights-cdn.azureedge.net/prod/spokesman/g2i.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c93a6d7cf17c6e0456ec89bb2f2e912b75ba9b5f08033e2da7acd28f0e59b89a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46483
x-xss-protection: 0
last-modified: Thu, 16 Dec 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 16 Dec 2021 12:51:01 GMT

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 8ms
7ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FA5) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:01 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 1403
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/8FA5)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 86f70830-501e-0077-2a78-f23de1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Thu, 16 Dec 2021 13:21:01 GMT

GET
H/1.1 200
OK index.js Show response
d1wa9546y9kg0n.cloudfront.net/ 6 KB
7 KB 59ms
17ms Script
application/x-javascript 143.204.101.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1wa9546y9kg0n.cloudfront.net/index.js
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-221.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8431f4973d02bcceeadba217953b9a058dad0b1d958f9ba25f9fccfe95d7ae42

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 06:20:43 GMT
Via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
Last-Modified: Tue, 23 Feb 2016 09:35:10 GMT
Server: AmazonS3
Age: 23419
ETag: "cf67eb51479caf3b57c3577a08b6a038"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 6494
X-Amz-Cf-Id: fjlLeat6iEzhSBAIrsGa1fTNRwIxw4DGlVjinkAS8SMMGswRH3e1SA==

GET
H2 200 SR__SPOKESMAN.json Show response
cdn.ayc0zsm69431gfebd.xyz/prod/data/spokesman/ 1 MB
1 MB 376ms
375ms Fetch
application/octet-stream 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/data/spokesman/SR__SPOKESMAN.json?_=1639659061883
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: df059da9db2824c9ecfad5ee266ee75c668aae9cbbe4afe12d2ba0f30d70a786

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: AppendBlob
date: Thu, 16 Dec 2021 12:51:02 GMT
last-modified: Tue, 07 Dec 2021 19:37:02 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-committed-block-count: 1
etag: 0x8D9B9B8F14FB577
content-type: application/octet-stream
access-control-allow-origin: *
x-ms-request-id: f7177281-201e-00d0-717b-f29add000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
cache-control: no-cache
x-ms-version: 2009-09-19
content-length: 1105176

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 442ms
133ms Image
image/jpeg 54.231.192.105
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.231.192.105 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Server: AmazonS3
x-amz-request-id: M47RRYKVQR56SDNF
ETag: "ef2cc7f55b7ab677b023e36033e26471"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 631
x-amz-id-2: hBsZ8CPM/6Eps/oBuGFCFas/YkWSP2l5MtmCg4R+1gBKPMgty3mg+39xESenhQpEUHQfKbkgqGU=
x-amz-meta-s3b-last-modified: 20191015T134358Z

GET
H/1.1

200
OK

4 Show response
api-35-87-123-161.aamapi.com/api/
Redirect Chain

https://api-35-87-123-161.aamapi.com/api/x?BPBqHdYu4haAQDAd$dXJsJDAkaHR0cHM6Ly93d3cuc3Bva2VzbWFuLmNvbS9zdG9yaWVzLzIwMjEvZGVjLzE2L3dpbGwtYnVuY2gtbm90aGluZy1pcy1tb3JlLWltcG9ydGFudC10aGFuLXRlYW0tdHJ1L...
https://api-35-87-123-161.aamapi.com:444/api/4?BPBqHdYu4haAQDAd

43 B
441 B

701ms
179ms

XHR
image/gif

35.87.123.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-35-87-123-161.aamapi.com:444/api/4?BPBqHdYu4haAQDAd
Protocol: HTTP/1.1
Server: 35.87.123.161 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-87-123-161.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:03 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: openresty
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: null
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43
Expires: -1

Redirect headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Server: openresty
Location: https://api-35-87-123-161.aamapi.com:444/api/4?BPBqHdYu4haAQDAd
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: https://www.spokesman.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 142

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 50ms
49ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1102132370&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDACEABBAAAAG~&jid=423618335&gjid=1628340411&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&_r=1&gtm=2wgc10WQTQTTW&cd1=1639659061984.7sgeo83u&cd2=Not%20Set&cd5=Not%20Set&cd6=Not%20Set&cd7=Not%20Set&cd8=Not%20Set&cd9=Not%20Set&cd3=Not%20Set&cd4=Not%20Set&cd10=Not%20Set&cd11=Not%20Set&cd12=Not%20Set&cd13=Not%20Set&cd14=Not%20Set&cd15=Not%20Set&cd16=story&cd17=Not%20Set&cd18=Default&z=1810222991

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.spokesman.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WQTQTTW&l=MG2DL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4568
date: Thu, 16 Dec 2021 11:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 16 Dec 2021 13:34:54 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 45ms
44ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MetaTagsCollected&el=Not%20Set&_u=aCDACEABBAAAAG~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&gtm=2wgc10WQTQTTW&cd1=1639659061995.pi17ylo&cd2=ab31bcf97d2f74f8b52e0f9427c6032e&cd5=Not%20Set&cd6=Not%20Set&cd7=Not%20Set&cd8=Not%20Set&cd9=Not%20Set&cd3=Not%20Set&cd4=Not%20Set&cd10=Not%20Set&cd11=Not%20Set&cd12=Not%20Set&cd13=Not%20Set&cd14=Not%20Set&cd15=Not%20Set&cd16=story&cd17=Not%20Set&cd18=Default&z=2075288283

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22075
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 track
dc.services.visualstudio.com/v2/ Frame 0
0 219ms
18ms Preflight 52.236.186.217
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.236.186.217 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,sdk-context
Origin: https://www.spokesman.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-methods: POST
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin: *
access-control-max-age: 3600
x-content-type-options: nosniff
date: Thu, 16 Dec 2021 12:51:01 GMT
content-length: 0

POST
H2 206 track Show response
dc.services.visualstudio.com/v2/ 223 B
408 B 44ms
44ms XHR
application/json 52.236.186.217
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.236.186.217 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.spokesman.com/
Accept-Language: de-DE,de;q=0.9
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-type: application/json

Response headers

x-ms-session-id: 5135FE33-0710-48AD-9E99-66799386AF47
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Dec 2021 12:51:01 GMT
access-control-max-age: 3600
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length: 223

GET
H3 200 container.html Show response
6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CB3A 6 KB
3 KB 91ms
46ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 16 Dec 2021 12:51:00 GMT
expires: Fri, 16 Dec 2022 12:51:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 109ms
109ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTgxMzczOTM0NSIsImVidXkiOiIyOTIzNTE0NjAzIiwiZWFkdiI6IjUwODEyNjE0NzUiLCJlY2lkIjoiMTM4Mzc1MDQwMzgxIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX1RvcF83Mjh4OTAiLCJlc2lkIjpudWxsLCJzaXplIjoiNzI4eDkwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=856c7e08-8f22-44b6-a7c7-537c49ff7199&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062238&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4396&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9B71 0
0 73ms
73ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvOGUBfIGFA-TD-WHwgupS3YQb8tRmiJ_P_OZoqsn91rUVuAGOWpTr9kSuvu2Zhxo6MZfEOgbO1yqsnrOnMXnFUcNicte2t4yHwyZi0wlhZ4cUimTFBbEEdTRBhD9a3YHXS0zto-9Ms2Os9AHzML5M3YtcRbIXQMN5jaVEPdiJjOM9p4tngcMgqjAXWQTmqgYZS7rCo3efTo9FtD1tzizRHgcl_TGIjqiJ1NlZGastvtsyMeZWPG3kWtyXN2-KzsBsDsbm-OcyH3Bsrooz-38w6Mmxi83YYABRmz19Q5WTsaEI8tMYR0BzwTcd5DJ1J5_ifaXeDHytVzk3BqbK6K7F4&sai=AMfl-YQolRFuZ8OY_YS7MYdKpSmTgMnHWTOdstA_UzgAu6D6aFu1ALDoJubdsvl8CYcS-L8L3svUQIs_kIkvLCOCg2HO3371V7e9YozfXxoYnwHunJagm5BWHDSWyvyZ9q0&sig=Cg0ArKJSzE3gu6HokU7MEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 9B71 19 KB
8 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 9B71 2 KB
1 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9B71 119 KB
37 KB 152ms
53ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 3063405309293719435
tpc.googlesyndication.com/simgad/ Frame 9B71 16 KB
16 KB 41ms
40ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3063405309293719435

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd2ceb43e1780bf65e06160a4c5a76a06e1de116a617bec97b2d41c402a0e89b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 08:59:43 GMT
x-content-type-options: nosniff
age: 273079
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15971
x-xss-protection: 0
last-modified: Fri, 10 Dec 2021 21:38:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 13 Dec 2022 08:59:43 GMT

GET
H3 200 container.html Show response
6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame AD43 6 KB
3 KB 63ms
46ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 16 Dec 2021 12:51:00 GMT
expires: Fri, 16 Dec 2022 12:51:00 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FD7B 0
0 84ms
84ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss1qul0npnSvxtS406yV10bbr6kR-_-Qg72oe04zgKa9FzVS2Lmmb6uBXV90jKIFAXf4gdfXZ7UUiTBgFTnFvRbZrsK3QLYSLV-P55Txan10Bz5he3hM5FSg_VMTmozoO2zmyMdnN7sSkghJpsll1CzXv9pr0sRk4mufaAcghqOl9M98uYGV7lVBD_o7YtP9gNuyTOwnLvTHHSJf90WyLVssJ-CvR-Fb8rxWBZyCZme2nRWLJLF9r0a0dVEPEHim0YHLCo8SnZgUcFshdsnUiRn7xmvfNNBUhr7PGL6L8_6DIPxJKDk4TCmgvwoLAdalj_aN81G5j4EVVQ&sai=AMfl-YRF911xbJAMcr0VpwhY98oOYjhU6UsulmkpSySh_MZtsBgPgsU2W_8PUq48w_kqwTJJfZSp7R6y4pyr8qa-vjTJlCKQEjufar2knmlBAnZXY6P8eZ1YWzMNAAZtNsw&sig=Cg0ArKJSzInsqWa8mts_EAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame FD7B 19 KB
8 KB 39ms
36ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame FD7B 2 KB
1 KB 62ms
60ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FD7B 119 KB
37 KB 269ms
185ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FD7B 0
0 52ms
51ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQxMNwsUHrFWYmOVgy2TF-T5m9O-U2g1C2ow4BIBuKL2gGsE_RzCMh4i-Bba-57sx7VXJbVngktQHMyTrYvZD4eqqe2YA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 4049148580905421613
tpc.googlesyndication.com/simgad/ Frame FD7B 79 KB
79 KB 61ms
59ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4049148580905421613

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ab653c06f099d89a710112a2eae9ea1cfcbabcace357575b09eac3556be2f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 10:52:58 GMT
x-content-type-options: nosniff
age: 266284
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80955
x-xss-protection: 0
last-modified: Sat, 06 Feb 2021 00:32:48 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 13 Dec 2022 10:52:58 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6FE9 0
0 78ms
78ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuD7c_LuTbKlJclVXxD7f0jwfmTXtOWjRm8MxlCbJPLthiAk-igh2TF2-7Va-rvOaM8RAOPZD6ccJnb_J5F1w2FcKgQETDk9ZoOJb__mKKWVaxninky3-u-uj659MccumcO2Fq5kp2H4_-2o_Q4dfZXxa5y2pk7lz6-4oZoNO7K5yWPv0HopvdUmXLqHtXTveLO7q3AgWrwhOQc05OrG2tCOUDrBW6B497d6JN8O6SDmClKXzd21fUmRLTYEIFTov5eEsxJOs1DmzplYIYfZUVjfCkcaiGrY0o8jg2gOkIXYcQPcGcpX6_Aitpv_o2GGxs_k-8P40IL7ahw4QEwr5g&sai=AMfl-YSgnl6XjAPLT-ibwn0bj6LweSLgRpUWwzl4HqtjUrhb3eL_xCcrXK9YPVNvZed9zxKJ-LiZ3zGUuBx7pAPX4KNd-eTikjnFpH0I-sdvXr60warlfDVtla5sW-QHJc8&sig=Cg0ArKJSzLJu6V1_FdyKEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 6FE9 19 KB
8 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 6FE9 2 KB
1 KB 75ms
75ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6FE9 119 KB
37 KB 260ms
180ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6FE9 0
0 49ms
48ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTyyZKXY-LVbmNYG4bX8CRkxVF4LpDHraYOg2IpZO7MmFtXZvrA43tJXC45AJty5-RG-FD1WiUCgG0kFvbTY8ukwxyYnw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

GET
H3 200 3071169342068440643
tpc.googlesyndication.com/simgad/ Frame 6FE9 122 KB
122 KB 74ms
74ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3071169342068440643

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45e7be9cc2252a8af0b505407916c872ea9c7cf0fbe7b090e1e6f0f48a0a4df4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 03:10:16 GMT
x-content-type-options: nosniff
age: 34846
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124880
x-xss-protection: 0
last-modified: Sat, 16 Oct 2021 00:47:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 16 Dec 2022 03:10:16 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8BB3 0
0 74ms
73ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv2crjiyiWZSVebmLYk146QfKukG-MrNpJC9nHnU9jsqrRUYEkH9-GvpQ3rMf87JnPrCiRqp0axZsjfx2NNmBC0beRuFa6K_cMQbC8wLMRWJJk9zszGozV-Rf-yUnQ_cm2XxVAAfAJeVaCVmtdKeA6tKvVVH7jd4_C3Qu4aX0A0Q_4YDVUQsnMHhLLxjqD8ILRZDo0nSQbrMHvPJ6UU6Q72LQYgL5SfemoKTaoVlsRwmtCk1R0W9BV_DbEKqr4MBJOQq79vMDyik-MfePwysgIS8ngTQfjZ_uvAejSgRvHXvawkv8zBC2Ijf0e1RtMaK3uoRaypI5Q0jyF1jGvVSpyEMfoXlmk&sai=AMfl-YQwCmmoBzbykwmWjIBcr3HfnnbpJn9EjP48M9wmoENNYsrU3iVIglqa52-x5XAoSLLvSlesa0Zczbwj4VrCe7z3oMlY1-8AAaaarv2z6Lz91deUva1dbFCs29Fuu9g&sig=Cg0ArKJSzBrTG4o2LMeDEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 8BB3 19 KB
8 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 8BB3 2 KB
1 KB 74ms
74ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8BB3 119 KB
37 KB 296ms
224ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 17132413581308926828
tpc.googlesyndication.com/simgad/ Frame 8BB3 54 KB
54 KB 74ms
74ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17132413581308926828

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6086cdcbe1661e7885a4cf0e4e3f299eda84312ce7dc5402071bf647be1174c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 01:37:19 GMT
x-content-type-options: nosniff
age: 213223
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55237
x-xss-protection: 0
last-modified: Mon, 13 Dec 2021 20:31:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 14 Dec 2022 01:37:19 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 800A 0
0 74ms
73ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvI8fDWQZlYEmfi2QoD4_OvgZIF9WkN4NlGdSqOwWH3jia_aUne06Y2VQo7CahbYnvH8cQ_YiwwaLgCLsOxTY4nyHPH4KEKyze1Fd9hRFx9xWzqJiKQ_TS0_1wHTftBDcz5IwCNW8loZ282A7R5Z7Cw6RM6Aw99NKERN_Y4jwjt5TV3N6enBAddqVY9ZNEqIyKpcBCZH2osfz8MorE1UBcIHYxF72juej2diypji-R51I1GEUTVqFx5-4mMVEpXXF0-sLMtvWu1P6RsTg0DQA2NX27QYzy-j_Z6UmTIEGMJwd6J6hi7CilENfWVQcDlW20AKt2faAFEvml7vqqpsQemYFw&sai=AMfl-YTcj17qxm-HyR6suXxUQ-swTMLQjTjFRRPmc7nRa4OjcFjhAop8XABYF7TfHMF33Dd0xrchNLUC6XcUxDNt3oCN4RKtbvZCZmJlRxbMhR-_TJ9zpGLArIaRCwqvH6Y&sig=Cg0ArKJSzMfxZQXBGpjyEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 800A 19 KB
8 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 800A 2 KB
1 KB 84ms
84ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 800A 119 KB
37 KB 196ms
131ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 11089798746636558612
tpc.googlesyndication.com/simgad/ Frame 800A 215 KB
215 KB 84ms
82ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11089798746636558612

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dbd62c7f49c7b12ea4d362ad5dc2e6ee9d468b671cb55aed77354071b12b7d21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 15 Dec 2021 03:29:56 GMT
x-content-type-options: nosniff
age: 120066
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 219697
x-xss-protection: 0
last-modified: Sat, 06 Feb 2021 00:34:15 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 15 Dec 2022 03:29:56 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EB15 0
0 89ms
85ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvIFUcHF0-9YgGbiik1MnZ6-JF3mOpvF0rPze1aOnXX_ZS5vVKBEFIQ3o2m4yTqKHuqSb_34fQRO-sAHyB9f4JMfBj-NGFHOh95luOPCfbbDIfKw7W2L_vwdbT1dovSNM-RdaKTtr_2bHRWsgX4HXm783BFfb823IjSENEt0JitK2K_SAPjl3ZVazqDXD2Bmbz1JpuqY54CTDPeJ1gzTy9LvK088KHU9xTJK8wWP3fQTvSb_gG9ZWRPvKtN2bhx_LbEvYTYK3tFkd9MpnUwIiQbmei-7NPy9lIjIw6LLMU6XIIWY-wdIsZ8Hvn-xB2SPGH14QsUBaMF5TcC_GIeJQ&sai=AMfl-YQWD85PxjmQ9HP62FF2AqqLo1qgO0-vIDSRY1R_Ui-5FumOQNW3qYdrAhMF3P7C7C80p6snCSQ_ZdZo-bmXY668yslicNBpVnkA1Cf1-XCMRle3oAJ5HKGEXVjNYtQ&sig=Cg0ArKJSzNsLqLLxW1UgEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame EB15 19 KB
8 KB 45ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:38 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame EB15 2 KB
1 KB 87ms
85ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EB15 119 KB
37 KB 254ms
196ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 8584584166922597145
tpc.googlesyndication.com/simgad/ Frame EB15 106 KB
106 KB 86ms
84ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8584584166922597145

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9182d1491100797b6b7addd771f782e1daa0d6788c2d7ebfa3570a21b1637b34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 09:16:52 GMT
x-content-type-options: nosniff
age: 12850
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 108706
x-xss-protection: 0
last-modified: Wed, 03 Nov 2021 19:29:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 16 Dec 2022 09:16:52 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 132ms
131ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTYwODA4ODU5MSIsImVidXkiOiIyODEyOTEzNDc3IiwiZWFkdiI6IjQ2NDczMzI1NTIiLCJlY2lkIjoiMTM4Mzc0Nzk0MTYwIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9ST1NfQ2F0ZmlzaF83Mjh4OTAiLCJlc2lkIjpudWxsLCJzaXplIjoiNzI4eDkwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=20dba9a1-5a7b-4424-9011-8a1724e81ed4&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062301&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4576&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame CB3A 22 KB
7 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 09:33:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11867
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 16 Dec 2022 09:33:15 GMT

GET
H2 200 / Show response
a2.adform.net/adfscript/ Frame CB3A 1 KB
2 KB 318ms
88ms Script
text/javascript 185.167.164.51
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/adfscript/?bn=51797166;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjst2_yesNUdMbQO5DQkazCO9uyPDX4Xru5GgB5GxxrKqZNaat0vVHtJB_jgPUSnmPVyfkLbm2WBboGbhjPQ_-_4U9wBl-2zedxLOZjRXI8n78AUtwUJR60tn8w1XKNiIfkaI_D0e2w2vRdAARtLA3hEnn2sAJDrGGGZflRdaAfoK7tSp1mj-ZzL5ccV_YRVLbbX6T_O6xwfZ0xRpKQwdfP1Uqw8LuGTEIRooY5hIgD1JgQ60f91gHY-afn88uSI7XdkTuYgcggmQtkxYcoNbU9A0YmxA5Y2xMnGwEwb2vjWoTNPpjnWqU1i9d0SxEN6DzQnHJCCHeZfNqjns&sai=AMfl-YTot3Go4RmbXsRhXQR29C897fjJC7X36EWCIUVjomIwB0XEJgpAbo7EI_tJItWYOWYWXavgTX6ZhPuMHlSWylkwR4z8MRP15iiGnpvuPN5gGewDw22ywtJ6hhtpk2g&sig=Cg0ArKJSzNuup0UH1ZX7EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.51 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

75b87be050878bf48f81eae0629be4b584a24d9cf7f894def408d83037f2c13e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 1162
expires: -1

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CB3A 119 KB
37 KB 250ms
247ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0481 624 B
733 B 182ms
57ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNW-QZw4Tz33LCoZgR33B3Fi_bqXGLgGaZ5gQkAJGTQaLUzKuS_BP21ygep68mRwu6rjg9HXOyGlrBbBxN_dKHifbcHgMeVFl5PGhcsU2dvCG9agGqRyIPwJfTWORz7_af27hLTUpcFqbbOWw_b_SPZ_Lr23_M6bi4dXAih4ZKtZbis6pyQ

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 16 Dec 2021 12:51:02 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AD43 24 KB
14 KB 198ms
73ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B1grE6pOk49W3RI3ewei5f1WC-XzhNjS8iobGH04vszU99Fve9axyX9ION0acIBEbNPT524evXPtj0eZGLt06q46tf0qdqTg8JkYPBBPkVuG75n8fk2ulwGfkmhYQQm-VlHwFWrokYVBW_Ufe8QbhCDsj8sw&cry=1&dbm_d=AKAmf-AM-hk9hf8K4lqBhJm_VFMqTODnHuNxuSxf5Xmxz5hLEt7ABPDTP4lnALyrqfuPFVOq8nYsh-k9w-beTkBlUd-HYc7toI0xzHzHu_QdGl1yC7nIhop8mohQeujCLldLKsg-IeVMYI8-FbntYJHj7owSxQDDp7u9-mFJq7MRQmgoqZK_yZPi8S2JmiXN1tE2xMqx4dh2iUpcOWv_eWE5nsiwDe6buBrXEoZjs9M30QNfsyV4MwmFo6wawQHvQahLBHcVBcEaCUucTlNOl-Kmk2ut55RIjDooFRR0HVD-rCAqnPo8MqMhv-6y4Ije7aCdfNschpY6WOL73lW6UBNwSf4wRVE_U31zD9W6oZB535Ci_f-LMFwzqmG5ORNyQzxDX2Xq9X1ikSxHDjyGq7H3EGeFTkztx_N8g1WFwzu81bXQSY4s6MhY3sEGsTJlP-lWStrn_pzEz9uC0yW6fmKxlOdaDmSVZdvwy26utIlinou7yFm00JKBDG0e4kusGqFh9SmnxyFoJam0n3PIcNZ-flkgTolumbaiBF1ESQqoQzf4KeEWk63Mm-lr_iIV3Z9UOMGaEOGY4jFxLbDSDwFpzOdYR-Q1TXK9S5O0uirpXzZpEuYV_6VALNkFVw4PtDZhgal0Z_KypW2FTVkAOHHQUBm76FRR4u8waPvoO9mQ3iFwDkreFpegJE-MVGOtujzB6mgRUJ1wbvR0Hb-dlqFPVPVxSKnp3syxxhOzVKRqqrckXKCUDstTDfvCnIxYaT5C4PXS__h6y-R6ksdeITMwaXJRpoQp0KITMeKip3BgknpWi_RFGBfE3E7xWnL_u7Vi3Qeif2dX6UeaDRSLxMeBiVcnviTVSjA1j3X2NRbpoO42Ncx3LI9VdX3K_V7NSzXzrTi-RLZvhBXoGP4GDr1V3ZLgMq-JXRngIAU6sKkHruC0iH-DifRnwsLp2_7K26fbaTLtZ-UmmNSGil5JG6Q6qd8ue8_co6pHFonKTepdwGLOJbxau60_Mb02W_BO4Tc8clKmpOAsBUaCzZAHXWVN1-oWjCOXwf2GGaalevp2s_aI29EuKza1UIbvkUrWwd7Z-dBWGJAkmzcDj9Mhrj9iNp6y9tWs-4vLRzerZRKExQIhAllxV4Ipm0sDAlrHjc6SFagMjBgajR5jHodFoj_epS-fzF1T8Ydxe9daCldqOb4neeSl6IhilpST2rAZJCbEzNIDNKyU5mxU0Yis92DiQMVkiszjQGpyPnWKW2_L9ZHCgT0-zqtG0yFXY5j3jkbg3lpoKb5Z45tl-7ZOHGQR_WGlg3qCfNwoiTCyh00-175SR_7OYVI0Jry_EZ2szQ4gVis3CpRP567HTvuGgMrUEDKfjSy1oTrV76LkjrPhm2kWsI7kOWTtNeBYkkSai34oH4GYg0sRiVpnfcI4nOnA_TYnyKzbMj1Dv9gpWQG4PwY0E8beVRvcBbfHO5U2w-Ugb5LRJKcZjFUDxMkrAzV02M7EJl1q6zML9IZL8kPHdaTlsvr0jkNkTHJG3fPz-8127uwCad-HD8L8ECx7K7uVTGB0YQ-UfdKAH-ll7IBooAB5YxpYC4dSoz4iI-Lt7a3PaBI4-6-yGdhNZviIhrboaNmsoT8Xg7BIZw4vDYIpW3fbBthR3d75Q24brkrzOJtAtKBLkhJFWrFbgliWJnTJcdtB3qaIbyLZLhyJDGTpdXxVW9htZ-9pDXgHJSN0tWUwYPcbCmOe9t17B3quvnkCyw-MiO-6r_9WcGiGYu0aG3pPYtwWwMRVWHT7qEieUVBXSnhbK2G6LMLw_kBKYMm5VhXMct1qYyfirHkPIjEeFCtzp80WIsOF9lRnifTtThxndy6cY45ttuL6Z9mDKnAY5NezxjpAcFbXzxVcqGQ3fQ5P_fDwKDWA_Z8Cmx3l6TX7lKezWvIcqf0DutO7Gvgg30sFfovkHjmyPc1G1pSKTjnJuPdAh5x57UfePolf_tyHK9ZTaJk_63oIKp4pMpoAlz21fTzwedjpQRprdSdnnCFyDLGaLjcO_TzsdiZ0tuWtz3CEZbQ8IQzF-I1SxdndKGoHQ0EJp4j7m37OGNepdk_UWmjDksV2Lha99Oh8SFekSdq9SC6Gdcla9D8X7UyyqwEMxk0kmiwJhUKhDPvko3XoUyuduqcwvjTrnjuZ0AmfdVKPsfv9De1ekqGeMzDytzKZ8FbZ0s0_rACVuHnnCqlss0q6tDoz0_a-2-NSvJcQgS0Wf6obqed3aPjKzKLUAPB38SgM7pEPIHUW7im-uf7x74LGBGUG7y9B-CBL_w8noi0Azy7EIo8da-ZEn1_kJmhk_PBlT2rVvefCvYgNU0Hh7SCFEhao8WsSVUzWZci7Xtoc_WNvtf0pZfXrnWuWjLTCALAebpvfQ5QWUA0q5I3Y7Hq3FvHTyTogd_xjxd3gJM85mssouWp1KLkgRVCb7z5RHT8lwo2-wcP_b6tAPL1mYzWjSw-g6LiLUsI5CFh2HT7UwC66LnMe7E_7omKT7oqbungGFaZVwXvoRKO6ptExxDX-9pg79HFO-zwY30w8IKry3m-QQJhw0kiEhvHr2jb_hg2vVtbtnSQmIluxHQKpZnl5qNUxGBthchZjl5RPekUt2K5fKwEtY1CiS3SSLWReO_d2B3_PeSKTil9rmqg98V4aOo6ufJu335G73iGFV8aopASHbRqKs84_Umlti3NbxPnje45oo77ytKNct8uKfCQ033AeRW-Ju__5VRDVuIwA_XAdHprVnRYssBcYiyT5BM3llcZbImyOjzq4iURhTi3C1sLuxFASHaZ-i2mQMh05esUf6LoQTJ3_h3VVpUFwTNXuR910jRsb2L_Pl0vT1gCXCm8Puk3I5qU67m6dtMh9JttMNji80TPwa9D60azu2cYtlKxFxQ346cObKtgSeH64p040Zb9oF1hVKdrtaWXUKcHhsxXIYUEf9D7uDIVHSTOF7033Io6rZEHWQLrUD5sC5j58Tvm0_Jq0U-b6pM-CSvYupwmF8J2ogwxTUxZJpeLovuMR6MSmkCcJjGw0ndvJuPN7rZx3Ip76gwLJFWau-5LjenIZeN48K9T8dbxWBxRCKPxUOdCGbbOcggHBPXyEEGJfnnUB2s3TR4FODLo6V7ELG3F8qJwrsJXKYW9wBhl6hqx2hm4avv9em1woDB2_pUih_7xSvv_0YKdVj_na_tfo4G-9UDD5YS76UGRwUFxh2mW4rlr_7i0TVrhKMTbbLuH0Hv8TU6UKs_ts5Z547ktSJMSeDB9inLfQMPsoV96d2eiwHT8ucLD4oAyrZ_TK9aBzq9JN4b2kr6rortWEwdhWnmoY1nIgp1ZN0iwHBL42cpBSrqvG3F4sqBEteD0Vy-o&cid=CAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%252F%240

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ae7f141db97da757eaab464500c6e750de71638cae4fd68d415ca4648dbd4ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD43 42 B
63 B 100ms
100ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DxBeEHLZD9yE0HZMyWNL3XRFZPGwF7920K8nO-gLri78fZ8E_7b57uysyFJfjnwTEAzgEJJbtK-JFfxQjGzMNfpGCH0QUGMjVjVscGt4HivH6-SVg

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame AD43 2 KB
1 KB 104ms
103ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:38:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:38:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AD43 119 KB
37 KB 274ms
273ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame AD43 15 KB
6 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:46:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
server: cafe
etag: 15715955993838318253
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:46:15 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame AD43 0
0 47ms
47ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRKzYrgzjLbPZsYHLe6HjV97mrSOEHu_8ev3uXFQWj7WBGdZgHWR6qiRtwk6ckDhgMGgY35LKA_knd9uUMtopIMqhGxBg
Requested by: Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

POST
H/1.1 200
OK x
api-35-87-123-161.aamapi.com/api/ 0
387 B 176ms
176ms Ping
text/plain 2600:1f14:600:6e00:30b0:ae3e:5fa8:bc2c
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-35-87-123-161.aamapi.com/api/x?BPBqHdYu4haAQDAd$YWRibG9jayQ2MDkkMA
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:600:6e00:30b0:ae3e:5fa8:bc2c Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.spokesman.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:02 GMT
Server: openresty
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.spokesman.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: -1

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CB3A 0
0 90ms
90ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst15uvWH2WiYE1LZdBvvQHBS32fb6zC7N2bDZ4UCj5z5-VDFStlYX8Wr5qgKLTjBriUC2PxR48kGyMlwfJuwUQPJRfUHS9GAoMMETnNGpUkJxhGCANM-OhQVr2Q3eoUPbZfjEbuWZklM-3Wjg9qknavUtl1I_RCHVYNBgb7sxz98DPTXd0O9oHRO5tzPW1KK28_gONzsFnBSoSmzLoECwZun2hzxfkWwA9hS7nuTO3Ie8qqxToV5HqevQg8CmgMZ2tv2EKnv1ItTvCSKamKl3ke8NLzDZPcGRNE6g9kcdHApdsXwpr5onAcOZ1E0c4eO-JK8Xw8UuR-_M7fOo6_&sai=AMfl-YTALE1kaJhAds2UPxZfL0CoR38Qf5Z6mx6xPLEi_KVtkgx-onOEsZbRgYUbs0AApwkofyrVXZPpbVYZVXsAbQ3U0jbcatR8wggOgvuRya2OjFncOc9x0crOLB0BgSk&sig=Cg0ArKJSzCVFKWqEuY8lEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 102ms
102ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjpudWxsLCJlYnV5IjoiMCIsImVhZHYiOiIwIiwiZWNpZCI6bnVsbCwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX0Zvb3Rlcl83Mjh4OTAiLCJlc2lkIjpudWxsLCJzaXplIjoiNzI4eDkwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=1fabcb1c-90d1-4e92-b965-11439232ba05&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062306&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4576&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9B71 0
0 117ms
72ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu3RscYX5JyFEDDsSqaaUNW_XKg6fhIrTirm6C8sIJK0UCtsHU0QTPfcZ5R9a4Mx0Q2XYXAFjfDQHrbI9hbW7O247HM3-dEHA3Ly3i5z8buTKdWWDxUksk829GvjC1pDHtMiTakHhGgl1FfDku9SwpV9POCoFrkiwPXuh6UzJRGA3BKUHPSQoBcAQoW4s_1NkpryjHJVJeX4HffsRd1nAGE_i6K6DdGuN4NzNYoPN7NAeJhOFJm9rzzG2hhcWUufObuLGD8BM9HqHuWpd2PlubGBQ5YQcAwLj8m6Ko7HLqRhV8RZQg8UyfpmYnOs6ldFwG7ytWXLAEUwi1N-h0umABL09E&sai=AMfl-YRW7ZvS8OaexOqSKe9nnyD8mMDzYOQXF9NbwiPGZbXXUppH_MXYgcMNODShJvgMb3MmX3NnPfRtfdYPp4tIoFZIOxQGoY2g0uSpW0A8r4UARzpIg-dCfgVlJnGZwgs&sig=Cg0ArKJSzGswevVEvoOQEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
DATA 200
OK truncated
/ Frame 9B71 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bae07f0af0a5b35a386e9084c737760b1ddcdec3fdddf8238347b4183ded9682

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 800A 0
0 93ms
72ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss_vkUnxnhoNRtjpoGfJ8iY74-alptjThO-sWcSk5vVoRuZAIDUO9CUVcuJU5NI20-QUbMDA995dr_f4aRTdrYp71rig2sduPqVfcNZyGYCvt9EeDesULBDMxMblOHlMJQYdbIq_KILuMJAZpwZbYMU-kZpTVOuBcLIcBb64c61hBE6Mc76IsbdjwR08icZPv8dvxn6wfqbjUGh9EamlvTm-W5jDDuWtRXyEMOzYbXlAq8wVJ0HgnG4aAQuEkZHVhM49gJX8D8QUbEfgNLKeaViIBPebVPftrNJW8LiRdPTP487q6Os8M-CZ0MemClddQuLj5mgrox0LWa3A6kJupu5WOAHfw&sai=AMfl-YSt-3KH2MmMdWHicxkyJNsJGLasyAmMPZoEBT4H_n9RR08XEcc0ETCHViYDAVk-oSgxMZh36qYg75f2uVIVztyjHe4nw0INOhPqDQGQ8R2REvmsG04JPHW_rDaJ8Ts&sig=Cg0ArKJSzEWW5t0pVNaDEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
DATA 200
OK truncated
/ Frame 800A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c27bf0209d7ca951bab976c15d4d02b613dd62eeaabb7abe53fb4cecb9f660c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame AD43 24 KB
9 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B1grE6pOk49W3RI3ewei5f1WC-XzhNjS8iobGH04vszU99Fve9axyX9ION0acIBEbNPT524evXPtj0eZGLt06q46tf0qdqTg8JkYPBBPkVuG75n8fk2ulwGfkmhYQQm-VlHwFWrokYVBW_Ufe8QbhCDsj8sw&cry=1&dbm_d=AKAmf-AM-hk9hf8K4lqBhJm_VFMqTODnHuNxuSxf5Xmxz5hLEt7ABPDTP4lnALyrqfuPFVOq8nYsh-k9w-beTkBlUd-HYc7toI0xzHzHu_QdGl1yC7nIhop8mohQeujCLldLKsg-IeVMYI8-FbntYJHj7owSxQDDp7u9-mFJq7MRQmgoqZK_yZPi8S2JmiXN1tE2xMqx4dh2iUpcOWv_eWE5nsiwDe6buBrXEoZjs9M30QNfsyV4MwmFo6wawQHvQahLBHcVBcEaCUucTlNOl-Kmk2ut55RIjDooFRR0HVD-rCAqnPo8MqMhv-6y4Ije7aCdfNschpY6WOL73lW6UBNwSf4wRVE_U31zD9W6oZB535Ci_f-LMFwzqmG5ORNyQzxDX2Xq9X1ikSxHDjyGq7H3EGeFTkztx_N8g1WFwzu81bXQSY4s6MhY3sEGsTJlP-lWStrn_pzEz9uC0yW6fmKxlOdaDmSVZdvwy26utIlinou7yFm00JKBDG0e4kusGqFh9SmnxyFoJam0n3PIcNZ-flkgTolumbaiBF1ESQqoQzf4KeEWk63Mm-lr_iIV3Z9UOMGaEOGY4jFxLbDSDwFpzOdYR-Q1TXK9S5O0uirpXzZpEuYV_6VALNkFVw4PtDZhgal0Z_KypW2FTVkAOHHQUBm76FRR4u8waPvoO9mQ3iFwDkreFpegJE-MVGOtujzB6mgRUJ1wbvR0Hb-dlqFPVPVxSKnp3syxxhOzVKRqqrckXKCUDstTDfvCnIxYaT5C4PXS__h6y-R6ksdeITMwaXJRpoQp0KITMeKip3BgknpWi_RFGBfE3E7xWnL_u7Vi3Qeif2dX6UeaDRSLxMeBiVcnviTVSjA1j3X2NRbpoO42Ncx3LI9VdX3K_V7NSzXzrTi-RLZvhBXoGP4GDr1V3ZLgMq-JXRngIAU6sKkHruC0iH-DifRnwsLp2_7K26fbaTLtZ-UmmNSGil5JG6Q6qd8ue8_co6pHFonKTepdwGLOJbxau60_Mb02W_BO4Tc8clKmpOAsBUaCzZAHXWVN1-oWjCOXwf2GGaalevp2s_aI29EuKza1UIbvkUrWwd7Z-dBWGJAkmzcDj9Mhrj9iNp6y9tWs-4vLRzerZRKExQIhAllxV4Ipm0sDAlrHjc6SFagMjBgajR5jHodFoj_epS-fzF1T8Ydxe9daCldqOb4neeSl6IhilpST2rAZJCbEzNIDNKyU5mxU0Yis92DiQMVkiszjQGpyPnWKW2_L9ZHCgT0-zqtG0yFXY5j3jkbg3lpoKb5Z45tl-7ZOHGQR_WGlg3qCfNwoiTCyh00-175SR_7OYVI0Jry_EZ2szQ4gVis3CpRP567HTvuGgMrUEDKfjSy1oTrV76LkjrPhm2kWsI7kOWTtNeBYkkSai34oH4GYg0sRiVpnfcI4nOnA_TYnyKzbMj1Dv9gpWQG4PwY0E8beVRvcBbfHO5U2w-Ugb5LRJKcZjFUDxMkrAzV02M7EJl1q6zML9IZL8kPHdaTlsvr0jkNkTHJG3fPz-8127uwCad-HD8L8ECx7K7uVTGB0YQ-UfdKAH-ll7IBooAB5YxpYC4dSoz4iI-Lt7a3PaBI4-6-yGdhNZviIhrboaNmsoT8Xg7BIZw4vDYIpW3fbBthR3d75Q24brkrzOJtAtKBLkhJFWrFbgliWJnTJcdtB3qaIbyLZLhyJDGTpdXxVW9htZ-9pDXgHJSN0tWUwYPcbCmOe9t17B3quvnkCyw-MiO-6r_9WcGiGYu0aG3pPYtwWwMRVWHT7qEieUVBXSnhbK2G6LMLw_kBKYMm5VhXMct1qYyfirHkPIjEeFCtzp80WIsOF9lRnifTtThxndy6cY45ttuL6Z9mDKnAY5NezxjpAcFbXzxVcqGQ3fQ5P_fDwKDWA_Z8Cmx3l6TX7lKezWvIcqf0DutO7Gvgg30sFfovkHjmyPc1G1pSKTjnJuPdAh5x57UfePolf_tyHK9ZTaJk_63oIKp4pMpoAlz21fTzwedjpQRprdSdnnCFyDLGaLjcO_TzsdiZ0tuWtz3CEZbQ8IQzF-I1SxdndKGoHQ0EJp4j7m37OGNepdk_UWmjDksV2Lha99Oh8SFekSdq9SC6Gdcla9D8X7UyyqwEMxk0kmiwJhUKhDPvko3XoUyuduqcwvjTrnjuZ0AmfdVKPsfv9De1ekqGeMzDytzKZ8FbZ0s0_rACVuHnnCqlss0q6tDoz0_a-2-NSvJcQgS0Wf6obqed3aPjKzKLUAPB38SgM7pEPIHUW7im-uf7x74LGBGUG7y9B-CBL_w8noi0Azy7EIo8da-ZEn1_kJmhk_PBlT2rVvefCvYgNU0Hh7SCFEhao8WsSVUzWZci7Xtoc_WNvtf0pZfXrnWuWjLTCALAebpvfQ5QWUA0q5I3Y7Hq3FvHTyTogd_xjxd3gJM85mssouWp1KLkgRVCb7z5RHT8lwo2-wcP_b6tAPL1mYzWjSw-g6LiLUsI5CFh2HT7UwC66LnMe7E_7omKT7oqbungGFaZVwXvoRKO6ptExxDX-9pg79HFO-zwY30w8IKry3m-QQJhw0kiEhvHr2jb_hg2vVtbtnSQmIluxHQKpZnl5qNUxGBthchZjl5RPekUt2K5fKwEtY1CiS3SSLWReO_d2B3_PeSKTil9rmqg98V4aOo6ufJu335G73iGFV8aopASHbRqKs84_Umlti3NbxPnje45oo77ytKNct8uKfCQ033AeRW-Ju__5VRDVuIwA_XAdHprVnRYssBcYiyT5BM3llcZbImyOjzq4iURhTi3C1sLuxFASHaZ-i2mQMh05esUf6LoQTJ3_h3VVpUFwTNXuR910jRsb2L_Pl0vT1gCXCm8Puk3I5qU67m6dtMh9JttMNji80TPwa9D60azu2cYtlKxFxQ346cObKtgSeH64p040Zb9oF1hVKdrtaWXUKcHhsxXIYUEf9D7uDIVHSTOF7033Io6rZEHWQLrUD5sC5j58Tvm0_Jq0U-b6pM-CSvYupwmF8J2ogwxTUxZJpeLovuMR6MSmkCcJjGw0ndvJuPN7rZx3Ip76gwLJFWau-5LjenIZeN48K9T8dbxWBxRCKPxUOdCGbbOcggHBPXyEEGJfnnUB2s3TR4FODLo6V7ELG3F8qJwrsJXKYW9wBhl6hqx2hm4avv9em1woDB2_pUih_7xSvv_0YKdVj_na_tfo4G-9UDD5YS76UGRwUFxh2mW4rlr_7i0TVrhKMTbbLuH0Hv8TU6UKs_ts5Z547ktSJMSeDB9inLfQMPsoV96d2eiwHT8ucLD4oAyrZ_TK9aBzq9JN4b2kr6rortWEwdhWnmoY1nIgp1ZN0iwHBL42cpBSrqvG3F4sqBEteD0Vy-o&cid=CAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:49:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9516
x-xss-protection: 0
server: cafe
etag: 14328493792227503680
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Dec 2021 12:49:56 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AD43 41 KB
15 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 15 Dec 2021 11:30:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91230
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Dec 2022 11:30:32 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0481
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1

43 B
894 B

25ms
25ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNW-QZw4Tz33LCoZgR33B3Fi_bqXGLgGaZ5gQkAJGTQaLUzKuS_BP21ygep68mRwu6rjg9HXOyGlrBbBxN_dKHifbcHgMeVFl5PGhcsU2dvCG9agGqRyIPwJfTWORz7_af27hLTUpcFqbbOWw_b_SPZ_Lr23_M6bi4dXAih4ZKtZbis6pyQ
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:02 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 16 Dec 2021 12:51:02 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0481
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Ybs2NpTxL6NV280fo-f2kgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1

43 B
894 B

27ms
21ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNW-QZw4Tz33LCoZgR33B3Fi_bqXGLgGaZ5gQkAJGTQaLUzKuS_BP21ygep68mRwu6rjg9HXOyGlrBbBxN_dKHifbcHgMeVFl5PGhcsU2dvCG9agGqRyIPwJfTWORz7_af27hLTUpcFqbbOWw_b_SPZ_Lr23_M6bi4dXAih4ZKtZbis6pyQ
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:02 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 16 Dec 2021 12:51:02 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE0MAety60foZwwStqoK4AI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 0481
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBFQ6QAr-X0V-qW4DkScK5o&google_cver=1

43 B
1008 B

46ms
46ms

Image
image/gif

185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBFQ6QAr-X0V-qW4DkScK5o&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNW-QZw4Tz33LCoZgR33B3Fi_bqXGLgGaZ5gQkAJGTQaLUzKuS_BP21ygep68mRwu6rjg9HXOyGlrBbBxN_dKHifbcHgMeVFl5PGhcsU2dvCG9agGqRyIPwJfTWORz7_af27hLTUpcFqbbOWw_b_SPZ_Lr23_M6bi4dXAih4ZKtZbis6pyQ

Protocol

HTTP/1.1

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:02 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 623.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 61cd75e0-bad9-462f-8aaf-01e9c09b1972
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBFQ6QAr-X0V-qW4DkScK5o&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0481
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc4ODQ0NjQ1MjcxODQ5NjQ1MQ%3D%3D

170 B
243 B

72ms
72ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc4ODQ0NjQ1MjcxODQ5NjQ1MQ%3D%3D

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:02 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 623.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0cbab9e4-99ff-4581-ba83-98791e9a4acc
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc4ODQ0NjQ1MjcxODQ5NjQ1MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EB15 0
0 72ms
72ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQN0dOWkRz_ERH3LkLFHy47TaVOMYdbx2amYL8xTYcGLRbACSibxc6byFXxyK0Xbsc3M5EgeegiRLJghLDh_HmfnKiLhuyCQTQ-w7e3RoqfNmDi22H9rr4b83sWvQj0BRRSoIpue8oIU16J4SdPRfIUb8ldQVn9ODO5RO8NYi88q577rSYCFQPW-eF-hkBBx5kcDLQfemTfoJk1BRYEsvsH32xArIt8c4O9g6LLLfVhFJpiM3ndPFhCWUcNBw32LTgb2rvy6ldHKN03M2W0qk8caz0dZXf3RRTuOppVtq_DpovVYyIeGVLSDt1sFVV00poLlO-RTlYcQiGOEoQaSOD&sai=AMfl-YS7u26u92fJhXU1sgnH_nnfhGrcGOo0S_J1cPlviXaBi7NKxN7JGx5p6W6jMR0MjneMUsXljKW-d4FjDF7dnoi-XA86fQcgifB50Ngk91peG3mn1Enqmg2Zdwu_qgk&sig=Cg0ArKJSzA457RdDsp9iEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
DATA 200
OK truncated
/ Frame EB15 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f2664874071206d407f0f842bb7486710a6b644a91f8763de7323271d6d0a24

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 126ms
126ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTU4MTgyMjk3OSIsImVidXkiOiIyNzk5MTczMjc5IiwiZWFkdiI6IjQ4MjY4MTgwNjkiLCJlY2lkIjoiMTM4MzM5MTAwOTYyIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9JblN0b3J5XzcyOHg5MCIsImVzaWQiOm51bGwsInNpemUiOiI3Mjh4OTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=e22ea9f7-3a2e-4358-a8fc-14d6e9873365&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062307&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4576&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8BB3 0
0 104ms
103ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvvlGi504AHLPxeeQW0MkOIbxZGODimJQnUu5UPpd83vepW9rruBW7ArGaNSBv03gisqodROYChN-zPE7u0UyYkcKScYfLEGl9VBN5-LLnO38_10-ul0Lhh_B4fLKCRSMjq-YRS8ZYKcNGaHe8BwazW7i7AtoRqdVQv24kwt2MEx7qnHfRr0Mg657Fm7cpiwwU_2O2PA3kLktFQPgG7oWs3L7Xv-irmUiqbvW6xA01kkhoo63iSCGGarP-VVdpi2ej5T6a2Eu7zDp80DolOrby-6AeUyRl1h3ZIoWVfq_F3yZgufgmQwa7JK5VguOS0DyK5X09peoyIeBmjPpWWaAUWeDqmyTfGmA&sai=AMfl-YS8Itj1dodLzLXjD01KnNVsOWjv3Bu6F4LCbf0cpHtEToSLUd9iQ_SeNTGKQ8qQ_T_VSnojDcMjew7Ii__luqYJhVGXmZquZofexg69rV0CoFjgl3nRNUzVrosEkjk&sig=Cg0ArKJSzH3rCIVP7dpiEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
DATA 200
OK truncated
/ Frame 8BB3 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 324f166ee7e8ff95bb43a6020bbfc4ed3ab6b942930d99af565a5caf088f5514

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6FE9 0
0 82ms
81ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuBgkMk9xTGJepRDZcOWTBi5A9tFuRkAXh39H_VCKTT64jHnlvPyTkG2gVRCeqBVn8alNY2vtY-aojuE4bi0nPrSXWx_KpCQe5JhkarypbkANg3YKcTx-EJ9BxRR7yEFuVuY8ASLALecs-zaYilzWYnGvQyAqyMiY4Iv8qMocYzFuQHABXXmZQqMSPvj9tTlRfjDLBFrTBamq0CrtdvRftf3HmQfoUvvoPBRNUZ_nj8td6CtZ6PqqZrmde5bXdPD_oz9LUqiKwY5kXQr54vWmitywavIvxB4pos3-gL-lZ__oJnzncncQkX2aeOS1j-2aMPi4UeCivKo1MMcJ7p_RyeQw&sai=AMfl-YRqWXro7ycv-RGsx3HajPBqucp36Wj8uiY5lMj-fBbjSKx7edulz3NDELs3Rd77-SftkoQEvQrc3XrakM9op5xLTVG_edTUlGmXm5OC0ytFR6HuPlxR_xoG1OGIMtA&sig=Cg0ArKJSzIHgkKt7pdRWEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
DATA 200
OK truncated
/ Frame 6FE9 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 432afd7c7188562f355165fc68a8e628f035a81e338a51cf355cc1e55c929233

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FD7B 0
0 73ms
73ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstNDVqTo0Vc_hnoB4jP0ImLEEuXDYJgqeEIKZwYbOGFhYQQiP0R02RxtgbCKFr82hcQNiJ6ViJv9VwB6Z5j8yDZERnOCDfTZqvnGkLqLjHDFH0TRDHwh81SMvhRyLZox-me8oOt0B5_5pvJGMVan39Ln-POO5-Qhr1iMto2F9le9_dMRGITeq3B2eMDKcTf5Qq8_dviMH2jrMEJrtp-3T6W11HHR-RjK2f8Sngyer51kcWRnYv7uDQ1onQvi8cR4YkL3_-WOKxnInCE3PaIFHwkalpUgNebp49VFG3OOFT4l26wgLkgZpz5tiiRd9k9V9TyySek_HihEF_wWw&sai=AMfl-YTRXWlepB5bfd0Fpn4_ZEc_6TeyjlDScWfEeyi1PkJKXSxd0-9d334oS7lPo7LYdNcFU2UXUKTF5pxGk1htOiPpz3QENEf9Z8VhG0nHsWXirmmreJis904k4PYkmqk&sig=Cg0ArKJSzH6D4v2FbsFFEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:02 GMT

GET
DATA 200
OK truncated
/ Frame FD7B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6bc2961f59c01ea3adeae738e02e2b817a4753ebfa58684646282c84e6301d91

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FD96 22 KB
8 KB 46ms
46ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 15 Dec 2021 11:30:32 GMT
expires: Thu, 15 Dec 2022 11:30:32 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 91230
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK k87fl8jofdhz Show response
hal9000.redintelligence.net/zone/ Frame AD43 11 KB
4 KB 119ms
52ms Script
text/html 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/k87fl8jofdhz?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLUf-NDa7YcfHNrK5lQf5vbfgAo_g-IZT_bGLpMoM8C4QASDDoPwBYJXikIKgB8gBCakCLN9BhWL7sj6oAwGqBJkCT9CAEItFPl71b8BMMPVXTYsnmnfJXTfG-Zi2lDCZTLY-itQKhJLIoTEKRFMWxc5fwxMsbI387VIWH3IeBRM4hlDanmxHWyBeadj2sUDDwaRtYhF0UGS37yYSsKqeHMEsOCw5s1CRrMUoxjPaXM_O9DzglqgPJtpBfjcGfaRKbDbcx5x0h1_LBSl7QHnIcHwDSsppw0IxQUrbOO_qrO0GzA6vVOPJZz2j8LrIskJzPy8JHSVF0ginqaIUI1R2lDgtPW0J0ylPWG9LNIJgIaCg-TKciW_3QcWO0UhrWJlaIMddOvm4fdaaBmu-R1I3750aZsweJOP-c6HQwhfxt92PyKJaeIOymv7oBmQP3862gH2UtRgZfhPtxX7ABLvxqMDPAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA%26sig%3DAOD64_10H-l_OckTO2Oyv6rSY0sXDbgWzQ%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-Aizz2NA6wlG4dPrrp6WJqAeaXIZ4uet3VFLIGZiVgsKHeBaR-y-v8Zu0PEGurT64blRfCJyVXi1eeWR5Z6Wdl-4RgoZ64uTcSJNcjHMc4qn457quZTbyFhxQy_T-FlO7tU5M-OQIrk3C2qg9S3hgfHzS9RCA%26cry%3D1%26dbm_d%3DAKAmf-CXrExPXgC5MLHg2PfXFHJtAPhYg0ZSvisgwcrrnxZZRauUn7HzkNBsshuPXNbOU3BexkwV7_1uV1-Iz5tCaa2d-kgO2bXN7xND1_zF-LWDAhklxTkyJgy1N-l1fhQDbfrKHOlmN5B2HckDhKGNjJZ2R5v5pYR2381F3ox3s7jALx5GGAy6-grLAIaLBONz0Ok8dBcTZ1Igra99SEBlg7WpRYHO2OJrLnuIsfv68M_nkEgQV6n8VIdJjYEREIZsWu3k258b36xmuHw5eBW7VSfLbMcAc-d9iJURDeUbYAvk9am3GSeWRPnxnRf-PqeI3-JRwFSdHWJ_N0ZuqVUqA1Mib2TEy5f9xk9hwssg3L0OoSXFtJHyS19cHGIW-0LH2ay9MIQdYS55JtZqnDOXMpowzuksoSfqfQrKi1fHUCXMzHav1-Vqr15rxAwSqN8cDFSVBUkjc1ZXRY3UJKklmicnyp9dqEuarEpGI_2tgxocRoeRUsDwJIMh6ovxScQoY_jwoaqzBhepFL0yx0A-x9JR15y1jb1w64gzUunn67JvLwV6W6o%26adurl%3D
Requested by: Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: ba221a9ab9e5ede2412c201dfb8080fa5a33c57cbdadc35efd0a81d30a9fe59b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4035
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame CB3A 33 KB
16 KB 175ms
24ms Script
text/javascript 37.157.6.236
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: a2.adform.net
URL: https://a2.adform.net/adfscript/?bn=51797166;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjst2_yesNUdMbQO5DQkazCO9uyPDX4Xru5GgB5GxxrKqZNaat0vVHtJB_jgPUSnmPVyfkLbm2WBboGbhjPQ_-_4U9wBl-2zedxLOZjRXI8n78AUtwUJR60tn8w1XKNiIfkaI_D0e2w2vRdAARtLA3hEnn2sAJDrGGGZflRdaAfoK7tSp1mj-ZzL5ccV_YRVLbbX6T_O6xwfZ0xRpKQwdfP1Uqw8LuGTEIRooY5hIgD1JgQ60f91gHY-afn88uSI7XdkTuYgcggmQtkxYcoNbU9A0YmxA5Y2xMnGwEwb2vjWoTNPpjnWqU1i9d0SxEN6DzQnHJCCHeZfNqjns&sai=AMfl-YTot3Go4RmbXsRhXQR29C897fjJC7X36EWCIUVjomIwB0XEJgpAbo7EI_tJItWYOWYWXavgTX6ZhPuMHlSWylkwR4z8MRP15iiGnpvuPN5gGewDw22ywtJ6hhtpk2g&sig=Cg0ArKJSzNuup0UH1ZX7EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 30d2143e5e0ad4af94bf25a55ea17ac1451f5f8b91ff96dc4a32b4791aaeeab8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:02 GMT
content-encoding: gzip
last-modified: Wed, 01 Dec 2021 14:23:05 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 17 Dec 2021 16:14:47 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 103ms
103ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTg1MDQ2NzQ5NCIsImVidXkiOiIyOTQ2ODA0NDc4IiwiZWFkdiI6IjUwODAxMzcyOTMiLCJlY2lkIjoiMTM4MzY3NzU4OTY1IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX1RvcF8zMDB4MjUwIiwiZXNpZCI6bnVsbCwic2l6ZSI6IjMwMHg2MDAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=b6db9488-6017-4544-aeb2-17c2d1ed5b8a&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062308&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4576&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 200 U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js Show response
pagead2.googlesyndication.com/bg/ Frame FD96 35 KB
13 KB 84ms
83ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53f0cf5f2fef7e5a938d553f62eb56266d1ac4e244eb7dcd40630614485fdacd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 22:53:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 136665
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13577
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 Dec 2022 22:53:17 GMT

GET
H/1.1

200
OK

request.php Show response
hal90007.redintelligence.net/ Frame AD43
Redirect Chain

https://hal90007.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90007.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

100ms
78ms

Script
application/x-javascript

138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLUf-NDa7YcfHNrK5lQf5vbfgAo_g-IZT_bGLpMoM8C4QASDDoPwBYJXikIKgB8gBCakCLN9BhWL7sj6oAwGqBJkCT9CAEItFPl71b8BMMPVXTYsnmnfJXTfG-Zi2lDCZTLY-itQKhJLIoTEKRFMWxc5fwxMsbI387VIWH3IeBRM4hlDanmxHWyBeadj2sUDDwaRtYhF0UGS37yYSsKqeHMEsOCw5s1CRrMUoxjPaXM_O9DzglqgPJtpBfjcGfaRKbDbcx5x0h1_LBSl7QHnIcHwDSsppw0IxQUrbOO_qrO0GzA6vVOPJZz2j8LrIskJzPy8JHSVF0ginqaIUI1R2lDgtPW0J0ylPWG9LNIJgIaCg-TKciW_3QcWO0UhrWJlaIMddOvm4fdaaBmu-R1I3750aZsweJOP-c6HQwhfxt92PyKJaeIOymv7oBmQP3862gH2UtRgZfhPtxX7ABLvxqMDPAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA%26sig%3DAOD64_10H-l_OckTO2Oyv6rSY0sXDbgWzQ%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-Aizz2NA6wlG4dPrrp6WJqAeaXIZ4uet3VFLIGZiVgsKHeBaR-y-v8Zu0PEGurT64blRfCJyVXi1eeWR5Z6Wdl-4RgoZ64uTcSJNcjHMc4qn457quZTbyFhxQy_T-FlO7tU5M-OQIrk3C2qg9S3hgfHzS9RCA%26cry%3D1%26dbm_d%3DAKAmf-CXrExPXgC5MLHg2PfXFHJtAPhYg0ZSvisgwcrrnxZZRauUn7HzkNBsshuPXNbOU3BexkwV7_1uV1-Iz5tCaa2d-kgO2bXN7xND1_zF-LWDAhklxTkyJgy1N-l1fhQDbfrKHOlmN5B2HckDhKGNjJZ2R5v5pYR2381F3ox3s7jALx5GGAy6-grLAIaLBONz0Ok8dBcTZ1Igra99SEBlg7WpRYHO2OJrLnuIsfv68M_nkEgQV6n8VIdJjYEREIZsWu3k258b36xmuHw5eBW7VSfLbMcAc-d9iJURDeUbYAvk9am3GSeWRPnxnRf-PqeI3-JRwFSdHWJ_N0ZuqVUqA1Mib2TEy5f9xk9hwssg3L0OoSXFtJHyS19cHGIW-0LH2ay9MIQdYS55JtZqnDOXMpowzuksoSfqfQrKi1fHUCXMzHav1-Vqr15rxAwSqN8cDFSVBUkjc1ZXRY3UJKklmicnyp9dqEuarEpGI_2tgxocRoeRUsDwJIMh6ovxScQoY_jwoaqzBhepFL0yx0A-x9JR15y1jb1w64gzUunn67JvLwV6W6o%26adurl%3D&documentReferer=https%3A%2F%2Fwww.spokesman.com%2F&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=381556123018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.157 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 18e0b50e12f93086cfb9acdf9deda140f94346bea98c89632b67a15135b45a5d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:03 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 22880800092894300710580011810007
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1052
Expires: Thu, 16 Dec 2021 12:51:03 +0100

Redirect headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:02 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLUf-NDa7YcfHNrK5lQf5vbfgAo_g-IZT_bGLpMoM8C4QASDDoPwBYJXikIKgB8gBCakCLN9BhWL7sj6oAwGqBJkCT9CAEItFPl71b8BMMPVXTYsnmnfJXTfG-Zi2lDCZTLY-itQKhJLIoTEKRFMWxc5fwxMsbI387VIWH3IeBRM4hlDanmxHWyBeadj2sUDDwaRtYhF0UGS37yYSsKqeHMEsOCw5s1CRrMUoxjPaXM_O9DzglqgPJtpBfjcGfaRKbDbcx5x0h1_LBSl7QHnIcHwDSsppw0IxQUrbOO_qrO0GzA6vVOPJZz2j8LrIskJzPy8JHSVF0ginqaIUI1R2lDgtPW0J0ylPWG9LNIJgIaCg-TKciW_3QcWO0UhrWJlaIMddOvm4fdaaBmu-R1I3750aZsweJOP-c6HQwhfxt92PyKJaeIOymv7oBmQP3862gH2UtRgZfhPtxX7ABLvxqMDPAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA%26sig%3DAOD64_10H-l_OckTO2Oyv6rSY0sXDbgWzQ%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-Aizz2NA6wlG4dPrrp6WJqAeaXIZ4uet3VFLIGZiVgsKHeBaR-y-v8Zu0PEGurT64blRfCJyVXi1eeWR5Z6Wdl-4RgoZ64uTcSJNcjHMc4qn457quZTbyFhxQy_T-FlO7tU5M-OQIrk3C2qg9S3hgfHzS9RCA%26cry%3D1%26dbm_d%3DAKAmf-CXrExPXgC5MLHg2PfXFHJtAPhYg0ZSvisgwcrrnxZZRauUn7HzkNBsshuPXNbOU3BexkwV7_1uV1-Iz5tCaa2d-kgO2bXN7xND1_zF-LWDAhklxTkyJgy1N-l1fhQDbfrKHOlmN5B2HckDhKGNjJZ2R5v5pYR2381F3ox3s7jALx5GGAy6-grLAIaLBONz0Ok8dBcTZ1Igra99SEBlg7WpRYHO2OJrLnuIsfv68M_nkEgQV6n8VIdJjYEREIZsWu3k258b36xmuHw5eBW7VSfLbMcAc-d9iJURDeUbYAvk9am3GSeWRPnxnRf-PqeI3-JRwFSdHWJ_N0ZuqVUqA1Mib2TEy5f9xk9hwssg3L0OoSXFtJHyS19cHGIW-0LH2ay9MIQdYS55JtZqnDOXMpowzuksoSfqfQrKi1fHUCXMzHav1-Vqr15rxAwSqN8cDFSVBUkjc1ZXRY3UJKklmicnyp9dqEuarEpGI_2tgxocRoeRUsDwJIMh6ovxScQoY_jwoaqzBhepFL0yx0A-x9JR15y1jb1w64gzUunn67JvLwV6W6o%26adurl%3D&documentReferer=https%3A%2F%2Fwww.spokesman.com%2F&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=381556123018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Thu, 16 Dec 2021 12:51:02 +0100

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 101ms
101ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTg1MDI2NzczNyIsImVidXkiOiIyOTQ2MzA5MDU4IiwiZWFkdiI6IjQ3ODQzNTkxNjEiLCJlY2lkIjoiMTM4Mzc1NDI0MjI4IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX0Rhc2hib2FyZF8zMDB4MjUwIiwiZXNpZCI6bnVsbCwic2l6ZSI6IjMwMHgyNTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=1b45b01e-ba1a-47d0-8245-6765316c5ad7&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062309&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4576&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:02 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H2 200 / Show response
a2.adform.net/adfserve/ Frame CB3A 5 KB
3 KB 89ms
89ms Script
text/javascript 185.167.164.51
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/adfserve/?CC=1&bn=51797166;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjst2_yesNUdMbQO5DQkazCO9uyPDX4Xru5GgB5GxxrKqZNaat0vVHtJB_jgPUSnmPVyfkLbm2WBboGbhjPQ_-_4U9wBl-2zedxLOZjRXI8n78AUtwUJR60tn8w1XKNiIfkaI_D0e2w2vRdAARtLA3hEnn2sAJDrGGGZflRdaAfoK7tSp1mj-ZzL5ccV_YRVLbbX6T_O6xwfZ0xRpKQwdfP1Uqw8LuGTEIRooY5hIgD1JgQ60f91gHY-afn88uSI7XdkTuYgcggmQtkxYcoNbU9A0YmxA5Y2xMnGwEwb2vjWoTNPpjnWqU1i9d0SxEN6DzQnHJCCHeZfNqjns&sai=AMfl-YTot3Go4RmbXsRhXQR29C897fjJC7X36EWCIUVjomIwB0XEJgpAbo7EI_tJItWYOWYWXavgTX6ZhPuMHlSWylkwR4z8MRP15iiGnpvuPN5gGewDw22ywtJ6hhtpk2g&sig=Cg0ArKJSzNuup0UH1ZX7EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=;js=1;adfxid=1x;1931;set=en-US|en-US|1600X1200|0|750|100|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fwww.spokesman.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.51 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

b63e9c10a834e1367c980e9674536971b0e4a23670768439c60c848343958948

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:03 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 2569
expires: -1

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 102ms
101ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTU4MTgyMjk3OSIsImVidXkiOiIyNzk5MTczMjc5IiwiZWFkdiI6IjQ4MjY4MTgwNjkiLCJlY2lkIjoiMTM4MzM5MDMxNjczIiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9OZXdzX01pZGRsZV8zMDB4MjUwIiwiZXNpZCI6bnVsbCwic2l6ZSI6IjMwMHg2MDAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=df9142ba-aa30-4f5e-ab3f-f2188472cd0a&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062309&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4576&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FD96 0
20 B 72ms
72ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BtyuINja7YZyjH5eLjuwPmMCH2A0AAAAAOAHgBAI&bg=!2dql2p7NAAZKWFskSlg7ACkAdvg8WmOZeZXIk1uaDg1x6EYiDI9G1yjfWMwVj9vHuVM7iPA1ELlJJgIAAAGLUgAAAARoAQeZAvd4b2lIbXod1iH9E_wipLpD9k9fnI7wlCWmHFBre-TWnjZnYfCz4V-ozyTb7HGSlyKL9yus11piP1ZGuqqTNhF1b8IpF8dN2ntUbSCSKOAGEpqh3Lb1HNHyg4FnehpFJ52vZKjvpOwMptiSBQsvUE3Ne9rhtta9ByL6FvkU_BNaQNZhGv-nJiKIq10b2kQYbXbFrsoPVHKZd_5G0HVTZ6pScqMIWMnQNTcPm-mPc1kBBPHzwm2LlFA5k_OQTPJX96QRkfzwrGnAyRSshux3AfY1D9wu1npFRH4hbm8vt46PrI0UMuEXZoSO9UtgZfg8sFXb6E-dvnXv2V3ko-bf6gqxkDBZ3jcH_Mnn8mLtvYSPK7jtR9gMeqGZMpLjIUz2yWib02Lwscs_HjvtaN4l_qMFSHquJLq-jHzoKT-UIALsu5BI4PhKjGzsam19Q4BHKvbe6F4Y7R5XvGs78-wuStN7aECaLRUSXMb1w5i2Pn-dtyRwJh29HOhpdzhEjVPmELSJ3PehsR8O-8bhG-ocHlbs06sg4H02qJtw8tnDt1Pg0UNEKBCjSrCqptBx-b1RCWlAOJgDdS16RbwvevRHL_M5BXYYy41Z18VmmVdf92tjN2_yaJL-3ISJZ91ao50x8KKBR8XZKTlfOzA5fY_MzvIH-CIs8gHkCGfLtKHyIEdytZAZcoXI6QI6wdFiBen_ZwImQN9s1bbIVDZ_gXJyO2YoG1JD56qmC_g7sn2w63JQ2SfAKMWYyqGYlI0neNhLOnkx8kUSoMO7A_qUiwra5r3w67B5L_j9OZOnzDdlWhZ1UUSZGODEWBr_svfjUIc_3dQmUqitWzJtT9BkuEz5pcbmfrAOUsHeQzwPW8opVJhbeJ65X57k5GOX8aN39aeRx1BylFGptvd-uwsuTH06_E1s2PvdH2qpzckhEo1LB12YK8GYY7XRFg4CTf2Tk1KNNzm9NjSybtb-0OXQasLn6ZKlIvVk1M5DQHARDQaUxgASLcniXNi5EWc

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 15BA
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=22880800092894300710580011810007&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22880800092894300710580011810007&actionid=879111&produktid=ratenkredit&dt_url=

0
628 B

115ms
75ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22880800092894300710580011810007&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLUf-NDa7YcfHNrK5lQf5vbfgAo_g-IZT_bGLpMoM8C4QASDDoPwBYJXikIKgB8gBCakCLN9BhWL7sj6oAwGqBJkCT9CAEItFPl71b8BMMPVXTYsnmnfJXTfG-Zi2lDCZTLY-itQKhJLIoTEKRFMWxc5fwxMsbI387VIWH3IeBRM4hlDanmxHWyBeadj2sUDDwaRtYhF0UGS37yYSsKqeHMEsOCw5s1CRrMUoxjPaXM_O9DzglqgPJtpBfjcGfaRKbDbcx5x0h1_LBSl7QHnIcHwDSsppw0IxQUrbOO_qrO0GzA6vVOPJZz2j8LrIskJzPy8JHSVF0ginqaIUI1R2lDgtPW0J0ylPWG9LNIJgIaCg-TKciW_3QcWO0UhrWJlaIMddOvm4fdaaBmu-R1I3750aZsweJOP-c6HQwhfxt92PyKJaeIOymv7oBmQP3862gH2UtRgZfhPtxX7ABLvxqMDPAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA%26sig%3DAOD64_10H-l_OckTO2Oyv6rSY0sXDbgWzQ%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-Aizz2NA6wlG4dPrrp6WJqAeaXIZ4uet3VFLIGZiVgsKHeBaR-y-v8Zu0PEGurT64blRfCJyVXi1eeWR5Z6Wdl-4RgoZ64uTcSJNcjHMc4qn457quZTbyFhxQy_T-FlO7tU5M-OQIrk3C2qg9S3hgfHzS9RCA%26cry%3D1%26dbm_d%3DAKAmf-CXrExPXgC5MLHg2PfXFHJtAPhYg0ZSvisgwcrrnxZZRauUn7HzkNBsshuPXNbOU3BexkwV7_1uV1-Iz5tCaa2d-kgO2bXN7xND1_zF-LWDAhklxTkyJgy1N-l1fhQDbfrKHOlmN5B2HckDhKGNjJZ2R5v5pYR2381F3ox3s7jALx5GGAy6-grLAIaLBONz0Ok8dBcTZ1Igra99SEBlg7WpRYHO2OJrLnuIsfv68M_nkEgQV6n8VIdJjYEREIZsWu3k258b36xmuHw5eBW7VSfLbMcAc-d9iJURDeUbYAvk9am3GSeWRPnxnRf-PqeI3-JRwFSdHWJ_N0ZuqVUqA1Mib2TEy5f9xk9hwssg3L0OoSXFtJHyS19cHGIW-0LH2ay9MIQdYS55JtZqnDOXMpowzuksoSfqfQrKi1fHUCXMzHav1-Vqr15rxAwSqN8cDFSVBUkjc1ZXRY3UJKklmicnyp9dqEuarEpGI_2tgxocRoeRUsDwJIMh6ovxScQoY_jwoaqzBhepFL0yx0A-x9JR15y1jb1w64gzUunn67JvLwV6W6o%26adurl%3D&documentReferer=https%3A%2F%2Fwww.spokesman.com%2F&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=381556123018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Mannheim, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 16 Dec 2021 01:51:04 GMT
server: Microsoft-IIS/10.0
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Thu, 16 Dec 2021 12:51:03 GMT
content-length: 0

Redirect headers

Server: nginx/1.19.7
Date: Thu, 16 Dec 2021 12:51:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.34
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22880800092894300710580011810007&actionid=879111&produktid=ratenkredit&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: B9D59BA5:9A82_91EFC182:01BB_61BB3637_168F4EE6:627C
X-IPLB-Instance: 40027
Cache-control: private

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame AD43 1 KB
2 KB 455ms
137ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3432245&wgcampaignid=99582&viewref=22880800092894300710580011810007&js=1&nw=1
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: e34d390cdb0cab173611c3071e48f0b8288ef85367a18b380373dfb3ecd25f2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:03 GMT
Last-Modified: Thu, 16 Dec 2021 12:51:03 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1239
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90007.redintelligence.net/ Frame 2A30 7 KB
2 KB 35ms
12ms Document
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=f11880ba9a&subid=&uid=21e37916689f39f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLUf-NDa7YcfHNrK5lQf5vbfgAo_g-IZT_bGLpMoM8C4QASDDoPwBYJXikIKgB8gBCakCLN9BhWL7sj6oAwGqBJkCT9CAEItFPl71b8BMMPVXTYsnmnfJXTfG-Zi2lDCZTLY-itQKhJLIoTEKRFMWxc5fwxMsbI387VIWH3IeBRM4hlDanmxHWyBeadj2sUDDwaRtYhF0UGS37yYSsKqeHMEsOCw5s1CRrMUoxjPaXM_O9DzglqgPJtpBfjcGfaRKbDbcx5x0h1_LBSl7QHnIcHwDSsppw0IxQUrbOO_qrO0GzA6vVOPJZz2j8LrIskJzPy8JHSVF0ginqaIUI1R2lDgtPW0J0ylPWG9LNIJgIaCg-TKciW_3QcWO0UhrWJlaIMddOvm4fdaaBmu-R1I3750aZsweJOP-c6HQwhfxt92PyKJaeIOymv7oBmQP3862gH2UtRgZfhPtxX7ABLvxqMDPAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoD458lpzK_PHIFkR6ZD4DYtI-jA%26sig%3DAOD64_10H-l_OckTO2Oyv6rSY0sXDbgWzQ%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-Aizz2NA6wlG4dPrrp6WJqAeaXIZ4uet3VFLIGZiVgsKHeBaR-y-v8Zu0PEGurT64blRfCJyVXi1eeWR5Z6Wdl-4RgoZ64uTcSJNcjHMc4qn457quZTbyFhxQy_T-FlO7tU5M-OQIrk3C2qg9S3hgfHzS9RCA%26cry%3D1%26dbm_d%3DAKAmf-CXrExPXgC5MLHg2PfXFHJtAPhYg0ZSvisgwcrrnxZZRauUn7HzkNBsshuPXNbOU3BexkwV7_1uV1-Iz5tCaa2d-kgO2bXN7xND1_zF-LWDAhklxTkyJgy1N-l1fhQDbfrKHOlmN5B2HckDhKGNjJZ2R5v5pYR2381F3ox3s7jALx5GGAy6-grLAIaLBONz0Ok8dBcTZ1Igra99SEBlg7WpRYHO2OJrLnuIsfv68M_nkEgQV6n8VIdJjYEREIZsWu3k258b36xmuHw5eBW7VSfLbMcAc-d9iJURDeUbYAvk9am3GSeWRPnxnRf-PqeI3-JRwFSdHWJ_N0ZuqVUqA1Mib2TEy5f9xk9hwssg3L0OoSXFtJHyS19cHGIW-0LH2ay9MIQdYS55JtZqnDOXMpowzuksoSfqfQrKi1fHUCXMzHav1-Vqr15rxAwSqN8cDFSVBUkjc1ZXRY3UJKklmicnyp9dqEuarEpGI_2tgxocRoeRUsDwJIMh6ovxScQoY_jwoaqzBhepFL0yx0A-x9JR15y1jb1w64gzUunn67JvLwV6W6o%26adurl%3D&documentReferer=https%3A%2F%2Fwww.spokesman.com%2F&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=381556123018&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9dd881c7f521ccbc11afbe56d2634c6c02790ed7abbae20eb532366d6b42543a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 16 Dec 2021 12:51:03 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2098
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame AD43
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22880800092894300710580011810007
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22880800092894300710580011810007
https://ad-server.eu/wm/pb/native.png

68 B
312 B

155ms
29ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:55:46 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Server: nginx/1.17.5
X-IPLB-Request-ID: B9D59BA5:9A94_91EFC182:01BB_61BB3637_168E65EA:627A
X-Powered-By: PHP/7.2.21
X-IPLB-Instance: 40027
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame AD43 43 B
704 B 335ms
48ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2601049&v=18332&q=376776&r=296283&pref1=22880800092894300710580011810007&pv=1

Requested by

Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:03 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
DATA 200
OK truncated
/ Frame AD43 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a6511ab2409265fe4c48f0b4fd0daca4e5301bdd6fc8a74bff2ef1e5b309ccac

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 101ms
101ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTIzOTEzMzY2NSIsImVidXkiOiIyMzEzNzk1NzgxIiwiZWFkdiI6IjQ1NzEwODI5NDAiLCJlY2lkIjoiMTM4MzcwNTI5MjI3IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9TaWRlUmFpbF8xMDB4NTI1IiwiZXNpZCI6bnVsbCwic2l6ZSI6IjEwMHg1MjUiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=f424e5e6-8b81-4f25-8a10-56b102095d4e&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659062310&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4576&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9B71 42 B
64 B 72ms
72ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssKT8cGok5Q1RjIGx-0z2YpopVKYEKnV08OmPDnGfSN7CosC71g_nnissYDEZim9XNBMLviTgHLHpLnMdDox_n8YsTg2XXqCsA8G63BnjjU05VYYu5a&sig=Cg0ArKJSzNBzL8gjfHFtEAE&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=2822441466&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639659062256&rpt=278&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame CB3A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 802d854dc9807d9ea486614494e54c22469bcbd0a4c165e25a92e02ce2d82e09

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CB3A 0
0 74ms
73ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstO7DL_SRALOiRn6wa5htS2q4Wg1Bd2bK8DPGdpd7C-iQHyq1CVKapQyJCKEky2kSANf2uIXw7y1UQzgX3MuWccTjm4oYJ1Oe-t3vt6MVJhaF7EA1PnznwF5NNgDymqZ5pRTyAgMVzQ9Fs-pZ8MOCfMsPJjaKYaJ0Hoo7c5esnzQMoZI44lkJtG04165Xz8bWZ4w3nowvN74QO7Ubfe_ifqfLuDIFIyeUjQ9d9jpECIDUYUK3UkE94fYNDsln7l0yTBTkQcYPZ3eVfsAZ3l1leADYi_hg2TpllVP9eojhXZzZOBHkE0RuwH4f5dP51vLC62Sx8lRsWIdSSWVZ63dd8&sai=AMfl-YRUqHVxmfnu4WkP5gJPzHXQpe6ZzrfIgP5bCjl1WyIfph7NLLXHynVn3nQRgjh4zVJ6J1CcPPE1Bi_2M7AVU6oRKU0a_aAZEqRucgC-ljEiGLylqMW0vhCzNw2_g5E&sig=Cg0ArKJSzJ2W5CfbD2tMEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Dec 2021 12:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 16 Dec 2021 12:51:03 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EB15 42 B
64 B 85ms
85ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvBy3h00iFoBj1Qk02F4pQExEOGZy8ngseo_vDOlsjau72h6dHGJgSq433DqjNv7BsBqPi4m8QzPCreWlexoVUssT43rH-B67M68Ncy5JeTNb_nXgB_&sig=Cg0ArKJSzA7G0MPgRZP6EAE&id=lidar2&mcvt=1006&p=338,1500,863,1600&mtos=1006,1006,1006,1006,1006&tos=1006,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=2731099659&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639659062296&rpt=302&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 2A30 1 KB
921 B 152ms
49ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 16 Dec 2021 12:22:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 16 Dec 2021 12:51:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 16 Dec 2021 12:51:03 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2A30 16 KB
16 KB 35ms
13ms Image
image/png 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: b29e096fad99b50a208e6afc10bb138117361fbfa79fb0391dd537eb1aee66e4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16248
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2A30 15 KB
15 KB 35ms
13ms Image
image/png 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52113/creativesup/TRG-star-wars-marvel-comics-panini-banner-1200x627.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 74968c2eb2c9eb642e9727e95fc845c69c8783922e368d5e844ac7446b7b6146

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15272
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2A30 15 KB
15 KB 37ms
13ms Image
image/png 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52343/creativesup/1200x627_2.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 42cfa647cc7b2d88d12aeaae7d09e1a91757e5ac2672fef2cfb681124759f1d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15250
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.212/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/ImageTag:types/ Frame CB3A 85 KB
36 KB 54ms
54ms Script
text/javascript 37.157.6.236
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.212/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/ImageTag:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 1f647589f081c26a24954bf8f32fb7ea1b828fe3a41cebc760154191a167efea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:03 GMT
content-encoding: gzip
last-modified: Wed, 01 Dec 2021 14:23:05 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 17 Dec 2021 16:14:53 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6FE9 42 B
64 B 71ms
71ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu2fUqgSGr-3uY0x-bqrWUFJzANcUVEJra8rY__ATeJEa2MJY6PEUexZ4dFon--WDFYyqsrzvY_eYHUJJJjMELq-_kxyJeWOEdJxfvcFYWwL9-JLS-g&sig=Cg0ArKJSzFVaGUelBP96EAE&id=lidar2&mcvt=1001&p=306,1236,906,1536&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=1616198098&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639659062276&rpt=376&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
a2.adform.net/csimpr/ Frame CB3A 35 B
503 B 87ms
87ms Ping
image/gif 185.167.164.51
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/csimpr/?bn=51797166&csi=-xJDHvzgZdI3nFxHRD-Y02bOrx-bKy5c9DYIX7n04YfrygPkIxxfkyKk-oRos5j2uQMw50sTkqnvn-GCvYUaWt6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.51 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:03 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 49565650.jpg
s1.adform.net/Banners/49565650/ Frame CB3A 41 KB
41 KB 28ms
28ms Image
image/jpeg 37.157.6.236
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/49565650/49565650.jpg?bv=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.236 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

918c5c89b6df58895dbc7ea7663dae669300da3a79e2857e443d1d66265a92f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 12:51:03 GMT
last-modified: Wed, 10 Nov 2021 23:23:59 GMT
server: nginx
etag: "618c548f-a46f"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 42095

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame AD43 51 KB
51 KB 48ms
8ms Script
application/javascript 143.204.98.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3432245&wgcampaignid=99582&viewref=22880800092894300710580011810007&js=1&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-5.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: wvDglZsFnxZ0eZ1mUErJkFMo1VNidWYJ
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront)
last-modified: Tue, 09 Nov 2021 11:05:10 GMT
server: AmazonS3
age: 30164
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Thu, 16 Dec 2021 04:49:12 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: GKfi-Wrqlhg9-OPaJUX7hM_NHpe0RxG7jHFjgUB4Y1UfposdW-8sqA==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame AD43 667 B
1 KB 92ms
32ms Image
image/jpeg 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=41568100078159001051022011810019&wglinkid=3432245
Requested by: Host: 6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
URL: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 9ea21905a7edfa4ceda705f977891d5e100f9709318836cfacbab47ad3321ff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:03 GMT
Last-Modified: Thu, 16 Dec 2021 12:51:03 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/jpeg
Content-Length: 667
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal90007.redintelligence.net/ Frame 2A30 0
150 B 34ms
12ms Script
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/viewability?s=22880800092894300710580011810007&a=f7017e17&vb=m
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/request_content.php?s=22880800092894300710580011810007&a=ccf119d1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:03 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame AD43 16 B
232 B 80ms
80ms Fetch
application/json 54.72.0.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.72.0.164 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-72-0-164.eu-west-1.compute.amazonaws.com

Software

nginx / PHP/7.4.25

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 16 Dec 2021 12:51:04 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.25
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 108ms
31ms Preflight 54.72.0.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.0.164 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-0-164.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 16 Dec 2021 12:51:04 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CB3A 42 B
64 B 73ms
72ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvjWR5EFrMWZzp3aaPncKsZ9YAlK_No0oIhtDqjgkWL1JRkWJREIMGmETRJsWqvPl62XAcj6XsuzSMNQ80d4gkH7SyrArFD3zlpj9agiRBGyYiiZfNO&sig=Cg0ArKJSzPPhJV4PqyFHEAE&id=lidar2&mcvt=1000&p=173,436,263,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=19&adk=2750535117&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639659062236&rpt=1338&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H/1.1 200
OK views
prod-spokesman-proxy-connext.azurewebsites.net/api/ Frame 0
0 644ms
186ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=ab31bcf97d2f74f8b52e0f9427c6032e&ConfigCode=SPOKESMAN&SiteCode=SR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Origin: https://www.spokesman.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
X-Powered-By: ASP.NET
Date: Thu, 16 Dec 2021 12:51:05 GMT
Content-Length: 0

GET
H/1.1 200
OK views Show response
prod-spokesman-proxy-connext.azurewebsites.net/api/ 64 B
979 B 188ms
187ms Fetch
application/json 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=ab31bcf97d2f74f8b52e0f9427c6032e&ConfigCode=SPOKESMAN&SiteCode=SR
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: 26a3fabdf71141620385737bed9c17655464346664a470a1bdd006c96660d940

Request headers

authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3MTE2NTkwNjF9.yBYp2aVmZv_JNYFv7Ak9ZFFGRRy5xMDSFVayiVUl8BA
source-system: Plugin
site-code: SR
autoqa: false
Accept-Language: de-DE,de;q=0.9
settingskey: null
ssid: e147a7e1f83f250e3929b25c14301060
environment: prod
config-code: SPOKESMAN
access-control-allow-origin: *
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type: application/json
location: System
accept: application/json
Referer: https://www.spokesman.com/
version: Version: 2.8.2

Response headers

Pragma: no-cache
Date: Thu, 16 Dec 2021 12:51:05 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ASP.NET
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Server-Time
Cache-Control: no-cache
Content-Length: 176
X-Server-Time: 12/16/2021 12:51:05 PM
Expires: -1

POST
H2 200 /
a2.adform.net/serving/unload/ Frame CB3A 35 B
503 B 87ms
87ms Ping
image/gif 185.167.164.51
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/serving/unload/?version=15&unload=939673718357384580@@51797166,7343658108691971538,100|1100|0|0|0|0|0|0|0||38|1|||||1|0|0|SgN6U6tO5bNcPlakbYq96a1AHUCRk8FuH9pJcYBQ5_iV-UbW_6NIiYm3nyX34Xgm0|||11||0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.51 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 12:51:05 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 110ms
109ms Image
image/jpeg 54.231.192.105
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.231.192.105 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:06 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Server: AmazonS3
x-amz-request-id: 7792J15VEJBMVRSM
ETag: "ef2cc7f55b7ab677b023e36033e26471"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 631
x-amz-id-2: IdpQcywBrOfVpDlE7eOpcP18QBVnwZxUoQXda+lhLmqKKeitexjnoQQR423VvP02yqNwswClRxQ=
x-amz-meta-s3b-last-modified: 20191015T134358Z

GET
H/1.1 200
OK index.js Show response
d1wa9546y9kg0n.cloudfront.net/ 6 KB
7 KB 8ms
8ms Script
application/x-javascript 143.204.101.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1wa9546y9kg0n.cloudfront.net/index.js
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-221.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8431f4973d02bcceeadba217953b9a058dad0b1d958f9ba25f9fccfe95d7ae42

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 06:20:43 GMT
Via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
Last-Modified: Tue, 23 Feb 2016 09:35:10 GMT
Server: AmazonS3
Age: 23423
ETag: "cf67eb51479caf3b57c3577a08b6a038"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 6494
X-Amz-Cf-Id: Ebz05JNOUZ0CB3D97BSE1zF-dzXwJ_jTpxcnL2ZJ_t1l15k_xULkEw==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
40ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MeterLevelSet&el=%7B%22MeterDetermineMethod%22%3A%22Default%22%2C%22MeterRuleName%22%3A%22NA%22%2C%22MeterLevel%22%3A%22Metered%22%7D&_u=aCDACEABBAAAAG~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&gtm=2wgc10WQTQTTW&cd1=1639659066044.csavparl&cd2=ab31bcf97d2f74f8b52e0f9427c6032e&cd5=Not%20Set&cd6=Unknown&cd7=Metered&cd8=Not%20Set&cd9=Not%20Set&cd3=Not%20Set&cd4=Not%20Set&cd10=Not%20Set&cd11=Not%20Set&cd12=Not%20Set&cd13=Not%20Set&cd14=Not%20Set&cd15=Not%20Set&cd16=story&cd17=Not%20Set&cd18=Default&z=31674664

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22079
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MeterStart&el=%7B%22ConversationName%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ConversationDateStarted%22%3A%22Not%20Set%22%2C%22ConversationDateEnded%22%3A%22Not%20Set%22%2C%22ConversationDateExpiratation%22%3A%22Not%20Set%22%2C%22ConversationPaywallLimit%22%3A%22Not%20Set%22%2C%22ArticleViews%22%3A%22Not%20Set%22%7D&_u=aCDACEABBAAAAG~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&gtm=2wgc10WQTQTTW&cd1=1639659066221.2vl1k9uq&cd2=ab31bcf97d2f74f8b52e0f9427c6032e&cd5=Not%20Set&cd6=Unknown&cd7=Metered&cd8=Not%20Set&cd9=Not%20Set&cd3=Not%20Set&cd4=Not%20Set&cd10=Not%20Set&cd11=Not%20Set&cd12=Not%20Set&cd13=Not%20Set&cd14=Not%20Set&cd15=Not%20Set&cd16=story&cd17=Not%20Set&cd18=Default&z=1249688846

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22079
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=ConversationDetermined&el=%7B%22ConversationName%22%3A%22First%20Time%20Visitor%20-%20B%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ConversationDateStarted%22%3A%222021-12-16T12%3A51%3A06Z%22%2C%22ConversationDateEnded%22%3A%22Not%20Set%22%2C%22ConversationDateExpiratation%22%3A%222021-12-17T12%3A51%3A06Z%22%2C%22ConversationPaywallLimit%22%3A%222%22%2C%22ArticleViews%22%3A%221%22%7D&_u=aCDACEABBAAAAG~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&gtm=2wgc10WQTQTTW&cd1=1639659066226.67hog2h&cd2=ab31bcf97d2f74f8b52e0f9427c6032e&cd5=Not%20Set&cd6=Unknown&cd7=Metered&cd8=First%20Time%20Visitor%20-%20B&cd9=1&cd3=Not%20Set&cd4=Not%20Set&cd10=1&cd11=2&cd12=2021-12-16T12%3A51%3A06Z&cd13=2021-12-17T12%3A51%3A06Z&cd14=Not%20Set&cd15=Not%20Set&cd16=story&cd17=Not%20Set&cd18=Default&z=39856428

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22079
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 100013ftv-inline.jpg
cdn.czx5eyk0exbhwp43ya.biz/upload_images/ 39 KB
40 KB 43ms
7ms Image
image/jpeg 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.czx5eyk0exbhwp43ya.biz/upload_images/100013ftv-inline.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FF5) /
Resource Hash: c0c6cfe1c73870d62f5ff9dab41dd95fb95bd3f40a49100947a6465391ba8fc2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: AppendBlob
date: Thu, 16 Dec 2021 12:51:06 GMT
age: 145669
x-cache: HIT
content-length: 40109
x-ms-lease-status: unlocked
last-modified: Wed, 02 Jun 2021 19:56:28 GMT
server: ECAcc (frc/8FF5)
x-ms-blob-committed-block-count: 1
etag: 0x8D9260082E44DFF
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 44d6b0ba-e01e-00cd-6d28-f14337000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 fontawesome-webfont.woff2
cdn.czx5eyk0exbhwp43ya.biz/prod/fonts/ 2 KB
2 KB 29ms
8ms Font
application/octet-stream 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/fonts/fontawesome-webfont.woff2?98120622
Requested by: Host: cdn.ayc0zsm69431gfebd.xyz
URL: https://cdn.ayc0zsm69431gfebd.xyz/prod/spokesman/t8y9347t.min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F40) /
Resource Hash: c9438bf6c7a6122ea18edeb717850798c337311b634d1ab61c374f5e92e08a2a

Request headers

Referer: https://cdn.ayc0zsm69431gfebd.xyz/
Origin: https://www.spokesman.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 16 Dec 2021 12:51:06 GMT
content-md5: 4KZHfCb3p1RwzI0cUtcF7g==
age: 101014
x-cache: HIT
content-length: 1720
x-ms-lease-status: unlocked
last-modified: Thu, 17 Dec 2020 10:16:38 GMT
server: ECAcc (frc/8F40)
etag: 0x8D8A274D72F017A
content-type: application/octet-stream
access-control-allow-origin: *
x-ms-request-id: 2b58156d-401e-00c0-1b90-f1ac3b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 104ms
104ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&metered=1%7C2&metername=First%20Time%20Visitor%20-%20B&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=061f86db-00c5-4cd2-8892-73a78741eca5&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659066311&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4800&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiaW5saW5lIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDAwMDEiLCJuYW1lIjoiU3Bva2VzbWFuIFJldmlldyBDYW1wYWlnbiJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIEIiLCJvcmRlciI6IjIifSwiYWN0aW9uIjp7Im5hbWUiOiJGVFYgQiAtIElubGluZSIsInR5cGVJZCI6IjQiLCJ0eXBlTmFtZSI6ImlubGluZSIsIm9yZGVyIjoiNCJ9fSwidmVuZG9yIjoibWcyIiwidHlwZSI6InVua25vd24ifSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiIxMjM4NDcwNTcyIiwicmVmVGltZSI6IjE2Mzk2NTkwNjYzMTEifSx7InR5cGUiOiJtZzIiLCJpZCI6ImFiMzFiY2Y5N2QyZjc0ZjhiNTJlMGY5NDI3YzYwMzJlIiwicmVmVGltZSI6IjE2Mzk2NTkwNjYyOTgifV0sIm1nMkRhdGEiOnsidmVyc2lvbiI6IlZlcnNpb246IDIuOC4yIiwiZW52aXJvbm1lbnQiOiJwcm9kIiwiYXV0aFN5c3RlbSI6Ik1HMiIsImNhbXBhaWduTmFtZSI6IlNwb2tlc21hbiBSZXZpZXcgQ2FtcGFpZ24iLCJjYW1wYWlnbklkIjoiMTAwMDAxIiwic3Vic2NyaXB0aW9ucyI6W10sImNvbnZlcnNhdGlvbiI6eyJJZCI6IjEwMDExNCIsIk5hbWUiOiJGaXJzdCBUaW1lIFZpc2l0b3IgLSBCIiwiT3JkZXIiOiIyIiwiUHJvcGVydGllcyI6eyJQYXl3YWxsTGltaXQiOiIyIiwiVmlld3MiOiIxIiwiRGF0ZSI6eyJFeHBpcmF0aW9uIjoiMjAyMS0xMi0xN1QxMjo1MTowNi4xMTRaIiwiU3RhcnRlZCI6IjIwMjEtMTItMTZUMTI6NTE6MDYuMTE0WiJ9LCJBcnRpY2xlTGVmdCI6IjEiLCJWaWV3VHlwZSI6IkNvbnZlcnNhdGlvbiIsIlBheXdhbGxJbmZvIjp7IkFydGljbGVMZWZ0Ijp7IkNvbnZlcnNhdGlvbiI6IjEiLCJNZXRlciI6InVubGltaXRlZCJ9LCJMaW1pdCI6eyJDb252ZXJzYXRpb24iOiIyIiwiTWV0ZXIiOiJ1bmxpbWl0ZWQifSwiTWluVmlldyI6IkNvbnZlcnNhdGlvbiJ9fX19LCJ1c2VyRGF0YSI6eyJtZzJEYXRhIjp7Ik93bmVkU3Vic2NyaXB0aW9ucyI6W10sIkF1dGhTeXN0ZW0iOiJNRzIiLCJEaWdpdGFsQWNjZXNzIjp7IkFjY2Vzc0xldmVsIjp7fSwiU3Vic2NyaXB0aW9uIjpbXX0sIklnbVJlZ0lEIjpudWxsLCJFbWFpbCI6IiIsIk56d0xpZCI6bnVsbCwiTWFzdGVySWQiOm51bGwsIkRpc3BsYXlOYW1lIjoiIn19fQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:06 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=ActionShown&el=%7B%22ConversationName%22%3A%22First%20Time%20Visitor%20-%20B%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ActionName%22%3A%22FTV%20B%20-%20Inline%22%2C%22ActionType%22%3A%22Inline%22%7D&_u=aCDACEABBAAAAG~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&gtm=2wgc10WQTQTTW&cd1=1639659066322.4hyvao1j&cd2=ab31bcf97d2f74f8b52e0f9427c6032e&cd5=Not%20Set&cd6=Unknown&cd7=Metered&cd8=First%20Time%20Visitor%20-%20B&cd9=1&cd3=Not%20Set&cd4=Not%20Set&cd10=1&cd11=2&cd12=2021-12-16T12%3A51%3A06Z&cd13=2021-12-17T12%3A51%3A06Z&cd14=FTV%20B%20-%20Inline&cd15=Inline&cd16=story&cd17=Not%20Set&cd18=Default&z=1843865444

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22079
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 40ms
39ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=ActionShown&el=%7B%22ConversationName%22%3A%22First%20Time%20Visitor%20-%20B%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ActionName%22%3A%22FTV%20B%20-%20Banner%20-%201st%20Article%22%2C%22ActionType%22%3A%22Banner%22%7D&_u=aCDACEABBAAAAG~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&gtm=2wgc10WQTQTTW&cd1=1639659066414.s7etgm4&cd2=ab31bcf97d2f74f8b52e0f9427c6032e&cd5=Not%20Set&cd6=Unknown&cd7=Metered&cd8=First%20Time%20Visitor%20-%20B&cd9=1&cd3=Not%20Set&cd4=Not%20Set&cd10=1&cd11=2&cd12=2021-12-16T12%3A51%3A06Z&cd13=2021-12-17T12%3A51%3A06Z&cd14=FTV%20B%20-%20Banner%20-%201st%20Article&cd15=Banner&cd16=story&cd17=Not%20Set&cd18=Default&z=1121725985

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22079
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1102132370&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&ul=en-us&de=UTF-8&dt=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=PageView&el=%7B%22Page%22%3A%22Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review%22%2C%22ContentType%22%3A%22article%22%2C%22MeterLevel%22%3A%22Metered%22%7D&_u=aCDACEABBAAAAG~&jid=&gjid=&cid=1238470572.1639659060&tid=UA-230256-42&_gid=1344418452.1639659060&gtm=2wgc10WQTQTTW&cd1=1639659066449.tjo1n4zm&cd2=ab31bcf97d2f74f8b52e0f9427c6032e&cd5=Not%20Set&cd6=Unknown&cd7=Metered&cd8=First%20Time%20Visitor%20-%20B&cd9=1&cd3=Not%20Set&cd4=Not%20Set&cd10=1&cd11=2&cd12=2021-12-16T12%3A51%3A06Z&cd13=2021-12-17T12%3A51%3A06Z&cd14=FTV%20B%20-%20Banner%20-%201st%20Article&cd15=Banner&cd16=story&cd17=Not%20Set&cd18=Default&z=1033594617

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 06:43:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22079
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 102ms
102ms Image
image/gif 34.195.91.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=Will%20Bunch%3A%20Nothing%20is%20more%20important%20than%20Team%20Trump%27s%20January%20PowerPoint%20urging%20a%20full-blown%20coup%20%7C%20The%20Spokesman-Review&metered=1%7C2&metername=First%20Time%20Visitor%20-%20B&tv=js-3.0.146&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=18&tid=7e56d1d5-138b-4438-8998-e3242d593949&pid=a289455f-5326-441e-9591-f2290654173b&dtm=1639659066395&qnm=_matherq&visible=1&tabid=3876c242-b86e-4369-aede-45bc9f93f282&url=https%3A%2F%2Fwww.spokesman.com%2Fstories%2F2021%2Fdec%2F16%2Fwill-bunch-nothing-is-more-important-than-team-tru%2F&vp=1600x1200&ds=1600x4800&tofa=1639659060&vid=1&lvidt=1639659060&duid=dfd1cbc37671ec73&fp=401617179&cid=ma20153&mrk=575681700&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiYmFubmVyIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDAwMDEiLCJuYW1lIjoiU3Bva2VzbWFuIFJldmlldyBDYW1wYWlnbiJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIEIiLCJvcmRlciI6IjIifSwiYWN0aW9uIjp7Im5hbWUiOiJGVFYgQiAtIEJhbm5lciAtIDFzdCBBcnRpY2xlIiwidHlwZUlkIjoiMSIsInR5cGVOYW1lIjoiYmFubmVyIiwib3JkZXIiOiI1In19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjEyMzg0NzA1NzIiLCJyZWZUaW1lIjoiMTYzOTY1OTA2NjM5NSJ9LHsidHlwZSI6Im1nMiIsImlkIjoiYWIzMWJjZjk3ZDJmNzRmOGI1MmUwZjk0MjdjNjAzMmUiLCJyZWZUaW1lIjoiMTYzOTY1OTA2NjM4NiJ9XSwibWcyRGF0YSI6eyJ2ZXJzaW9uIjoiVmVyc2lvbjogMi44LjIiLCJlbnZpcm9ubWVudCI6InByb2QiLCJhdXRoU3lzdGVtIjoiTUcyIiwiY2FtcGFpZ25OYW1lIjoiU3Bva2VzbWFuIFJldmlldyBDYW1wYWlnbiIsImNhbXBhaWduSWQiOiIxMDAwMDEiLCJzdWJzY3JpcHRpb25zIjpbXSwiY29udmVyc2F0aW9uIjp7IklkIjoiMTAwMTE0IiwiTmFtZSI6IkZpcnN0IFRpbWUgVmlzaXRvciAtIEIiLCJPcmRlciI6IjIiLCJQcm9wZXJ0aWVzIjp7IlBheXdhbGxMaW1pdCI6IjIiLCJWaWV3cyI6IjEiLCJEYXRlIjp7IkV4cGlyYXRpb24iOiIyMDIxLTEyLTE3VDEyOjUxOjA2LjExNFoiLCJTdGFydGVkIjoiMjAyMS0xMi0xNlQxMjo1MTowNi4xMTRaIn0sIkFydGljbGVMZWZ0IjoiMSIsIlZpZXdUeXBlIjoiQ29udmVyc2F0aW9uIiwiUGF5d2FsbEluZm8iOnsiQXJ0aWNsZUxlZnQiOnsiQ29udmVyc2F0aW9uIjoiMSIsIk1ldGVyIjoidW5saW1pdGVkIn0sIkxpbWl0Ijp7IkNvbnZlcnNhdGlvbiI6IjIiLCJNZXRlciI6InVubGltaXRlZCJ9LCJNaW5WaWV3IjoiQ29udmVyc2F0aW9uIn19fX0sInVzZXJEYXRhIjp7Im1nMkRhdGEiOnsiT3duZWRTdWJzY3JpcHRpb25zIjpbXSwiQXV0aFN5c3RlbSI6Ik1HMiIsIkRpZ2l0YWxBY2Nlc3MiOnsiQWNjZXNzTGV2ZWwiOnt9LCJTdWJzY3JpcHRpb24iOltdfSwiSWdtUmVnSUQiOm51bGwsIkVtYWlsIjoiIiwiTnp3TGlkIjpudWxsLCJNYXN0ZXJJZCI6bnVsbCwiRGlzcGxheU5hbWUiOiIifX19
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.91.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-91-69.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 12:51:06 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

128 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

38 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru	1970-01-19 23:27:40	Name: _gada_ses.e3de Value: *
www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru	1970-01-20 16:58:51	Name: _gada_id.e3de Value: d939ada1-61d1-4c78-b23f-fcc6352aaafb.1639659061.1.1639659061.1639659061.cfd9b059-78e9-496f-846e-bfbd09242dbf
www.spokesman.com/stories/2021/dec/16/will-bunch-nothing-is-more-important-than-team-tru	1970-01-19 23:29:05	Name: privAu Value: 0
.spokesman.com/	1970-01-20 16:58:51	Name: _ga_G3BY0LGVDL Value: GS1.1.1639659060.1.0.1639659060.0
.spokesman.com/	1970-01-19 23:27:40	Name: _sp_ses.53c5 Value: *
.spokesman.com/	1970-01-20 16:58:51	Name: _ga Value: GA1.2.1238470572.1639659060
.spokesman.com/	1970-01-19 23:29:05	Name: _gid Value: GA1.2.1344418452.1639659060
.spokesman.com/	1970-01-19 23:27:39	Name: _dc_gtm_UA-230256-14 Value: 1
.spokesman.com/	1970-01-19 23:27:40	Name: __asc Value: db97810617dc34bbf392bc38273
.spokesman.com/	1970-01-20 08:14:41	Name: __auc Value: db97810617dc34bbf392bc38273
.pymx5.com/	1970-01-20 03:46:51	Name: _ia_uid Value: eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.8GrYuHqHTccPQidVpewEf2hI9-rT7c2vHWJn5564j4eeaA9xCajmkA.nlsJKQ_mx901o7KJ.pZbxhfurnCl17iu6lquXndKxLANtLfvZtHcHDHFIu_Oo4Cm0UR303YS055hw4akyH_HR9IVMQtjvMaprazEbievZt2kukLABbHtdAoCBbZe6MrnlZas620izK82IsDHKOwExWi80VklyuqVP71E8RUiBSPONNUlwBxtlfJ3fe6uGyJs1Ru4s4bVsOmAsqkQ3SRyEEnC5p7l91KKDT625fyLYHrRmo8U-plyq-SVQZMJNc3I66WlP2qEtDjXC1LxB6bNyvCDKHLn3g5e62Wih5awIWNKfXE7v_ZBvGMSSsMdrcnE5D61_12xzsA3ybt0GINymz8lrljB-wGR74PlbY9rS3xkSGaZytnpKCwOqJm8.qQZbCmPq9tGJSgQVLoLHjw
.pymx5.com/	1970-01-20 03:46:51	Name: _ia_version Value: 2
www.spokesman.com/	1970-01-20 08:13:15	Name: ai_user Value: qd4iV\|2021-12-16T12:51:01.290Z
.spokesman.com/	1970-02-25 11:27:39	Name: anonDeviceId Value: ab31bcf97d2f74f8b52e0f9427c6032e
.spokesman.com/	1970-01-19 23:27:39	Name: _gat_UA-230256-42 Value: 1
www.spokesman.com/	1970-01-19 23:27:40	Name: ai_session Value: pC6Mb\|1639659062008.2\|1639659062008.2
.spokesman.com/	1970-01-20 08:49:15	Name: __gads Value: ID=358bb41207c0e9a9-22bdb71e09cd0021:T=1639659060:S=ALNI_MaG7_0WH_4bwb_LjwQO6_zIKXBUAQ
.doubleclick.net/	1970-01-20 08:49:15	Name: IDE Value: AHWqTUnUAmjFryqf1FuTfX9vLrPT2d6UeD00QQ0D83VCJz_zsW7g7szbdsvDEZaguc8
.casalemedia.com/	1970-01-20 08:13:15	Name: CMID Value: Ybs2NpTxL6NV280fo-f2kgAA
.casalemedia.com/	1970-01-20 01:37:15	Name: CMPS Value: 3270
.adform.net/	1970-01-20 00:12:17	Name: C Value: 1
.adnxs.com/	1970-01-20 01:37:15	Name: uuid2 Value: 4788446452718496451
.casalemedia.com/	1970-01-20 01:37:15	Name: CMPRO Value: 1211
.casalemedia.com/	1970-01-19 23:29:05	Name: CMST Value: Ybs2NmG7NjYA
.casalemedia.com/	1970-01-20 08:13:15	Name: CMRUM3 Value: 2d61bb36362760CAESEE0MAety60foZwwStqoK4AI
.adnxs.com/	1970-01-20 01:37:15	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In7er-4!!]tbPl1M>e)ZlrFUfJ+tGXxp)BK//qE!^c9)zSza?@p'I6hwjc?13=HlPcbpRzqF1`b`:a1<0(
.redintelligence.net/	1970-01-20 01:37:15	Name: 8lcfmzhxc8d6_uid Value: 1e7202ecb8a4a8ea
.spokesman.com/	1970-01-20 00:01:26	Name: nxt_ab_test_SR_SPOKESMAN_PROD Value: {%22ABExperimentId%22:100001%2C%22ABExperimentName%22:%22Offer%20Change%20-%20$5%20for%206%20Months%22%2C%22ABGroup%22:%22B%22%2C%22ABGroupName%22:%22B%20Test%22}
.adform.net/	1970-01-20 00:54:03	Name: uid Value: 939673718357384580
.adform.net/	1970-01-19 23:37:43	Name: TPC Value: 1639659063232
.awin1.com/	1970-01-19 23:30:31	Name: awpv18332 Value: 296283\|1639659063\|d3e47121-5e6e-11ec-92b1-22382f8dc9cc
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 376776:2601049
.medialead.de/	1970-01-20 08:13:15	Name: trscj Value: MTYzOTY1OTA2NHxMM1J5WTJzdlpYQjJMMlU1T1dGaFkyVTVOR1UyWlRVNE56TTRPREZrTXpRd01EazVNMlV4WlRkbFAzTjFZbWxrUFRJeU9EZ3dPREF3TURreU9EazBNekF3TnpFd05UZ3dNREV4T0RFd01EQTNKblE5YUhSc2NBPT18YUhSMGNITTZMeTgyT1RrMFlUSTNOalppT0RZMU1UazJOR1l5TTJFNE5UVTBOMlU1WlROa055NXpZV1psWm5KaGJXVXVaMjl2WjJ4bGMzbHVaR2xqWVhScGIyNHVZMjl0THc9PQ%3D%3D
pb.media01.eu/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 0dsxhaxml1eongslqvmndu1t
pb.media01.eu/	1970-01-20 16:58:51	Name: DTU Value: 6C11B92EED1BDC4C8799128475C8C54E
.spokesman.com/	1970-01-19 23:29:05	Name: nxt_upd_ac_SR_SPOKESMAN_PROD Value: 1
.spokesman.com/	1970-01-20 16:58:51	Name: _sp_id.53c5 Value: dfd1cbc37671ec73.1639659060.1.1639659066.1639659060
.spokesman.com/	1978-01-11 12:46:04	Name: nxt_SR_SPOKESMAN_PROD Value: {%222%22:{%22100114%22:{%22ac%22:1%2C%22ac_d%22:1%2C%22s%22:%222021-12-16T12:51:06.114Z%22}%2C%22_ac_d%22:1%2C%22_ac%22:1%2C%22_acnv%22:100114}}

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js(Line 9) Message: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6994a2766b8651964f23a85547e9e3d7.safeframe.googlesyndication.com
a2.adform.net
aamapi.com
aamcf.aamsitecertifier.com
aamcftag.aamsitecertifier.com
ad-server.eu
adservice.google.com
adservice.google.de
analytics.webgains.io
api-35-87-123-161.aamapi.com
api-mg2.db-ip.com
api.circularhub.com
api.pymx5.com
api.webgains.io
az416426.vo.msecnd.net
cdn.ayc0zsm69431gfebd.xyz
cdn.czx5eyk0exbhwp43ya.biz
cdn.sbgsodufuosmmvsdf.info
certify.alexametrics.com
cm.g.doubleclick.net
d1wa9546y9kg0n.cloudfront.net
d31qbv1cthcecs.cloudfront.net
dc.services.visualstudio.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
googleads.g.doubleclick.net
h.cloudengage.com
hal9000.redintelligence.net
hal90007.redintelligence.net
ib.adnxs.com
js.matheranalytics.com
loader-cdn.azureedge.net
medialead.de
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pb.media01.eu
polyfill.io
prod-spokesman-proxy-connext.azurewebsites.net
pv.medialead.de
pymx5.com
redirect.prod.experiment.routing.cloudfront.aws.a2z.com
s1.adform.net
securepubads.g.doubleclick.net
static.spokesman.com
stats.g.doubleclick.net
thumb.spokesman.com
tpc.googlesyndication.com
track.webgains.com
www.awin1.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
www.spokesman.com
104.111.239.217
104.26.4.15
107.178.250.234
13.85.16.224
138.201.63.157
142.250.184.226
142.250.185.130
143.204.101.221
143.204.98.17
143.204.98.34
143.204.98.43
143.204.98.5
145.239.193.130
185.167.164.51
185.33.220.145
2.18.234.21
2600:1f14:600:6e00:30b0:ae3e:5fa8:bc2c
2600:1f14:600:6e00:77cb:3957:e000:1f7f
2600:9000:2156:1e00:14:c3e7:6780:93a1
2600:9000:2156:1e00:1e:dc88:cb00:93a1
2600:9000:2156:a00:2:4597:5e80:93a1
2600:9000:2156:e800:0:b5fb:e6c0:93a1
2606:2800:233:1cb7:261b:1f9c:2074:3c
2a00:1450:4001:80e::2008
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::200e
2a00:1450:4001:813::2003
2a00:1450:4001:827::200a
2a00:1450:4001:82a::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
2a00:1450:400c:c06::9d
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:200::282
34.195.91.69
34.208.153.184
34.96.74.203
35.227.203.93
35.87.123.161
37.157.6.236
44.241.169.29
46.236.13.147
52.143.76.118
52.236.186.217
54.231.192.105
54.72.0.164
54.76.176.197
78.46.90.238
88.198.250.30
94.23.99.218
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62
0ae7f141db97da757eaab464500c6e750de71638cae4fd68d415ca4648dbd4ee
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
0f2664874071206d407f0f842bb7486710a6b644a91f8763de7323271d6d0a24
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11a0443fb3a3eccb14c0325c8aa4d86e72f3855007bb5055f23012f956e65c20
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
18e0b50e12f93086cfb9acdf9deda140f94346bea98c89632b67a15135b45a5d
1907478e8fa62801a1db26be87cab0755288131c9c8e80320582e560825df3cc
1f647589f081c26a24954bf8f32fb7ea1b828fe3a41cebc760154191a167efea
26a3fabdf71141620385737bed9c17655464346664a470a1bdd006c96660d940
2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
30d2143e5e0ad4af94bf25a55ea17ac1451f5f8b91ff96dc4a32b4791aaeeab8
324f166ee7e8ff95bb43a6020bbfc4ed3ab6b942930d99af565a5caf088f5514
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
42cfa647cc7b2d88d12aeaae7d09e1a91757e5ac2672fef2cfb681124759f1d5
432afd7c7188562f355165fc68a8e628f035a81e338a51cf355cc1e55c929233
45e7be9cc2252a8af0b505407916c872ea9c7cf0fbe7b090e1e6f0f48a0a4df4
48ab653c06f099d89a710112a2eae9ea1cfcbabcace357575b09eac3556be2f8
492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c27bf0209d7ca951bab976c15d4d02b613dd62eeaabb7abe53fb4cecb9f660c
4e7151e825c0212319858a5b8c145ffdc1ad5900186e8551b4c673b91e48dbf4
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50cbf3c9c403a5aea1e1c68a552c71f1e68b280a23e745cd9062f28ca44961c3
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
53f0cf5f2fef7e5a938d553f62eb56266d1ac4e244eb7dcd40630614485fdacd
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5b021ee6283cde5010ffda78c227f7fb3c7a8831f9978e3616468a2c576d0d7d
5ba65148259568967389d182b434f97e0da7b6cd83abf926a602433a340ca9d0
5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
64cf82f7e450115ea6cc0724a1c15acc7886ef4741395c4b8eeff68650f42809
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bc2961f59c01ea3adeae738e02e2b817a4753ebfa58684646282c84e6301d91
6f2a4c20e0c0ecea553428a17fa567ad691d9f490fa3469da05631d48e2f4e43
6f863b76431fe0df437b6d1c1cc5d7d5a2b48081a13197d41a6719e6ee0e20f9
74968c2eb2c9eb642e9727e95fc845c69c8783922e368d5e844ac7446b7b6146
75b87be050878bf48f81eae0629be4b584a24d9cf7f894def408d83037f2c13e
7a302ee9c6b8f81716ef6cb8da24e0dcc66f55a8173fa1ba39774018dc6f211a
802d854dc9807d9ea486614494e54c22469bcbd0a4c165e25a92e02ce2d82e09
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8431f4973d02bcceeadba217953b9a058dad0b1d958f9ba25f9fccfe95d7ae42
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
9182d1491100797b6b7addd771f782e1daa0d6788c2d7ebfa3570a21b1637b34
918c5c89b6df58895dbc7ea7663dae669300da3a79e2857e443d1d66265a92f0
933e6b902576f1f6615df407f8ceebb87e7b91d605a1699ec169e6753e75ab7c
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
9437490e4f56c98a9918b0e8f8f077f9e83f27ee69c1547ac1f229fcb4470fae
9938ce63ddec630645e903bede29aacb1541c88fa2179097ae2513502cd0c8a1
9c05f3e7a99522d6cba125b8dd46ce8ed64068a1d08dcec309c56a58ec85cf3e
9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f
9dd881c7f521ccbc11afbe56d2634c6c02790ed7abbae20eb532366d6b42543a
9ea21905a7edfa4ceda705f977891d5e100f9709318836cfacbab47ad3321ff1
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a04635015a3fbcd058149ed73a7cc6ae74c533b537e8cfd55cfcc566edd15a20
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee
a2d874e8985a0ffde7abfe1926fed77ea6e11356ff45782d305e976721eb94b0
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a6511ab2409265fe4c48f0b4fd0daca4e5301bdd6fc8a74bff2ef1e5b309ccac
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8
af44b91aee646d43b9687c2f00450dd0ade50f4b8c7a78e6b99257f1d5e8984c
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b29e096fad99b50a208e6afc10bb138117361fbfa79fb0391dd537eb1aee66e4
b63e9c10a834e1367c980e9674536971b0e4a23670768439c60c848343958948
ba221a9ab9e5ede2412c201dfb8080fa5a33c57cbdadc35efd0a81d30a9fe59b
ba390adb5583a9ead715ce663f3bc825ab927b3764d8bd18dceec2361aa35d8c
bae07f0af0a5b35a386e9084c737760b1ddcdec3fdddf8238347b4183ded9682
c0c6cfe1c73870d62f5ff9dab41dd95fb95bd3f40a49100947a6465391ba8fc2
c1577ba94752b8302f8a5518b1ccd8b21507a7da67cd613dc990e8fd10f8ab5e
c1a476b3442043756f97fc98c480c06c65c74207e12ae6ba150eee21d7eed067
c6b85e7d83cf8c2916b4f7c92240774ee63487975ab6fd96e56d9356fe92d2fa
c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0
c93a6d7cf17c6e0456ec89bb2f2e912b75ba9b5f08033e2da7acd28f0e59b89a
c9438bf6c7a6122ea18edeb717850798c337311b634d1ab61c374f5e92e08a2a
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cd2ceb43e1780bf65e06160a4c5a76a06e1de116a617bec97b2d41c402a0e89b
ce42122da81bb58d308f8023f9594aada0107c8fe7e35666e8aee7671263f130
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d80d605ac45ef2fe7e5520d71cce9d00137b1e7b5a874951f10c5760bf2a8f97
d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf
dbd62c7f49c7b12ea4d362ad5dc2e6ee9d468b671cb55aed77354071b12b7d21
dd1b5e04d54c4420fe3e8e6abe2875fc7f13a3cd6384b6c2afc1a35e302dd846
df059da9db2824c9ecfad5ee266ee75c668aae9cbbe4afe12d2ba0f30d70a786
df6bea60b20cec5c038b730e3f0e6fd8bfa345641320b65e4efeeefc86071a91
e34d390cdb0cab173611c3071e48f0b8288ef85367a18b380373dfb3ecd25f2e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9b88df7153280c5ff946c894cb57cc4634d2ed86d0e23a95143b8087a418d7d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f6086cdcbe1661e7885a4cf0e4e3f299eda84312ce7dc5402071bf647be1174c
fa2561995f678d73840c1a264d6a697fda76e56f75cd53e5d73615e2196172dc
ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

www.spokesman.com Open in urlscan Pro 2600:9000:2156:e800:0:b5fb:e6c0:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

178 Requests

96 %HTTPS

40 %IPv6

39 Domains

59 Subdomains

52 IPs

8 Countries

3783 kBTransfer

8376 kBSize

38 Cookies

16 Outgoing links

Page URL History

Redirected requests

178 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.spokesman.com Open in urlscan Pro
2600:9000:2156:e800:0:b5fb:e6c0:93a1 Public Scan

Screenshot
Live screenshot

Full Image

178
Requests

96 %
HTTPS

40 %
IPv6

39
Domains

59
Subdomains

52
IPs

8
Countries

3783 kB
Transfer

8376 kB
Size

38
Cookies

178 HTTP transactions
8 data transactions